Privacy Policy

1. Who is responsible for your data?

The controller of personal data processed through the Service is:

Lumi Zone Łukasz Blania
ul. Zabrska 15
40-083 Katowice
Poland
NIP: 1990132289
REGON: 528880848

Privacy and legal contact: lukasz.b@lumizone.pl
General support: support@miyacompanion.com

We have not appointed a Data Protection Officer, because our core activities do not consist of large-scale, server-side storage of special-category data: conversations are kept on your device and processed on our servers only transiently (see Section 4.3). Privacy enquiries and requests should be sent to the privacy and legal contact above.

In this Policy, “Miya,” “we,” “us,” and “our” refer to the controller identified above.

2. Scope

This Policy applies to:

• the Miya application for iOS and Android;
• Miya-operated APIs and account, entitlement, usage, and billing services;
• the Miya marketing and support website; and
• communications you send to us for support, privacy, billing, or legal purposes.

This Policy does not govern a third-party AI service or custom endpoint that you independently select and use with your own API key. Those services process data under their own terms and privacy notices, as explained in Section 8.2.

3. Important summary

• Miya is an AI. Your companion is artificial intelligence, not a person. The app tells you so on the welcome screen; in the United States it also shows a short reminder at the start of a chat and at least every three hours.
• Local-first storage. Your full chats, memories, companion profiles, relationship state, local embeddings, gallery, and most preferences are stored on your device, not in Miya’s server database.
• Cloud processing is required for replies. Your current message, a few recent messages, selected memories, your companion’s profile, and any image you deliberately attach are sent to one of the AI providers listed in Section 8.1 to generate a reply, extract memories, describe a photo, or create an image.
• Consent before the first chat. Before anything is sent to an AI provider, the app names the providers and processing countries and asks for your permission, including explicit consent for sensitive information you choose to share. You can withdraw it in the app at any time.
• Some providers are outside the EU. Depending on routing, content may be processed in the United States or, for DeepSeek’s own service, in the People’s Republic of China (Section 10).
• Pseudonymous device account. The app creates a device-linked account automatically. No email address or password is required.
• Billing is handled by the stores. Apple or Google processes your payment details. Miya and RevenueCat receive purchase and entitlement metadata, not your full payment-card number.
• No sale of personal data. We do not sell personal data, share it for cross-context behavioural advertising, or use chat content for targeted advertising. We do not use your conversations to train any model.
• The Service is for adults. Miya is intended only for people aged 18 or older.

4. Data we process

4.1 Data stored primarily on your device

Depending on the features you use, Miya may store the following in the app’s private local storage, SQLite database, secure storage, or app-owned media directory:

• Profile information: your chosen display name and information you enter in the “About You” area;
• Companion information: companion names, gender or custom gender label, avatar, biography, personality traits, custom instructions, appearance, chat style, relationship type, and related settings;
• Conversations: messages, generated replies, message status, chat titles, timestamps, reactions, and locally referenced attachments;
• Memory and continuity data: extracted memories, lorebook entries, open loops, summaries, relationship events, relationship metrics, mood state, tone state, and local knowledge representations;
• Media: companion portraits, wallpapers, images you select, images attached to chats, and AI-generated images saved to the local gallery;
• Local AI data: on-device memory embeddings and background-processing state;
• Notification data: scheduled check-in text, schedule, notification identifiers, quiet hours, preview preference, and deep-link information;
• Preferences: theme, language, text size, notification choices, memory settings, and AI routing choices;
• Consent record: the version and time of the consents you gave on the welcome screen (or in a one-time prompt for earlier installs), so we can show what you agreed to and ask again when the disclosure changes;
• Feedback: thumbs-up or thumbs-down reactions associated with local messages;
• Security information: an optional app-lock PIN hash and salt, app-lock state, biometric-unlock preference, failed-attempt counters, and lockout timing; and
• AI credentials: API keys and optional custom-endpoint credentials saved in the operating system’s secure storage when you choose direct API-key mode.

