Legal
Privacy Policy
What we collect, who we share it with, how long we keep it, and the rights you have over it — in plain English.
Last revised 2026-07-06.
In plain English
You own your data. We don't sell it. We collect what's needed to run the app and tell you, in this document, exactly who else sees it. You can delete your account anytime — it stays recoverable for 30 days if you sign back in, after which we permanently purge everything.
That's the short version. Below is the full disclosure.
1. Who we are
Mour is a field service management app for solo and small home-services operators. The mobile app and this website are operated by Mour, a sole proprietorship owned and operated by Zen Akhtar, based in Ontario, Canada. The operator email is founder@mour.app.
For the purposes of this policy:
- You — the person or business that signs up for an account.
- We / us / our — Mour, the sole proprietorship operated by Zen Akhtar.
- Your clients — the people YOU schedule jobs for. They are not Mour customers; they're your customers, and you are their data controller. Mour processes their information only because you put it into the app.
2. What we collect
From you (the account holder)
- Identity — your name, email address, phone number.
- Business profile — business name, optional business address, optional business logo.
- Payment provider identifiers — depending on the platform you signed up on, we store one of: Apple App Store original transaction IDs (iOS), Google Play purchase tokens (Android), or Stripe customer IDs (web). We do not see or store your credit-card number — Apple, Google, and Stripe each hold your card themselves.
- Account state — your subscription tier, billing status, last-seen timestamps, push notification tokens.
From your work in the app
- Clients — the names, phone numbers, email addresses, and addresses you enter for your clients.
- Jobs — scheduled dates, services performed, prices, notes, completion photos.
- Invoices — line items, amounts, statuses (Professional tier only).
- Activity log — a record of changes you make to the data above, kept for support and audit purposes.
Automatically
- Device & app version — for push notification delivery and for telling you when you need to update.
- Operational logs — IP address, request method, timestamp, response status — retained for 90 days for debugging and abuse detection.
- Analytics and advertising — page views, referrers, and on-site interactions measured by Google Analytics, and, where enabled, conversion events measured by the Meta pixel. These set cookies. Section 8 explains how consent works and how to change it.
Location (only when used)
- Mour uses your device's location for route optimization (when you tap "Optimize Route" or "Navigate") and for the in-app map view (Professional tiers). We don't track location in the background and we don't store your location history. Location is sent to Google for routing and is not retained on our servers.
3. Who we share data with
We share data only with the service providers listed here. This list is exhaustive and includes our analytics and advertising providers.
| Provider | What they receive | Why |
|---|---|---|
| Apple App Store | Subscription state, payment provider IDs | Billing for iOS users. Apple holds your card; we never see it. |
| Google Play Billing | Subscription state, purchase tokens | Billing for Android users. Google holds your card; we never see it. |
| Stripe | Subscription state, customer + payment-method IDs | Billing for web users (app.mour.app). Stripe holds your card; we never store the card number. |
| Twilio | Your clients' phone numbers (when you send SMS) | SMS delivery and OTP for phone verification. |
| Google Maps Platform | Client addresses (for geocoding), origin + destination (for route optimization) | Geocoding API converts addresses to coordinates; Routes / Directions API optimizes the day's route. |
| Google OAuth | Your email and name (when you sign in with Google) | Authentication only. We don't request access to your Google contacts, calendar, or any other Google data. |
| Firebase Cloud Messaging (FCM) | Your device push token, notification payload | Push notification delivery on iOS and Android. |
| Cloudflare Turnstile | Your IP address and browser interaction signals (only on the contact and signup forms on this website) | Bot detection and spam prevention. Not used for advertising or cross-site tracking. |
| Google Analytics 4 | Pages you visit on this website, referrer, approximate location from your IP address, and a randomly generated device identifier stored in a cookie | Understanding how people find and use the site. |
That's the full list. If we ever add a new processor, this table is the place where it appears, and a /changelog entry will call it out.
4. Children
Mour is not intended for users under 18. We do not knowingly collect data from anyone under 13 (COPPA jurisdiction). If we learn we've collected information from a child, we delete it.
5. Retention
- Operational logs (IP, request path, response code): 90 days, then deleted.
- Deleted accounts: recoverable for 30 days by signing in again, then permanently purged (no recovery after that).
- Photos: retained as long as the parent job exists. Deleting a job deletes its photos. Deleting your account purges all photos in the 30-day grace window.
- Activity log (your in-app changes): purged on the same schedule as the parent record (e.g. when a job is deleted).
- Invoices: retained as long as your account exists — these may be tax records.
- Backups: encrypted nightly backups are retained for 30 days. Deleted records are no longer recoverable from new backups after they leave that window.
6. Your rights
You can:
- Access the data we hold about you — email founder@mour.app and we'll send you a download link within a day or two (typically faster).
- Correct anything you see in the app — by editing it in the app.
