Privacy Policy

1. What we collect

• What you give us: a chosen name, an email address or Apple relay address, your settings, what you say and write in sessions (text, audio and reflections), and any message you send us.
• What the app records: which explorations you run, when and for how long; device type and operating system; IP address; error and performance logs.
• With your separate permission: heart rate, breathing rate, blood oxygen and sleep from the Health app.

No tracking pixels, no fingerprinting, no advertising.

2. Special category data

What you say in sessions can reveal your mental health, religious or philosophical beliefs, ethnic origin, and sex life or sexual orientation. Each is special category data under Article 9 UK GDPR and EU GDPR, and sensitive personal information under US state privacy laws including California's.

3. Lawful basis

Account, payment and subscription data: performance of our contract with you (Article 6(1)(b)). Security and fraud prevention: our legitimate interest in keeping the Service safe (Article 6(1)(f)); you may object. Everything else, including what you say in sessions: your consent (Article 6(1)(a)), and for special category data your explicit consent (Article 9(2)(a)). You may withdraw consent at any time in the app or by email. Withdrawal does not affect processing already carried out.

4. What we use it for

To run and improve the Service, personalise it to you, communicate with you about your account, keep the Service secure, meet our legal obligations, and improve the product using anonymised and aggregated data. Never for advertising. We do not sell personal data. Any research study, any partnership involving derived or aggregated data, and any use of your content to train models would each need your separate, explicit consent first.

5. AI processing

miræ's sessions are run by an AI. Session content is processed on our instructions by Anthropic Ireland, Limited and its affiliate Anthropic, PBC (inference, United States), OpenAI OpCo, LLC (speech to text, United States) and Voyage AI Innovations, Inc. (embeddings, United States). Each receives only what its task needs: audio for transcription, the conversation for inference, text with no identity attached for embeddings. None uses your data to train models. Voyage retains nothing. Anthropic and OpenAI keep inputs for no more than thirty days for abuse monitoring, then delete them.

The observations miræ produces about your patterns are for your use only. They are not clinical assessments, diagnoses or medical opinions, and no decision with a legal or similarly significant effect on you is made by automated means.

6. Who else processes your data

Under data processing agreements: EU-hosted database, storage and server providers that hold and run the Service; EU-hosted analytics and error monitoring that receive usage and error telemetry with personal data scrubbed at source; RevenueCat Inc. (United States) for subscriptions; and, for purchases on miræ.com, Stripe, Inc. (United States) for payment. We never hold your full card details. The full list is available on request. We also disclose data where the law requires it, or to protect the rights, safety or property of miræ, our users or others.

7. International transfers

Anthropic, OpenAI, Voyage, RevenueCat and Stripe process data in the United States under Standard Contractual Clauses with the UK Addendum or the UK International Data Transfer Agreement, with encryption in transit. Everything miræ itself stores is in the EU.

8. Retention and deletion

We keep personal data only as long as these purposes need it or the law requires. Consent records are kept for the life of the account plus seven years.

When you delete your account, we erase what you wrote and said in sessions (text, transcripts and recordings), your contact details and your sign-in identity, and the account cannot be used again. The only records that remain are structured research records held in a separate store: they contain none of your words, no direct identifiers, and the details that could narrow them to you are coarsened. That store is keyed separately from your account, and its key is destroyed when you erase, so what remains cannot be linked back to you by us or by anyone else. We keep other data only where the law requires it or security needs it.

9. Your rights

You may access, correct, delete (including derived data), restrict or object to the processing of your personal data, take a copy of it, and withdraw consent. Email contact@miraecodelabs.com; we respond within one month. We will not discriminate against you for exercising any right. An agent may act for you; we will verify their authority and may confirm the request with you directly.

UK and EU: you may complain to us, and to the Information Commissioner's Office (ico.org.uk, 0303 123 1113) or your own data protection authority, whether or not you have raised the matter with us first.

California: you may limit the use of your sensitive personal information. We do not sell or share personal data for cross-context advertising.

Washington: under the My Health My Data Act you may confirm whether we collect, share or sell your consumer health data and access it; obtain a list of every third party we have shared it with; withdraw consent to its collection or sharing; and have it deleted, including by our processors. If we refuse a request you may appeal, and we will tell you how to take the matter to the Washington Attorney General if the appeal fails. We do not sell consumer health data and do not use geofencing around health care facilities. Our Consumer Health Data Privacy Policy is at miraecodelabs.com/legal/consumer-health-data-privacy-policy. If your state has its own consumer health data law, for example Nevada or Connecticut, we will handle your request under it.

10. Security

Data is encrypted in transit and at rest. Session content is encrypted under a key unique to you, and erasing your account destroys that key. Access is limited by role and reviewed regularly. No system is completely secure.

11. Changes

We will tell you in the app before a material change to this Policy or to how we share data takes effect.