Miya does not receive a copy of your app-lock PIN or biometric template. Biometric matching is performed by your device’s operating system, and the app receives only the authentication result.

4.2 Data processed by Miya’s servers

When the app can connect to Miya’s backend, we may process:

• Pseudonymous account identifiers: a randomly assigned user ID, device/account ID, and a one-way hashed representation of the installation identifier;
• Device and connection metadata: platform (iOS, Android, or unknown), account creation and last-seen timestamps, the most recent IP address associated with device provisioning or attachment, request IP address, request ID, route, response status, timing, and limited security diagnostics;
• Session information: a protected session-token hash, token expiry, session status, and revocation timestamps;
• Eligibility information: an access-policy value and policy version. At the start of onboarding the app asks you to confirm that you are 18 or older; once you do, it tells our servers that the account belongs to the adult category. Accounts that have not made this confirmation stay in the stricter unknown category. The app does not collect or verify your birth date or exact age;
• Subscription and entitlement data: RevenueCat app-user ID, store, product and entitlement identifiers, subscription status, purchase and expiry timestamps, renewal status, transaction identifiers, billing environment, and relevant cancellation or refund information;
• Usage records: operation type (for example, chat, memory extraction, vision, or image generation), request identifier, plan/budget period, provider/model routing metadata, token counts, generated-image quantity, cost/usage units, and settlement status;
• Generated images (temporary): images created for you are copied to our server so the app can download them, marked as AI-generated, and automatically deleted after 72 hours;
• Security and anti-abuse information: IP-based rate-limit state and app-integrity verification results (Google Play Integrity, Apple App Attest) or related request metadata; and
• Billing webhook records: normalized purchase, renewal, cancellation, refund, transfer, and entitlement events received from RevenueCat.

The current consumer app uses a seamless device-first account and does not require an email address or password. The backend contains reserved support for possible future email/password, Google sign-in, and server-stored provider credentials. Those features are not part of the current consumer flow. If activated, we will provide the required user-facing disclosures before or when the feature is enabled.

4.3 Content processed transiently to provide AI features

When you request an AI operation, some or all of the following may be transmitted from your device:

• your current message;
• a bounded selection of recent messages;
• the companion profile and instructions;
• selected memories, lorebook material, open loops, and relationship context;
• a system prompt created by the app;
• a memory-extraction input containing the current exchange and relevant existing memories;
• an image-generation prompt;
• an image attachment or companion/reference portrait that you deliberately submit; and
• technical fields needed to route, meter, secure, and return the request.

Miya’s gateway passes this content to the AI provider and returns the result. Our database does not store raw chat prompts, full replies, uploaded images, or memory content, and ordinary gateway logs redact request bodies and authorization headers. The only server-side copies are generated images (kept for 72 hours, Section 4.2) and content reports (below). The AI provider processes the content under its own terms; Section 8.1 summarises their retention.

Content reports. When you flag a single AI reply through the in-app report control, Miya stores only that reported reply text, the category you choose, an opaque local message identifier, and the timestamp on its servers so the operator can review the flagged content and respond to store safety requests. Your own message, the rest of the conversation, and any images are not included in the report. See Section 7 for retention.

Do not submit passwords, payment-card numbers, government identifiers, precise private addresses, medical records, or other information that is not necessary for your use of Miya.

4.4 Sensitive information (special categories of data)

Conversations with a companion can reveal information about your health (including mental health), sex life, sexual orientation, beliefs, or ethnic origin. Miya does not ask for this information, but you may choose to share it, and the companion may reply to it and remember it.

We process such information only on the basis of your explicit consent (Article 9(2)(a) GDPR), which the app asks for on the welcome screen as a separate statement, with full details one tap away. You can withdraw it at any time in Account → Privacy → Withdraw AI consent; Miya then stops sending content to AI providers until you consent again. Withdrawal does not affect processing carried out before it, and your local data stays on your device until you delete it.

Miya does not use images for identity recognition or biometric identification, and does not use sensitive information for advertising or any purpose other than the conversation and memory features you request.

