Privacy Policy
Last updated: October 30, 2026
This Privacy Policy explains how Mimu ("we", "us") collects, uses and protects personal data when you use the Mimu app. Mimu turns a few photos of your child into a portrait session of the character they dream of being. Photos of children are the most sensitive data we hold, and the whole service is built around protecting them.
1. Who uses Mimu
Mimu is used by parents and legal guardians who are adults. Children do not use the app or create accounts. You may only add photos of a child you are the parent or legal guardian of, or whose parent or legal guardian has authorized you, and you confirm this consent in the app when you create the child's profile.
2. Data we collect
- Account data: email address, language and, if you sign in with Apple, an identifier from Apple (your email can be a private relay address).
- Child profiles: the name or nickname you give the child, the 3 to 6 photos you choose, and the record of your guardian consent (date and version).
- Portrait sessions: the character and scene you describe, the session's theme, and the portraits created for you, including any adjustments you request.
- Purchases: the transaction identifiers and the pack bought, received from Apple. We never receive your payment card details.
- Community and feedback: if you use the feedback space (Community, Ideas, Bugs), the display name you choose, your posts, replies, reactions, votes, reports and blocks, your country (derived from your network location, to place you in your country's community), and for bug reports the screenshot you choose to attach and technical context (screen, app and system version, device model, language).
- Games: scores of the games you play while a session is being created.
- Technical data: app version and device model when needed to support you, and security logs (which never contain photos).
3. How we handle photos of children
- When a photo arrives we remove its location and device metadata.
- Photos are stored in private storage and leave our servers only through short-lived links to you, or to our AI provider to create the portraits you asked for.
- We use photos only to create the sessions you request. We never use them to train AI models, and we never create or keep facial measurements, face embeddings or any biometric identifier.
- Deleting a photo, a child profile or your account removes the photos and portraits for good.
- Bug report screenshots can show your child's photos: they are seen only by you and the Mimu team, and are never sent to any AI provider.
4. How we use your data
- To provide the service: create portrait sessions, show your memories, process purchases and give back a session when it cannot be delivered (contract performance).
- To send sign-in codes and links (contract performance).
- To run the feedback community: show posts, keep it safe through automated and human moderation, and rank contributions (contract performance; legitimate interests).
- To support you, keep the service secure, prevent abuse and comply with legal obligations (legitimate interests; legal obligation).
We do not sell your personal data and we do not use it for advertising.
5. Artificial intelligence
Portraits are created by artificial intelligence. To create them, the child's photos and your description are sent to our AI provider, OpenAI, which processes them on our behalf to check the photos, plan the session, generate the portraits and check their likeness. Under our agreement OpenAI does not use this content to train its models. Text you post in the community is screened by OpenAI's moderation service. Every portrait carries the provenance metadata (C2PA) of the model that created it, which marks it as AI-generated.
6. Sharing with service providers
We share data only with providers that process it on our behalf: Amazon Web Services (hosting, storage and email delivery, United States), OpenAI (AI processing, United States) and Apple (Sign in with Apple and App Store purchases). Community posts are visible to other members of your country's community; bug reports, their screenshots and context are visible only to you and the Mimu team.
7. International transfers
Your data is stored in the United States. Where required, transfers are protected by appropriate safeguards such as the European Commission's Standard Contractual Clauses.
8. Retention
We keep your data while your account is active. Deleting a photo, a profile, a session or your account takes effect immediately; residual copies in encrypted backups are overwritten within 35 days. Unused bug report screenshots are deleted after one day. We keep only minimal records that the law requires, without photos.
9. Your rights
Depending on where you live (including under the GDPR, the UK GDPR, Brazil's LGPD and California's CCPA/CPRA), you have the right to access, correct, delete and receive a copy of your data, to object to or restrict certain processing, and to withdraw consent. You can delete photos, profiles and your account directly in the app (Settings). To request a copy of your data or exercise any other right, write to privacy@mimumagical.xyz. You also have the right to lodge a complaint with your data protection authority.
10. Security
We protect data with encryption in transit and at rest, private storage, short-lived access links, access controls and audited administrative actions.
11. Changes
We will inform you in the app about material changes to this policy.