Mira privacy details
How Friction Ventures handles account, meal, and imported health data.
Records Mira handles
Mira handles the account identity returned by Google or Apple sign-in, including the provider account identifier, name and email address, and a Google avatar URL when supplied; profile height and weight; the authoritative IANA timezone and revision; nutrition targets and target history; meal timestamps, photos, itemized nutrition, notes, processing status, and recoverable-deletion dates. Coach conversations may include text you type, a voice recording retained for authenticated playback, its processing status, and the transcript created from it.
Apple may provide a private relay email address and may omit your name on later sign-ins. Mira stores Apple revocation credentials encrypted on its server. Apple and Google sign-ins with the same verified email address automatically use the same Mira account. Different email addresses stay separate unless you explicitly link a sign-in method with fresh sign-in proof. Mira also stores subscription status, store, product, expiry, transaction identity, and whether the purchase belongs to the production or sandbox environment. Approved TestFlight sandbox purchases can provide separately labeled beta access; they do not become a paid production subscription.
When you connect a supported health provider, Mira can handle steps, active calories, exercise sessions, and weight, together with requested record types, capture/upload/projection timestamps, device app version, synchronization sequence, consent version, and minimized deletion audit state. On Android, Mira does not request Health Connect history permission. On iPhone, Apple Health does not reveal whether you denied read access or there is no matching data. Initial import and timezone reconciliation are bounded to 30 local dates.
Why the records are used
Account records authenticate your private journal. Meal photos are analyzed to identify food and estimate itemized nutrition. Meal and target records render your journal and nutrition progress. Coach messages are used to respond, log food, provide requested nutrition feedback, and privately search earlier visible Coach exchanges when needed to answer a later question; Mira stores the recording in private object storage so transcription can finish reliably in the background and you can play it back while it remains retained. Imported health records produce daily movement metrics, current weight, and fresh exercise adjustments. The timezone determines your local calendar boundaries; mobile app observations may request a revision-checked timezone update, but the server value remains authoritative.
Health consent and permissions
Health pairing requires an unchecked, explicit consent control for the current policy version. Provider permissions are separate from Mira consent. On Android, removing a Health Connect permission stops Mira reading that record type. On iPhone, Apple Health does not reveal whether read access was denied, and Mira cannot treat an empty result as proof of permission. Changing provider permission does not by itself revoke the Mira server connection, withdraw Mira consent, or delete records already imported.
Disconnecting in Mira revokes only that device connection after the server confirms the outcome. It does not change permissions in Health Connect or Apple Health. A server-revoked token can no longer sync. Withdrawing consent revokes sync and freezes imported history without changing it. None of these actions silently performs imported-data deletion.
Deletion, recovery, and retention
The separate “Delete imported health data” action first freezes access, revokes connection tokens, and blocks pairing, then deletes imported source records, aggregates, projections, synchronization state, and device metadata in retryable background work. Manual measurements, meals, nutrition targets, and minimized consent/deletion audit evidence remain.
Normally deleted meals and their private photos remain recoverable for 30 days and are included in exports during that period. After the recovery deadline, bounded purge work deletes the records and private objects. Account erasure is separate and immediately revokes account access while physical object deletion continues durably if a storage retry is needed.
Successfully transcribed voice audio is retained in private storage for authenticated playback until you erase your account. Mira also keeps a failed recording until you retry or delete it, subject to bounded per-account storage limits. Visible Coach transcript text and its “Transcribed from voice” marker are retained for the lifetime of your account and are deleted when the account is erased.
Imported health is retained while your account exists until you explicitly delete imported health or erase the account. Frozen history is not automatically deleted merely because consent or a connection was revoked.
If you erase an account that uses Apple sign-in, Mira removes the account and retains only an encrypted revocation credential and a minimized identity digest while it retries revocation with Apple. The credential is removed after Apple confirms revocation. Short-lived authentication challenges and minimized revocation and notification digests prevent replay and late callbacks; completed erasure credentials and associated digests are pruned separately from user records. Removing beta enrollment ends beta access without deleting your journal or cancelling a production subscription.
