Privacy Policy
Last updated: October 30, 2026
This Privacy Policy explains how Mimu ("we", "us") collects, uses, and protects personal data when you use the Mimu app. Mimu turns a few photos of your child into a portrait session featuring the character they dream of being. Photos of children are the most sensitive data we hold, and the entire service is designed to protect them.
1. Who uses Mimu
Mimu is used by parents and legal guardians who are adults. Children do not use the app or create accounts. You may only add photos of a child if you are their parent or legal guardian, or if their parent or legal guardian has authorized you to do so. You confirm this consent in the app when you create the child’s profile.
2. Data we collect
- Account data: email address, language, and, if you use Sign in with Apple, an identifier from Apple (your email may be a private relay address).
- Child profiles: the name or nickname you give the child, the 3 to 6 photos you choose, and a record of your guardian consent (date and version).
- Portrait sessions: the character and scene you describe, the session’s theme, and the portraits created for you, including any adjustments you request.
- Purchases: the transaction identifiers and the pack purchased, received from Apple. We never receive your payment card details.
- Community and feedback: if you use the feedback space (Community, Ideas, Bugs), the display name you choose, your posts, replies, reactions, votes, reports, and blocks; your country (derived from your network location to place you in your country’s community); and, for bug reports, the screenshot you choose to attach and technical context (screen, app and system version, device model, language).
- Games: scores from the games you play while a session is being created.
- Technical data: app version and device model when needed to support you, and security logs (which never contain photos).
3. How we handle photos of children
- When a photo arrives, we remove its location and device metadata.
- Photos are stored in private storage and leave our servers only through short-lived links sent to you or to our AI provider to create the portraits you requested.
- We use photos only to create the sessions you request. We never use them to train AI models, and we never create or retain facial measurements, face embeddings, or any biometric identifiers.
- Deleting a photo, a child profile, or your account permanently removes the photos and portraits.
- Bug report screenshots may show your child’s photos. They are visible only to you and the Mimu team and are never sent to any AI provider.
4. How we use your data
- To provide the service: create portrait sessions, show your memories, process purchases, and return a session when it cannot be delivered (performance of a contract).
- To send sign-in codes and links (performance of a contract).
- To operate the feedback community: display posts, keep it safe through automated and human moderation, and rank contributions (performance of a contract; legitimate interests).
- To support you, keep the service secure, prevent abuse, and comply with legal obligations (legitimate interests; legal obligation).
We do not sell your personal data or use it for advertising.
5. Artificial intelligence
Portraits are created using artificial intelligence. To create them, the child’s photos and your description are sent to our AI provider, OpenAI, which processes them on our behalf to review the photos, plan the session, generate the portraits, and check their likeness. Under our agreement, OpenAI does not use this content to train its models. Text you post in the community is screened by OpenAI’s moderation service. Every portrait contains provenance metadata (C2PA) from the model that created it, marking the portrait as AI-generated.
6. Sharing with service providers
We share data only with providers that process it on our behalf: Amazon Web Services (hosting, storage, and email delivery, United States), OpenAI (AI processing, United States), and Apple (Sign in with Apple and App Store purchases). Community posts are visible to other members of your country’s community. Bug reports, including their screenshots and context, are visible only to you and the Mimu team.
7. International transfers
Your data is stored in the United States. Where required, transfers are protected by appropriate safeguards, such as the European Commission’s Standard Contractual Clauses.
8. Retention
We retain your data while your account is active. Deleting a photo, profile, session, or your account takes effect immediately. Residual copies in encrypted backups are overwritten within 35 days. Unused bug report screenshots are deleted after one day. We retain only the minimal records required by law, without photos.
9. Your rights
Depending on where you live (including under the GDPR, the UK GDPR, Brazil’s LGPD, and California’s CCPA/CPRA), you have the right to access, correct, delete, and receive a copy of your data; to object to or restrict certain processing; and to withdraw consent. You can delete photos, profiles, and your account directly in the app (Settings). To request a copy of your data or exercise any other right, write to privacy@mimumagical.xyz. You also have the right to file a complaint with your data protection authority.
10. Security
We protect data using encryption in transit and at rest, private storage, short-lived access links, access controls, and audited administrative actions.
11. Changes
We will notify you in the app of material changes to this policy.