Mira Privacy Policy

Effective date: 27 October 2026

This policy explains what personal data the Mira app for iPhone ("Mira") processes, why, for how long, and what rights you have. Mira is built so that most of your data never leaves your iPhone.

1. Who we are

Mira is provided by Orbiva Ltd, a company in the United Kingdom. Orbiva Ltd is the data controller for the personal data described in this policy.

Contact for privacy questions and requests: hello@miyawesim.app

2. Summary

• Mira has no ads, does not track you across apps or websites, does not sell your data and contains no third-party analytics or advertising SDKs.
• You do not create a login. Mira creates an anonymous account automatically, without an email address, password or name.
• Your onboarding answers, measurements, game results, test answers and results, and coach conversations are stored on your device.
• Some features need our server. The basic account link and purchase checks are needed to provide your subscription. Everything else (synced measurements, the cloud coach, anonymous research norms, comeback notifications) runs only if you give consent, and you can withdraw it.
• Apple Health data stays on your device and is never sent to us.
• You can delete your account and the data on our server in the app.

3. Data that stays on your device

The following is stored locally on your iPhone (and in your device backups, according to your iOS settings). We do not receive it unless a section below says so:

• Onboarding answers: your goal, skills you want to train, daily time and preferred time of day, birth year, gender (optional), education level, native language, sleep duration and quality, physical activity, stress level, how often you learn new things or socialise, self-ratings, everyday forgetfulness and mind-wandering, and your state before a measurement (alertness, caffeine, surroundings, glasses).
• Measurements and results: task scores and response times, your brain profile, Mira Score, mental age range, and technical conditions of each session (device model, iOS version, screen refresh rate, Low Power Mode, thermal state).
• Activity: game results and skill ratings, streaks, quests, coins, achievements, league level, lesson progress, reminders and settings.
• Tests: your answers and results for the IQ, personality, emotion, wellbeing and other tests.
• Coach: your conversations with the Mira coach. Answers are produced on your device by Apple's on-device model or by Mira's built-in answers, unless you turn on the cloud coach (section 5.6).
• Widgets, Live Activities and App Clip: the information they display is shared with them on the device through an app group. A result from the Mira App Clip reaches the app the same way.
• Identifiers in the Keychain: a random account token and your anonymous session. The Keychain can keep them after you delete the app, so reinstalling Mira reconnects to the same anonymous account. Use "Delete account" (section 11) to remove the account and these identifiers.

4. Your anonymous account

When Mira first connects to our server, it creates an anonymous account and links it to a random account token generated on your device. We store:

• an anonymous user ID and the random account token;
• your app language and region setting and your time zone;
• the date the account was created, your last activity time and your league;
• a record of which consents you have given or withdrawn, and when.

We do not ask for or store your name, email address, phone number or precise location.

5. Data processed on our server

5.1 Purchases (needed for your subscription)

Purchases are made and paid for through Apple. We never receive your payment card details. To give you access and keep your subscription status correct, the app sends us Apple-signed records of your purchases, and Apple sends us App Store Server Notifications about renewals, cancellations, refunds and similar events. These records contain the product, transaction identifiers, dates, renewal and refund status, the type of offer used, ownership type (for example Family Sharing), and storefront and price information as provided by Apple. Each purchase carries the random account token so it can be matched to your anonymous account.

5.2 Promotional offers

When the app shows you a special offer (for example a discount for current subscribers), our server signs that offer for Apple. We record the product, the offer, a one-time number and the time, to prevent misuse.

5.3 Invitations (optional)

If you invite friends or use an invite code, we process your invite code, the number of invitations and rewards, and, when you redeem a code, an Apple-signed app transaction record. That record contains an app-specific identifier for your Apple Account, which we use only to allow one invitation per Apple Account. We may give you a single-use App Store offer code. A reward already earned by the person who invited you stays with them if you later delete your account.

5.4 Synced measurements (with your consent)

If you allow measurement sync, we store your measurement results (type and date, task scores, percentiles with their ranges, validity, norm version and app version) and daily game totals (date, game, number of rounds, time played, best score, average performance, XP). If you withdraw this consent, these records are deleted from our server.

5.5 Leagues

If you take part in weekly leagues, we store your weekly XP in a group of about 30 players. Other players see only an automatically generated nickname and your weekly XP, never your identity.

5.6 Mira cloud coach (with your explicit consent)

The cloud coach ("Advanced coach mode") is off unless you turn it on after reading a consent screen. When it is on, your question, up to six previous messages and a numeric summary of your data (age, goal, daily minutes, measurement percentiles, mental age range, self-reported sleep hours and stress level, streak, weekly training summary, reaction time and skill scores) are sent through our server to Anthropic, which generates the answer. We do not send your name, email, location or device identifiers. Our server does not store or log the message text; it keeps only the number of tokens, the status and the duration of each request. Anthropic processes the data on our behalf and does not use it to train its models. Questions about medical topics receive a fixed answer and are not sent to any model. You can withdraw consent at any time on the same screen.

5.7 Anonymous norm contributions (with your separate consent)

To build fair, age-adjusted scores, you can choose to contribute anonymous data: task, score, five-year age band, education level, gender (optional), language, device model class, app and norm version, and the month. These records contain no account ID, exact date or device identifier, so they cannot be linked back to you. Only adults (18+) contribute. No diagnosis or risk score is produced.