4.5 Photos

You decide whether to select a photo, attach an image, or use a reference portrait. Miya requests photo-library access only when needed for a feature you choose. The app is not configured to request camera or microphone access for the current feature set.

4.6 Support and communications

If you email us, we process the information you include, such as your name, email address, account ID, message, attachments, and support history. Please do not send full chat exports or private images unless they are necessary to resolve your request and we specifically ask for them.

4.7 Waitlist and newsletter sign-ups

If you join the Miya waitlist or subscribe to blog updates on the website, we process the email address you enter and the time of sign-up. We use the waitlist address only to tell you when Miya launches, and the newsletter address only to send new posts. The legal basis is your consent (Article 6(1)(a) GDPR and, for the newsletter, the consent to electronic marketing required by Article 398 of the Polish Electronic Communications Law), which you can withdraw at any time by emailing support@miyacompanion.com or using the unsubscribe link; we then delete your address. We keep sign-ups until you withdraw consent or, for the waitlist, until we have sent the launch notice. The forms are received and stored for us by our website host, Netlify, Inc. (USA), acting as our processor (see Section 10).

4.8 Data we do not intentionally collect

The current Service is not designed to collect:

• your precise GPS location;
• contacts or address-book data;
• microphone recordings or camera footage;
• your full payment-card or bank-account details;
• biometric templates used by Face ID, Touch ID, or Android biometrics; or
• advertising identifiers for behavioural advertising.

5. How and why we use data

For people in the European Economic Area (EEA) or United Kingdom, the table below also identifies the legal bases under the GDPR or UK GDPR.

Where we rely on legitimate interests, we assess whether the processing is necessary and proportionate, balance those interests against your rights and reasonable expectations, minimize the data used, and apply access, retention, and security controls. You may object as explained in Section 12.

5.1 Sources of data

We obtain data:

• directly from you when you enter content, choose settings, contact us, or request a feature;
• automatically from the app, device, network connection, and Miya gateway when the Service is used;
• from Apple, Google, and RevenueCat in connection with purchases and entitlements;
• from an AI provider when it returns output, usage information, identifiers, or an error; and
• from Google Play Integrity or Apple App Attest when the app proves it is a genuine installation.

5.2 Required and optional data

Pseudonymous installation, platform, session, request, and limited connection data are required to create and secure the device account and use Miya-operated cloud features. Selected prompt or context data, and the consents on the pre-chat screen, are required to perform the AI operations that are the core of the Service. Purchase and entitlement metadata is required to provide a paid plan.

Profile details, custom companion information, photos, direct-provider API keys, notifications, biometrics, and support communications are optional. If you do not provide optional data or permission, the related optional feature may not work, but unrelated features should remain available.

Operating-system permission prompts, such as photo-library, notification, or biometric permission, control technical access on your device. A permission prompt is not necessarily the same as consent under data-protection law.

6. Local storage, backups, and deletion

6.1 Local data

Local conversations, memories, companion information, media, and preferences remain on your device until you delete them, clear the app’s data, restore a backup that replaces them, or the operating system removes them.

The app includes controls to:

• delete individual chats, memories, companions, and media where the relevant screen provides that action;
• delete locally stored companions, chats, memories, media, AI configuration, and device-account session data through the “Delete all data” flow;
• disable and remove app-lock PIN and biometric settings separately in the Security screen;
• withdraw AI consent in Account → Privacy;
• export an encrypted .myyumi backup; and
• restore an encrypted backup.

An exported backup contains the local database and app-owned media. It is encrypted using a password you choose. We do not receive or store that password and cannot recover it. Once you export or share the backup, you are responsible for its location, password, recipients, and deletion.

The app-owned database and media are configured to be excluded from ordinary device-cloud backup where supported. Operating-system behaviour may vary. Some secure-storage items on iOS may survive an uninstall, so use Miya’s deletion controls before uninstalling if you want to remove local credentials and identifiers as fully as the platform permits.

6.2 Server account deletion

Deleting local app data, uninstalling Miya, and deleting a server-side device account are separate actions. Likewise, deleting an account does not cancel an App Store or Google Play subscription.

