What I collect, and what never leaves your device.

Who I am

Layan Aldawsari, an independent graphic designer working from Riyadh, Saudi Arabia. I decide what happens to the data described here, which makes me the data controller for it. Anything on this page — a question, a correction, a deletion — goes to Layan.aldawsari@gmail.com.

Your artwork never reaches my server

Logo Motion runs entirely inside your browser. The file you upload, the preview, and the finished video are all processed on your own machine — the rendering and encoding happen in a Web Worker on your device, and the video is saved straight out of the browser. None of it is uploaded, stored, or seen by me.

It does stay on your own machine between visits. The logo and every setting you tuned are written to your browser’s own storage, so that paying — which opens a checkout and can replace the page — does not throw away what you were working on, and so that coming back tomorrow finds it where you left it. It is kept on your device only: replacing the logo replaces what is stored, and clearing this site’s data in your browser removes it outright.

That is how I intend to build these tools, and it is why this page can be short. If I ever add one that has to send your work to a server to do its job, that tool will say so plainly on its own page before you use it, and this policy will say what happens to it.

Uploading, retiming, trying every template and playing the preview need no account at all. Paying for the finished file is the only part that asks who you are.

What I actually collect

• Your email address — only once you sign in to buy something. It is the account, and it is what lets a purchase find its way back to you.
• Sign-in codes — the six digits arrive by email and are stored only as a salted SHA-256 hash, never as text. A code expires after ten minutes and works once. The record that a code was requested is kept briefly so nobody can flood an address with them.
• Your purchase record — what you bought, when, its status, and the order, subscription and customer identifiers Lemon Squeezy issues. Whether that is a single download, a tool unlocked for good, or a subscription with renewal dates, this is the whole of what decides which paid features work for you.
• Usage statistics — Google Analytics and Vercel Web Analytics report visits in aggregate: pages opened, country, device type, and where a visit came from. Not tied to your account.
• Server logs — Vercel, my host, records requests including IP addresses for a short period, which is what keeps the site running and abuse visible.
• Card details — never. They do not pass through this site at all. See below.

Payments

Lemon Squeezy is the merchant of record for everything sold here. Buying takes you to their checkout, where your card, billing address and tax details are collected and held by them under their own privacy policy. I never see them and they are never stored here. What comes back to me is a signed webhook saying that a payment happened, what it was for, what state it is in, and which account it belongs to.

Your email address is passed to the checkout as a prefill so you do not have to type it twice. You can change it there — it is a convenience, not an identity.

Why I am allowed to hold it

• To deliver what you paid for — your email address and purchase record exist so a tool can tell what you are entitled to. Performing our contract.
• To keep accounts safe — hashed codes, expiry, attempt counting, rate limits and server logs. Legitimate interest in stopping somebody taking over an account that is not theirs.
• To see what people use — aggregate analytics. Legitimate interest in knowing which parts of the tool earn their place. If you would rather not be counted, browser-level blocking works, and Google’s opt-out add-on turns Analytics off everywhere.

Who else handles it

Five companies, each doing one job, none of them given anything beyond it:

• Vercel — hosting and delivery of the site and its API.
• Neon — the Postgres database holding accounts and purchase records.
• Resend — sends the sign-in email, and nothing else.
• Lemon Squeezy — checkout, payments, subscriptions, invoices, refunds.
• Google Analytics — aggregate usage measurement.

Fonts are served from this domain rather than fetched from a font provider, so opening a page does not announce you to one. Nothing here is sold, rented or handed to advertisers; there is no ad network on this site and nothing is used to build a profile of you.

Cookies and what sits in your browser

No advertising cookies, and nothing that follows you onto other sites. What is stored locally:

• layan-theme — whether you chose light or dark.
• logo-motion:session — your sign-in token, until you sign out or thirty days pass.
• logo-motion:locale — English or Arabic.
• logo-motion:account-changed — a timestamp, so a second open tab notices that you signed in or bought something.
• logo-motion:draft, and a logo-motion database — the work in progress described above: the logo and the settings, kept on your device so paying or closing the tab does not lose them. The marker says there is work saved; the database is where it actually sits, because a logo is far too big for the rest of this list.
• Google Analytics cookies — set by Google to count a returning visit as one visitor rather than two.

Another tool added later may keep its own preference under its own name, in the same way and for the same reason: so the thing you chose last time is still chosen.

How long it stays

• Account and purchase records — for as long as the account exists, and until you ask me to delete it. Lemon Squeezy keeps its own record of the sale for as long as tax and accounting law requires of them.
• Sign-in codes — usable for ten minutes; the row behind them is kept only long enough for the rate limiter to do its work.
• Analytics — under Google’s retention setting for the property, and in aggregate for Vercel.
• Server logs — a short window, set by Vercel.

Where it lives

The database, the hosting and the email service run on servers outside Saudi Arabia — in the United States and Europe, depending on the provider. Where personal data of people in the EU or UK is transferred, it travels under the standard contractual clauses those providers publish.

Your rights

Ask for a copy of what I hold, have it corrected, have it deleted, or tell me to stop using it. One email to Layan.aldawsari@gmail.com does any of it, and I answer within thirty days. Deleting your account removes your email address and every purchase row attached to it.

If you hold a live subscription, deleting the account does not by itself cancel it — cancel it first from your account, or ask me and I will do it before deleting anything. Anything you have paid for and not yet used goes with the account, so use it or ask for a refund first.

In Saudi Arabia these rights come from the Personal Data Protection Law; in the EU and UK the GDPR gives you the same ones, including the right to complain to your data protection authority.

Security

There is no password to steal — sign-in is a one-time code, stored only as a salted hash, single use, and dead after ten minutes. Sessions are signed tokens that expire after thirty days and carry nothing but an account identifier; what you have paid for is looked up fresh on every request rather than written into the token. Traffic to the database and to every provider runs over TLS.

Children

These tools are not meant for anyone under 16, and I do not knowingly hold data from them. If a child’s data has ended up here, email me and it goes.

Changes

If this policy changes, the date at the top changes with it. Anything that materially affects people who have bought something arrives by email as well, before it takes effect. Adding a new tool does not by itself change this policy — it is written to cover whatever is offered here, and if a tool ever needs something not described above, this page says so before that tool ships.