Miri Privacy Policy

Version 1.0 Effective July 12, 2026

We wrote this policy in plain language. No legal jargon, no hidden catches. We want you to know exactly what we do with your data — and to walk away from this document feeling calm, not like you need to consult a lawyer.

Who is the controller of your data?

Dawid Musiał, operating a sole proprietorship registered in Poland, Tax ID (NIP): 7822871173.

Privacy contact: [email protected]

What data do we collect and why?

Phone number

Signing up and logging in to Miri happens via your phone number. Each time, we send a one-time code to it — we don't store passwords.

Contacts from your phone

With your consent, Miri compares the contacts on your phone with Miri's user base — so it can show you which of your friends already use it. We store contact names in your account so Miri shows them the way you have them saved on your phone. We don't send invitations to anyone on your behalf and we don't contact people who don't have a Miri account.

Profile data

While using the app, you may share information about yourself — such as your name or other details you enter yourself. We store it solely so the app works the way it should.

The content of your tasks

Your tasks, notes and everything you type into Miri — that's your data. We store it so the app can work. We don't read it, don't analyze it manually and don't sell it. The content of your tasks never goes into the statistics we describe below.

Reports and messages to us

In the app you can write to Miri — report a problem or share an idea. We do read these messages — that's what they're for. We store them so we can reply to you and improve the app. We attach technical data (app version, operating system and device model) to problem reports — the app tells you this directly when you send one.

You can also write to Miri without an account. In that case your messages are linked to an anonymous identifier of this app installation, not to a phone number. If you gave your name when you first opened the app, we attach it so we know how to address you. When you create an account or log in, the conversation moves to your account. If you delete the app without creating an account, you won't be able to recover this conversation.

Billing data

Subscription payments are handled by an external provider (App Store or Google Play). We have no access to your card details — we never see them at all.

Technical data

We collect basic information needed to run the app: device type, operating system version, app version, error logs. When the app freezes or closes unexpectedly, we also get a crash report — it tells us what broke and on what kind of phone, but not who you are. We use this to fix problems, keep the app running and make it better.

App usage statistics

To know what works well in Miri and what needs fixing, we record how the app is used. For example: that someone completed a mission, which welcome screen they stopped at, or whether syncing worked.

What matters:

• The statistics never include the content of your missions, your name, phone number or contacts.
• They are linked to an anonymous identifier of this app installation and, once you log in, also to your account identifier — a string of characters, not your phone number.
• Along with them we record your country, your phone's language, its model and system version. We work out the country from your IP address, which we don't store.
• Statistics and crash reports are on by default. You can turn each of them off in the app: Profile → Privacy & Data.

How long do we keep your data?

We keep your data for as long as you have an active Miri account. When you delete your account, your data is permanently deleted within 30 days.

One exception: requests you sent to other people that they accepted stay with them as their own missions — with the title and description, but without your name. Requests nobody has accepted yet are deleted with your account. Missions you were doing for others go back to the people who sent them.

If you write to Miri without an account, we delete your messages 12 months after the last message in the conversation, unless you create an account or delete your data yourself before then.

We keep app usage statistics for up to 14 months and crash reports for 90 days. When you delete your account, we request deletion of your statistics right away — at our provider this takes up to about 2 months. Crash reports aren't linked to your account and disappear on their own after 90 days.

Who has access to your data?

Supabase — database

We store data on Supabase infrastructure. Data is encrypted at rest (AES-256) and in transit (TLS). Supabase holds an ISO 27001 certificate. Supabase acts as a data processor on our behalf and may not use the data for its own purposes.

Google Gemini — AI features

Miri is an AI-powered app — that's its heart. Miri's AI features run on the Google Gemini API (paid plan). It receives the text you type into the app — the content of your missions, the content of reports you send us, and the first and last name you provide in the app. The scope of AI features will keep growing; the type of data shared stays the same. By using Miri, you know this from the very first launch.

What this means in practice:

• Your data is not used to train AI models.
• Google may retain queries for a maximum of 55 days, solely to detect abuse — for no other purpose.
• We have a signed Data Processing Agreement (DPA) with Google that protects your data in line with the GDPR.

Google Firebase — statistics and crash reports

We collect app usage statistics and crash reports with Google Firebase (Google Analytics and Crashlytics). The provider is Google Ireland Limited, acting on our behalf. Some of this data may be processed in the United States — under the rules agreed between the European Union and the US (Data Privacy Framework).

What we've turned off:

• We don't collect your phone's advertising identifier.
• Your data isn't used to personalize ads.
• We don't share it with other Google services.

Collaboration in Miri

If you use the collaboration features, the tasks or information you choose to share with another person will be visible to them. You only share what you choose — the rest of your data stays private.

No one else

We don't sell data. We don't share it with advertising companies. We don't use advertising tools and we don't track you across other apps or websites. There are no other third parties with access to your information.

Where does our money come from?

Subscriptions. Only subscriptions. We don't make money on your data — and we never will.

Your rights

You have full control over your data. At any time you can:

• See your data — export it directly from the app.
• Correct your data — edit it directly in the app.
• Delete your account and all your data — in the app settings or by writing to us. If you use Miri without an account, you'll find a “Delete my data” option in the same place.
• Move your data — the export file is in JSON, a format other apps can read.
• Turn off statistics and crash reports — in the app: Profile → Privacy & Data. You don't need to give a reason.

We respond to all requests within 30 days.

Security

We encrypt data in transit and at rest, and we isolate data between users — everyone sees only their own.

If, despite this, a security breach affecting your data ever occurs, we will inform you within 72 hours.

User age

Using Miri requires being at least 13 years old. We do not knowingly collect data from younger children. If you're a parent and believe your child has created an account — write to us and we'll delete it.

Changes to this policy

If we change anything here, we'll let you know 14 days in advance with an in-app notification. We don't change the rules of the game quietly.

Have a question?

Just write: [email protected]

We reply.

This privacy policy applies to users of the Miri app on iOS and Android. The data controller is Dawid Musiał, a sole proprietorship registered in Poland, Tax ID (NIP): 7822871173. We process data in accordance with Regulation (EU) 2016/679 (GDPR). The legal basis for processing is the performance of a contract (Art. 6(1)(b) GDPR) and the controller's legitimate interest (Art. 6(1)(f) GDPR) with regard to technical data, app usage statistics and crash reports.

This English version is provided for convenience. In case of any discrepancies, the Polish version prevails.