To request deletion of your server-side Miya account and associated personal data, use Account → Delete account in the app, follow the steps on miyacompanion.com/delete-account, or contact lukasz.b@lumizone.pl or support@miyacompanion.com. If you write by email, include the Miya Account ID shown in the app and enough information to demonstrate control of the relevant account. Do not send your session token or API keys.

A server-side deletion request enters a 14-day grace period during which the request can be cancelled. Active sessions are revoked when the request is accepted. After the grace period, account-linked user, device, session, entitlement, subscription, usage, content-report and credential records are permanently deleted from the active database during the next scheduled deletion sweep. Separate billing-webhook audit records are stripped of account identifiers and retained only under the criteria in Section 7.

7. Retention

We retain data only for as long as necessary for the purposes described in this Policy.

• Local app data: until you delete it, replace it through restore, clear app data, or the operating system removes it;
• Consent record (on your device): until you withdraw it or delete local data;
• Encrypted backups: controlled by you after export; Miya does not receive the exported file unless you send it to us;
• Active account, session, entitlement, and usage data: while the account is active; deleted through the account-deletion process (Section 6.2);
• Session credentials: valid for up to 30 days and revocable earlier;
• Most recent device IP address: while the device/account record remains active, for trial-abuse and fraud prevention, then deleted with the account;
• Generated images on our server: 72 hours, then automatically deleted;
• Content reports: while needed to review the reported content and handle store safety requests, and in any case deleted with the account;
• Account deletion: 14-day grace period, then permanent deletion during the next scheduled sweep;
• Billing and webhook audit records: for the period required by tax and accounting law (in Poland, 5 years from the end of the year in which the tax obligation arose) and, where relevant, until limitation periods for claims expire;
• Security and gateway logs: size-limited rolling retention (normally a few days and never more than 30 days), longer only for a specific security incident under investigation;
• Complaints and support correspondence: for the duration of the matter and then up to the end of the limitation period for related claims (generally up to 6 years, or 2 years for certain consumer claims); and
• Backups of Miya-operated systems: deleted after 14 days under the rolling backup cycle.

We may retain de-identified or aggregated information that no longer identifies you.

8. AI processing modes and third-party services

8.1 Miya Subscription mode

In Subscription mode, the app sends selected content to Miya’s gateway. The gateway authenticates the request, applies entitlements and usage limits, and routes the request to one of the models below. Which model handles a request depends on your plan, the feature, capacity, safety configuration, and current routing; we use several models and may switch between them. The current list is also shown in the app before your first chat.

Provider summaries reflect the providers’ published API terms at the time of writing and may change; the provider’s own terms prevail. We do not use your conversation content to train any model, and we do not enable provider training on Subscription content. We will update this table and ask for your consent again in the app before routing content to a provider or country not listed here.

8.2 Direct API-key mode

If you choose direct API-key mode, the app sends requests from your device directly to the provider or endpoint you select, without routing the content through Miya’s gateway. Supported choices may include OpenAI, DeepSeek, Google Gemini, Anthropic Claude, OpenRouter, Mistral, xAI, Groq, Cerebras, Fireworks AI, Together AI, DeepInfra, Perplexity, fal.ai, and a custom OpenAI-compatible endpoint.

In this mode:

• your provider API key is stored in device secure storage;
• the selected provider receives the prompt, relevant context, and any attachment required for the request;
• the provider may charge your provider account directly;
• you contract with that provider directly, and its own terms, privacy notice, data location, retention, and training choices apply; and
• a custom-endpoint operator is selected by you and is not controlled or audited by Miya.

Review the provider’s policies before enabling this mode. Do not use a custom endpoint you do not trust.

8.3 Generated images

An image provider returns the image to Miya’s gateway, which copies it, adds a machine-readable mark identifying it as AI-generated (IPTC/XMP “trainedAlgorithmicMedia” metadata, as required by Article 50(2) of the EU AI Act), and keeps it for up to 72 hours so the app can download it. The app then saves it in Miya’s local media directory. Please do not remove this mark when sharing images.

