This Privacy Policy explains what personal data the Mira app ("we", "the App", "Mira") collects, how we use it, who we share it with, and how we protect it. By using Mira, you agree to the practices described in this policy.
1. Information We Collect
1.1 Account Information
When you register or sign in, we collect:
- your email address;
- your (display) name and, if provided, a profile picture;
- your password, stored only as a cryptographic hash; we never store it in plain text.
You may also sign in with Google, Apple, or Facebook (social sign-in via Firebase Authentication), in which case we receive your name and email from that provider.
1.2 Health & Fitness Data
To track calories and personalize your goals, we store the data you enter yourself:
- sex, date of birth (age), height, weight (current, starting, target);
- activity level, goal (lose / maintain / gain), diet type;
- food diary: meals, portions, calories and nutrients (protein, fat, carbs, fiber, vitamins, minerals, etc.);
- water intake, (intermittent) fasting, physical activity and workouts;
- onboarding answers and daily goals.
This data is used solely to operate the App's features. We do not sell health data and do not use it for advertising.
1.3 Apple Health & Google Health Connect Data
Only with your explicit on-device permission, Mira may read data from Apple Health (HealthKit, iOS) and Google Health Connect (Android):
- steps, active and total calories burned;
- distance traveled, floors climbed;
- workouts (type, duration, calories burned);
- weight records.
Access is read-only and used only to show your activity inside the App. This data is not shared with third parties. You can revoke the permission at any time in your device settings (Apple Health / Health Connect).
1.4 Food Photos & AI Processing
When you photograph a meal for recognition, the photo is uploaded to our server and sent to our AI provider (OpenAI) to identify the dish, calories, and macros. Regarding storage:
- a photo from an unconfirmed scan (you didn't save the result to your diary) is stored temporarily and deleted automatically within 48 hours;
- if you save the recognized meal to your diary, the photo is kept with that entry and deleted when you delete the entry or your account.
OpenAI processes this data as our processor via its API. Under OpenAI's API data usage policy, your data is not used to train OpenAI's models, and OpenAI is obligated to provide a level of data protection equivalent to the one described in this Policy.
1.5 AI Chat & Assistant
When you use the AI assistant (chat coach, proactive insights), the following is sent to the AI provider (OpenAI) to generate a reply: the text of your messages and conversation history, plus relevant account context: diary entries, daily goals, profile data (sex, age, height, weight, activity level), time zone, and language. Do not send the chat data you would not want processed this way.
As with photos, OpenAI processes this data as a processor via its API: your data is not used to train OpenAI's models, and OpenAI provides an equivalent level of data protection. In the App, we show a separate consent notice before data is first sent to the AI, and we do not send it until you agree.
1.6 Technical Data
- push notification tokens (Firebase Cloud Messaging);
- crash reports and diagnostics (Firebase Crashlytics);
- device identifiers, device type and OS version, logs and basic analytics;
- advertising identifier, only if ads are shown to you (see Section 3).
2. How We Use Your Information
| Purpose | Data used | Legal basis (GDPR) |
|---|---|---|
| Calorie & nutrition tracking, personal goals | Profile, diary, health data | Performance of a contract |
| Photo food recognition, AI chat, reports | Photos, prompt text | Performance of a contract |
| Activity sync | Apple Health / Health Connect | Consent |
| Subscriptions & payments | Subscription status, purchaser ID | Performance of a contract |
| Push notifications | Notification token | Consent |
| App stability and improvement | Crash reports, diagnostics, analytics | Legitimate interest |
| Advertising (for free users) | Advertising identifier | Consent (UMP/GDPR) |
3. Third Parties & Data Processors
We use the following services that may process your data as processors:
| Service | Purpose | Policy |
|---|---|---|
| OpenAI | AI processing of food photos and text prompts | openai.com/policies |
| Firebase / Google | Authentication, social sign-in, push notifications (FCM), crash reporting (Crashlytics) | firebase.google.com/support/privacy |
| RevenueCat | Subscription & entitlement management | revenuecat.com/privacy |
| Google AdMob | Advertising (if enabled on the free tier) | policies.google.com/privacy |
| Apple App Store / Google Play | Payment processing for subscriptions | apple.com/legal/privacy · policies.google.com/privacy |
We do not sell your personal data. If ads are shown, we ask for your consent through Google's standard UMP (GDPR) mechanism before showing personalized advertising.
4. Where Your Data Is Stored
Mira's servers are hosted on Oracle Cloud in Stockholm, Sweden (EU). Data is transmitted over encrypted channels (HTTPS/TLS). Some processors (e.g. OpenAI) may process data outside the EU (including in the United States); such transfers rely on appropriate safeguards (standard contractual clauses).
5. Retention & Security
We retain your data for as long as your account is active. If you delete your account, we delete your personal data within 30 days, except where retention is required by law. We apply industry-standard safeguards: encryption in transit, password hashing, and access controls.
6. Your Rights
Under GDPR and CCPA you have the right to:
- access your data and update your profile in the App;
- delete your account and all associated data directly in the App (Settings → Delete account) or via the delete account page. Deletion runs with a grace period, after which the data is permanently erased;
- withdraw consent for Health data, push notifications, or personalized ads in your device/app settings;
- submit a request or complaint by contacting us (below). EU users may also contact their data protection authority.
7. Children
Mira is not intended for anyone under the age of 13 (or under 16 in the EU, unless local law provides otherwise). We do not knowingly collect data from children. If you believe a child has provided us with personal data, contact us and we will delete it.
8. Changes to This Policy
We may update this Policy from time to time. We will notify you of significant changes in the App or by other means. Your continued use of Mira after the changes take effect constitutes acceptance of the updated policy.
9. Contact Us
For privacy questions or about your data, contact:
Email: support@mira-fit.com
The Mira team
Questions about this document? Write to us at support@mira-fit.com.