- Delete your account — Settings → Danger Zone → Delete Account, in the mobile app or the web app. We deactivate it immediately; sign in again within 30 days to restore it, otherwise we permanently purge after 30 days.
- Object to processing for any data not strictly needed to run the app — email founder@mour.app.
- Opt out of SMS — text STOP to any Mour SMS message (or have your client text STOP — see TCPA section below).
These rights apply regardless of jurisdiction; we honor GDPR/CCPA-style requests as a matter of policy, not just where law requires it.
7. SMS & TCPA compliance
Mour can send SMS notifications to your clients about appointments you scheduled for them. This carries legal responsibilities:
- You are the sender, legally speaking. Mour delivers the message on your behalf via Twilio. When you opt into SMS for a client, you are warranting that you have that client's consent to receive transactional messages from your business.
- STOP keyword is honored. Anyone who replies STOP, UNSUBSCRIBE, CANCEL, END, or QUIT to a Mour SMS is opted out for that client, immediately. Future messages to that phone number are blocked at the Mour level.
- HELP keyword is answered. Reply HELP to any Mour SMS to receive support information — you will get: "Mour alerts. For support: support@mour.app. Reply STOP to unsubscribe."
- Opt-out instructions are included regularly. The text "Reply STOP to opt out. Msg & data rates may apply." is appended to the first SMS Mour sends to any new phone number on your behalf, and re-included on the first message of each new calendar month, so the opt-out path stays discoverable.
- How consent is collected. Operators obtain each client's consent before adding their number, then record it in the app via a required consent checkbox. The full opt-in flow is described publicly at How clients opt in to SMS.
- A2P 10DLC. Mour's SMS sending is registered for A2P 10DLC business messaging via Twilio under the brand "Mour." Messages are transactional service notifications (appointment, invoice, and job updates) plus, on the Professional plan, occasional service reminders and offers sent only to clients who have consented.
- Outbound only. Mour's SMS is one-way — it sends notifications to your clients. Client replies to those texts are not monitored, stored, or surfaced in the app.
- Message frequency & rates. Message frequency varies based on your account activity and the appointments you schedule. Message and data rates may apply.
- No sharing of mobile data. We do not sell, rent, or share SMS opt-in data or mobile phone numbers with third parties or affiliates for marketing or promotional purposes. Phone numbers are disclosed only to Twilio, solely to deliver the messages you send — never for marketing.
8. Cookies and tracking
- Essential cookies — one session cookie that holds your CSRF token while you're filling out the contact form. No login cookies (this site has no login).
- Analytics — Google Analytics. We see page-view counts, referrers, and conversion events. Google Signals and ads personalization are switched off, so Google does not link this activity to your Google account on our behalf.
- Bot protection — the contact and signup forms on this website use Cloudflare Turnstile. Cloudflare sees your IP address and interaction signals on those two forms to tell humans from bots; it does not track you across sites.
- Advertising — where enabled, the Meta pixel records which visits lead to a signup, so we can tell whether our advertising is worth running.
- Your choice. Advertising cookies are never set until you accept, anywhere in the world. Analytics cookies work the same way in the European Economic Area, the United Kingdom, Switzerland, Quebec, Brazil, and six US states — California, Colorado, Connecticut, Texas, Utah, and Virginia — nothing is stored until you accept. Elsewhere, analytics is on when you arrive and you can decline at any time; we honour it from that moment on.
- No third-party fonts that fingerprint. We use the Inter typeface, served from Google Fonts. Google sees your IP when your browser fetches the font file, but Google Fonts does not set cookies or identify you across sites.
A cookie banner appears on your first visit with Accept and Decline. Your choice is stored in your browser, and you can change it at any time using Cookie settings in the footer.
9. Security
- Transport: TLS 1.2 or higher on every connection. Browsers refuse plain HTTP to mour.app and our subdomains.
- At rest: photos are stored on encrypted disk. Backups are encrypted and rotated nightly.
- Authentication: API tokens with a 30-day expiry; sign-in tokens are scrubbed from the URL on capture so they don't leak via browser history or referer headers.
- No card data: we don't see, store, or transmit credit-card numbers — Apple, Google, and Stripe each hold cards on their side; Mour only stores their provider-issued IDs.
- Disclosure: if a breach occurs that materially affects your account, we'll notify you within 72 hours of discovery.
For more, see /security.
10. International transfers
Our servers are in the United States. If you use Mour from outside the US, you consent to your data being transferred to and processed in the US. We do not currently have EU or UK-specific data residency.
11. Changes to this policy
We'll post material changes here and announce them in /changelog. Continued use of the app after a change means you accept the updated policy. We'll never make a change that retroactively widens our use of data without an explicit opt-in.
12. Contact
Email founder@mour.app for any privacy question, data access request, or correction. We'll respond within 7 days, usually within 1 or 2.