8.4 Hosting

Miya’s gateway and database run on a virtual private server rented from netcup GmbH (Karlsruhe, Germany), with the server located in the European Union. netcup acts as our processor under a data-processing agreement. Our website is hosted by Netlify, Inc. Our self-hosted website analytics (Umami) run on our own server at netcup. You can ask us for the current list of processors at any time.

9. When we disclose data

We may disclose personal data:

• to the service providers described above, only as needed for their function and, where they act as our processors, under a data-processing agreement (Article 28 GDPR);
• to hosting, infrastructure, security, professional-adviser, and support providers acting for us;
• when you direct us to disclose it, including through a system share sheet or selected AI provider;
• to comply with law, a court order, or a valid request from a competent authority;
• to investigate fraud, abuse, security incidents, or violations of the Terms of Use;
• to protect the rights, safety, and property of users, the public, Miya, or others; and
• as part of a merger, financing, acquisition, restructuring, or transfer of all or part of the business, subject to appropriate safeguards and notice where required.

We do not sell your personal data. We do not share personal data for cross-context behavioural advertising.

10. International transfers

We are established in Poland. Several providers process data outside the EEA:

• United States. For recipients certified under the EU–US Data Privacy Framework we rely on the European Commission’s adequacy decision of 10 July 2023; otherwise we use the Commission’s Standard Contractual Clauses (and the UK Addendum where relevant), together with supplementary measures such as encryption in transit and data minimisation.
• People’s Republic of China (DeepSeek’s own service). There is no EU adequacy decision for China, and DeepSeek does not offer Standard Contractual Clauses for its API. Chinese law may allow public authorities to access data held by companies in China, and you may have limited ability to enforce your rights there. Where we route requests to DeepSeek’s own service, the transfer relies on your explicit consent after being informed of these risks (Article 49(1)(a) GDPR), given on the welcome screen (or in a one-time prompt for earlier installs). You can withdraw it at any time in Account → Privacy. Where a hosting partner in the USA or EU runs DeepSeek models, no data is sent to China.

Transfers made directly to a provider or custom endpoint you independently select in API-key mode are made at your direction and governed by that provider’s privacy terms. Contact us to ask which safeguard applies to a specific transfer or to request a copy of the relevant contractual clauses, subject to appropriate redactions.

11. Security

Security measures reflected in the Service include, as applicable:

• encrypted network transport (TLS) for production connections;
• one-way protection of installation identifiers, session tokens, and passwords where those features apply;
• operating-system secure storage for session credentials, API keys, consent records, and app-lock information;
• encrypted storage for any supported server-side provider credential;
• request-body and authorization-header redaction in ordinary gateway logs;
• server-side request validation, rate limits, usage budgets, and app-integrity checks;
• optional PIN and device-biometric app lock;
• encrypted user-controlled local backups; and
• controls that attempt to prevent screen capture on sensitive app screens.

No method of storage or transmission is completely secure. Protect your device with a strong device passcode, enable Miya’s app lock if appropriate, keep your operating system updated, safeguard exported backups, and never share API keys or session tokens.

If a personal-data breach creates a legally reportable risk, we will notify the President of the Personal Data Protection Office within 72 hours and affected individuals without undue delay, as required by Articles 33 and 34 GDPR.

12. Your privacy rights

Depending on where you live and subject to legal conditions and exceptions, you may have the right to:

• obtain confirmation that we process your personal data and receive a copy;
• correct inaccurate or incomplete data;
• request deletion of personal data;
• restrict processing;
• receive data you provided in a structured, commonly used, machine-readable format and transmit it to another controller;
• object to processing based on legitimate interests;
• withdraw consent at any time (in the app under Account → Privacy, or by email), without affecting processing already carried out lawfully;
• complain to a data-protection authority; and
• receive information about applicable safeguards for international transfers.

Most of your data is stored only on your device, so you can view, export (encrypted backup) and delete it yourself in the app; we cannot access it.