5.8 Comeback notifications (with your consent)

If you allow them, we store your Apple push notification token and your last activity time, and may send a reminder after 3, 7, 14 or 30 days without activity, only between 10:00 and 21:00 in your time zone. Daily training reminders are scheduled on your device and do not use our server.

5.9 Coins

Coins you earn or spend may be recorded on our server (what was earned or spent, its source and the day) so that the balance stays correct.

5.10 Refund requests

When you ask Apple for a refund, Apple may ask us whether the purchase was delivered. We answer only if you have given separate consent for this, and the answer contains no personal data beyond delivery status. This feature is currently switched off.

5.11 Security and technical data

Our hosting provider processes your IP address to deliver requests, protect the service and limit abuse (for example, how many anonymous accounts can be created from one address). Our server logs contain only the function, status, error code and duration of a request; they never contain message text, tokens, keys or purchase records.

6. Apple services

• Apple Health (optional, off by default): if you turn it on, Mira reads your sleep (a 14-night average shown next to your scores) and saves breathing and focus sessions as mindful minutes. This data stays on your device; it is never sent to our server or any third party and is never used for advertising.
• Microphone and speech recognition: used only while you dictate a question to the coach. Recognition runs on your device where supported; otherwise Apple's speech recognition service processes it under Apple's privacy policy.
• Game Center (optional): if you turn it on, your weekly XP and area scores are sent to Apple's Game Center for leaderboards and achievements.
• App Store, Family Sharing and push notifications are provided by Apple under Apple's own privacy policy.

7. Legal bases (UK GDPR and EU GDPR)

| Processing | Legal basis | |---|---| | Anonymous account, purchases, App Store notifications, offer signing | Performance of our contract with you (providing Mira and your subscription) | | Invitations, leagues, coins | Performance of contract, and our legitimate interest in running these features fairly | | Security, abuse prevention, rate limiting | Legitimate interests (keeping Mira secure) | | Synced measurements, norm contributions, comeback notifications, refund information | Your consent | | Cloud coach (may include self-reported sleep and stress) | Your explicit consent | | Keeping purchase records for accounting and tax | Legal obligation |

You can withdraw consent at any time. Withdrawal does not affect processing that took place before.

Mira does not make decisions about you that have legal or similarly significant effects. The coach only phrases numbers calculated by the app.

8. Who receives your data

• Supabase, Inc. hosts our database, anonymous sign-in and server functions. Our project is located in the European Union (Ireland).
• Anthropic, PBC (United States) generates cloud coach answers, only if you have given consent.
• Apple processes purchases, notifications and the Apple services described above as an independent controller.

We do not sell personal data and do not share it for advertising. We may disclose data if required by law or to protect our rights and users' safety.

9. International transfers

Our server data is stored in the European Union. Where data is accessed from or sent to countries without an adequacy decision (for example to Anthropic in the United States), we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum.

10. How long we keep data

| Data | Retention | |---|---| | Data on your device | Until you delete it, delete your account or delete the app | | Anonymous account and profile | Until you delete your account | | Synced measurements and daily game totals | Until you withdraw consent or delete your account | | Cloud coach request records (no message text) | 30 days | | Push notification records | 120 days; the token is removed when you turn notifications off, delete your account or Apple reports it invalid | | App Store notification records | 400 days | | Rate-limit counters | 2 days | | Purchase records | As long as required for accounting, tax and refunds; after account deletion they are no longer linked to any account | | Anonymous norm contributions | Kept to build and update norms; they cannot be linked to you |

11. Deleting your account

In the app, go to Progress > Account > Delete account. This deletes your profile and everything linked to it on our server, deletes the anonymous account, and then removes all Mira data on your iPhone (results, progress, coach chat, settings and the identifiers in the Keychain); the app then starts again from the beginning. Purchase records stay for accounting and refunds but are no longer linked to you. Mindful minutes saved to Apple Health and your Game Center scores belong to Apple's apps and stay there; you can remove them in Health and Game Center. Deleting your account does not cancel a subscription: cancel it in your App Store account settings. You can also ask us to delete your data at hello@miyawesim.app.

12. Your rights

Under the UK GDPR and EU GDPR you have the right to access, correct, delete, restrict or object to the processing of your personal data, to data portability, and to withdraw consent. Write to hello@miyawesim.app. Because your account is anonymous, we may ask for information that lets us find it, such as details of your App Store purchase. For data Apple holds about your purchases, visit privacy.apple.com.

You can complain to the UK Information Commissioner's Office (ico.org.uk) or to the data protection authority in your EU country.

Users in Türkiye (KVKK): under Article 11 of Law No. 6698 you may learn whether your data is processed, request information, learn the purpose of processing, know the recipients in Türkiye or abroad, request correction or deletion, object to results arising exclusively from automated processing, and claim compensation for unlawful processing. Send requests to hello@miyawesim.app; we answer within 30 days. You can also apply to the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu).

We do not sell or share personal information as defined by US state privacy laws.

13. Children

Mira is not directed at children under 13, and we do not knowingly collect personal data from them. If you believe a child under 13 has used Mira, contact us and we will delete the related data.

14. Security

Connections to our server are encrypted. The app cannot write to our database directly: every request is checked by our server functions, and each table is protected by row-level security. Secret server keys are never included in the app. On your device, your account token and session are stored in the Keychain.

15. Changes to this policy

We will update this policy when Mira or the law changes, and show the new effective date above. For significant changes we will tell you in the app.

16. Contact

Orbiva Ltd, United Kingdom hello@miyawesim.app