Service providers and exclusions
Google or Apple processes identity-only sign-in, according to the method you choose. Apple and Google Play process purchases and subscription management for their respective stores. Private DigitalOcean Spaces storage holds meal photos and retained voice recordings in production. Gemini receives meal-photo and meal-edit context needed for nutrition analysis and chat actions. If you send a voice message, Gemini also receives that recording to create a transcript. Successfully transcribed raw audio remains private and available only for authenticated playback until account erasure, while the resulting transcript and its voice-origin marker are stored as a Coach message. When a later Coach question calls for earlier context, bounded excerpts from visible user and assistant messages may be sent to Gemini; raw voice audio, system prompts, tool arguments and results, internal traces, summaries, and memories are excluded from transcript search. Imported health records and derived health metrics are not automatically included in Gemini prompts.
RevenueCat receives Mira's opaque account identifier and store purchase metadata to validate subscriptions, restore purchases, and report subscription status. Mira does not send RevenueCat your name, email address, health records, meals, photos, voice recordings, or Coach messages. Sentry receives sanitized application errors only when configured. Mira disables tracing, profiling, replay, log forwarding, and default personal-data collection. The scrubber removes users, requests, query strings, breadcrumbs, health payloads, photo or storage identifiers, provider bodies, and tokens; an event is dropped when it cannot be proven safe.
Security and access
Mira uses authenticated same-origin API requests, private time-limited photo delivery, encrypted transport in production, an enforced Content Security Policy, no-store handling for private routes, one-time pairing credentials, and server-side authorization. Pairing credentials are placed in an App Link fragment or entered manually, not in a query string or image description.
Your controls
The signed-in profile provides data export, profile and target updates, health consent withdrawal, imported-health deletion, meal recovery, and account erasure controls. A failed voice message provides Retry and Delete controls beside authenticated playback. Exports include safe voice-processing metadata and transcript provenance, never raw audio or private object keys. Base nutrition targets remain available when health is unpaired, stale, reconciling, frozen, revoked, or being deleted.
Optional analytics and subscription attribution
When optional analytics is available, the public Mira website and the Mira app each ask for a separate choice. Declining does not limit browsing, sign-in, food tracking, Health Connect or Apple Health, or subscriptions. Website Privacy settings and the app Profile let you change the choice. An offline app denial stops local collection immediately and shows when server synchronization is still pending.
With your choice, Google Analytics and Firebase process browser or app-instance identifiers, an independent analytics account identifier for signed-in app use, approved campaign labels, technical device and app information, and acquisition events such as signup, subscription options, checkout, trial and first paid subscription. Google processes network information including IP addresses to provide its service and derive approximate location. Mira does not send email addresses, Google sign-in identifiers, billing identities, raw store transaction identifiers, food photos, nutrition, health records, Coach messages or voice audio to analytics. Advertising storage, advertising user data and personalization remain disabled; advertising identifiers are not collected by Mira analytics.
Mira uses approved campaign labels to understand how people find the app and become paying subscribers. Android can carry an approved campaign through Google Play installation. An unrelated website visit is not linked to your app account. Anonymous iPhone install attribution can remain unknown. RevenueCat supplies authenticated purchase information; Mira records the first qualifying positive-price subscription separately from trials, renewals and restores. Reported value is the provider-reported price and is not settlement accounting. Analytics does not decide paid access.
Approved campaign details are retained for at most 30 days and inactive installation context for at most 90 days. Sent server analytics payloads are removed within 7 days; failed or ambiguous payloads within 30 days. Google Analytics user and event retention is configured to 2 months without renewal on activity. Optional consent decision history has a one-year audit window. Minimal subscription eligibility and deduplication records are retained until account erasure and contain no Google identifiers or campaigns.
Withdrawal and account erasure stop new authorized server exports and queue deletion requests for registered Google identifiers. Encrypted identifiers needed to recover deletion requests are retained for a maximum 90-day recovery window. A Google submission acknowledgment is not confirmation of completed physical deletion; delayed app traffic, temporary outages and previously aggregated reporting may limit deletion. Unfinished deletion work is recorded for operator follow-up. Website settings clear local analytics cookies, but account erasure cannot identify unrelated anonymous browsers. Contact the privacy address in this policy for a website-data request, supplying an available visitor identifier only through that private contact process.
This notice is versioned independently of health consent. Compatible editorial changes can preserve a choice; material changes to analytics purposes or data require a new choice. Native analytics is disabled in builds until its privacy and provider setup checks pass. Google is an external analytics processor; its processing and international transfers are subject to the operator’s applicable Google agreements. The operator must publish aligned disclosures before enabling collection.