Profiling. Miya derives limited mood, tone, memory-relevance, and relationship-state signals from conversations to personalize responses and continuity. This is profiling for the companion features you request. It is not used for advertising or third-party scoring and does not produce legal or similarly significant effects. Miya does not make decisions based solely on automated processing that produce legal or similarly significant effects within the meaning of Article 22 GDPR.

How to exercise your rights

Email lukasz.b@lumizone.pl. Because the account does not contain your name or email address, provide your Miya Account ID and information reasonably necessary to verify control of the account. We will not request your password, API key, full session token, or unnecessary identity documents.

We respond within one month where the GDPR applies. That period may be extended by up to two additional months for complex or numerous requests, and we will explain any extension.

Complaint to a supervisory authority

If you are in Poland, you may complain to:

President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych)
ul. Stawki 2
00-193 Warsaw
Poland
https://uodo.gov.pl/

You may also complain to the competent authority where you habitually live, work, or where an alleged infringement occurred.

13. United States disclosures

California (CCPA/CPRA) and other state privacy laws. Where these laws apply, you may have rights to know, access, correct, delete, and obtain a copy of covered personal information, to limit the use of sensitive personal information, and to receive equal service when exercising those rights. During the preceding 12 months, the categories described in Section 4 may have been collected and disclosed for the business purposes described in Sections 5, 8, and 9. We do not sell personal information, do not share it for cross-context behavioural advertising, and use sensitive personal information only to provide the features you request. We do not offer financial incentives in exchange for personal information.

Companion-chatbot laws (California SB 243, New York General Business Law Article 47). Miya discloses clearly that you are talking to an AI, shows a short reminder at the start of a chat and at least every three hours of continuing use on devices set to a US time zone, and uses a protocol to detect expressions of suicidal ideation or self-harm and refer you to crisis services. The protocol is published at miyacompanion.com/safety. Miya is not offered to minors.

Residents of other jurisdictions may exercise any additional rights granted by their local law by contacting us. We will not discriminate against you for making a valid privacy request.

14. Children

Miya is intended only for users aged 18 or older. We do not knowingly offer or maintain the Service for anyone under 18. The app asks you to confirm that you are 18 or older when you start, and the app is rated 18+ in the app stores, but Miya does not independently verify your age. If we learn that a person under 18 has used the Service or provided personal data, we will restrict the account and delete or de-identify the affected data. If you believe this has occurred, contact lukasz.b@lumizone.pl.

15. Website, cookies, and external links

The Miya website is a static website. It does not set advertising cookies, use browser local storage for tracking, run tracking pixels, or use third-party behavioural analytics.

To understand which pages are visited, the website uses a self-hosted, cookie-free analytics script (Umami) that we run on our own server. It receives the page address, referrer, browser and device type, screen size and approximate country. It does not set cookies, does not store your full IP address, is not used for advertising or cross-site tracking, and does not share this data with anyone. You can block it with any content blocker without affecting the website.

The waitlist and newsletter forms submit your email address to our website host so we can contact you as described in Section 4.7. The contact form uses a mailto: link: completing and submitting it opens your email application. The form contents are not submitted to a Miya database unless and until you send the email.

Our web host processes basic access and security logs, such as IP address, requested URL, date/time, user-agent string, referrer, and response status, for delivery, security, and troubleshooting.

The website and app may link to third-party pages. We are not responsible for the privacy practices of those third parties.

16. Changes to this Policy

We may update this Policy when the Service, providers, laws, or processing practices change. We will post the updated version and change the “Updated” date. If a change adds a new AI provider or processing country, or otherwise requires consent, the app will ask for your consent again before the change applies to you. Other material changes will be announced in the app.

A Privacy Policy describes data practices; it does not reduce rights granted to you by applicable law.

17. Contact

For privacy requests, questions, or complaints, contact:

Lumi Zone Łukasz Blania
ul. Zabrska 15, 40-083 Katowice, Poland
Email: lukasz.b@lumizone.pl
Support: support@miyacompanion.com