Privacy Policy
Last updated: 30 October 2026
This Privacy Policy explains how Mimu ("we", "us") collects, uses and protects personal data when you use the Mimu app. Mimu turns a few photos of your child into a portrait session featuring the character they dream of being. Photos of children are the most sensitive data we hold, and the entire service is designed to protect them.
1. Who uses Mimu
Mimu is used by parents and legal guardians who are adults. Children do not use the app or create accounts. You may only add photos of a child if you are their parent or legal guardian, or if their parent or legal guardian has authorised you to do so. You confirm this consent in the app when you create the child’s profile.
2. Data we collect
- Account data: email address, language and, if you use Sign in with Apple, an identifier from Apple (your email address may be a private relay address).
- Child profiles: the name or nickname you give the child, the 3 to 6 photos you choose, and a record of your guardian consent (date and version).
- Portrait sessions: the character and scene you describe, the session’s theme, and the portraits created for you, including any adjustments you request.
- Purchases: the transaction identifiers and the pack purchased, received from Apple. We never receive your payment card details.
- Community and feedback: if you use the feedback area (Community, Ideas, Bugs), the display name you choose, your posts, replies, reactions, votes, reports and blocks, your country (derived from your network location to place you in your country’s community), and, for bug reports, any screenshot you choose to attach and technical context (screen, app and system version, device model and language).
- Games: scores from games you play while a session is being created.
- Technical data: app version and device model when needed to provide support, and security logs (which never contain photos).
3. How we handle photos of children
- When a photo arrives, we remove its location and device metadata.
- Photos are kept in private storage and leave our servers only through short-lived links provided to you or to our AI provider to create the portraits you requested.
- We use photos only to create the sessions you request. We never use them to train AI models, and we never create or retain facial measurements, face embeddings or any biometric identifier.
- Deleting a photo, a child profile or your account permanently removes the photos and portraits.
- Bug report screenshots may show your child’s photos. They are visible only to you and the Mimu team, and are never sent to any AI provider.
4. How we use your data
- To provide the service: create portrait sessions, show your memories, process purchases and return a session when it cannot be delivered (performance of a contract).
- To send sign-in codes and links (performance of a contract).
- To operate the feedback community: display posts, keep it safe through automated and human moderation, and rank contributions (performance of a contract; legitimate interests).
- To support you, keep the service secure, prevent misuse and comply with legal obligations (legitimate interests; legal obligation).
We do not sell your personal data or use it for advertising.
5. Artificial intelligence
Portraits are created using artificial intelligence. To create them, the child’s photos and your description are sent to our AI provider, OpenAI, which processes them on our behalf to check the photos, plan the session, generate the portraits and check their resemblance. Under our agreement, OpenAI does not use this content to train its models. Text you post in the community is screened by OpenAI’s moderation service. Every portrait includes provenance metadata (C2PA) identifying the model that created it and marking it as AI-generated.
6. Sharing with service providers
We share data only with providers that process it on our behalf: Amazon Web Services (hosting, storage and email delivery, United States), OpenAI (AI processing, United States) and Apple (Sign in with Apple and App Store purchases). Community posts are visible to other members of your country’s community. Bug reports, including their screenshots and context, are visible only to you and the Mimu team.
7. International transfers
Your data is stored in the United States. Where required, transfers are protected by appropriate safeguards, such as the European Commission’s Standard Contractual Clauses.
8. Retention
We retain your data while your account is active. Deleting a photo, profile, session or your account takes effect immediately. Residual copies in encrypted backups are overwritten within 35 days. Unused bug report screenshots are deleted after one day. We retain only the minimum records required by law, without photos.
9. Your rights
Depending on where you live (including under the GDPR, UK GDPR, Brazil’s LGPD and California’s CCPA/CPRA), you have the right to access, correct, delete and receive a copy of your data, to object to or restrict certain processing, and to withdraw consent. You can delete photos, profiles and your account directly in the app (Settings). To request a copy of your data or exercise any other right, email privacy@mimumagical.xyz. You also have the right to lodge a complaint with your data protection authority.
10. Security
We protect data using encryption in transit and at rest, private storage, short-lived access links, access controls and audited administrative actions.
11. Changes
We will inform you in the app of any material changes to this policy.