# Privacy Policy

Last updated: 18 October 2026. This policy explains what Mirabu collects and why.

## What you upload
Photos and screenshots you submit are uploaded only after you agree on the screen Mirabu shows before your first upload. They are analyzed by our servers and by the AI service providers named on that screen, only to produce your report. Our servers never store the photo: it is processed in memory and discarded as soon as your report is ready. The report itself stays on our servers for up to 24 hours, so it can be unlocked if you subscribe, and is then deleted. You can withdraw your permission any time in Profile → Privacy & Security; Mirabu then asks again before the next upload.

## Free-scan limit, security and service records
To apply the daily free-scan limit, stop abuse and keep the service secure, each request carries a random ID made by the app (it isn’t linked to you), your time zone, your platform and app version and, for subscribers, the subscription ID from Adapty; our servers also see your IP address. We keep: that day’s scan counts, deleted after two days; a technical log of each request (time, what was requested and its result, the user agent and the country estimated from your IP address), deleted after 7 days, or after 30 days if the request was flagged as suspicious; a pseudonymous usage record for this install, linked to a random ID and not to your name (first and last use, number of scans and failed attempts, plan, language, platform, app version, time zone, country), deleted 13 months after its last use; and this install’s access history (time, what it did and the IP address), deleted after 6 months. IP addresses are stored encrypted, only authorized staff can view them and every view is logged; we disclose them only to comply with a legal obligation or a lawful request from the authorities, or to protect the service and its users against abuse. Your photos, messages and results are never part of these records. Delete all data gives the app a new random ID, so later requests are no longer linked to these records.

## What stays on your device
Your reports, scan history, preferences and subscription status are stored on this device. Profile → Account & data → Delete all data removes them.

## The people you check
Nothing is ever sent to the person you check, and we never contact them.

## Purchases
Subscriptions are processed by Apple or Google; we never see your card details. Adapty, our subscription service, receives your purchase and subscription status, a random app ID and your country, so PRO works and we can see which campaigns lead to subscriptions. We do not collect your advertising identifier.

## Notifications
With your permission we send local reminders (trial ending, free scans back, weekly digest) and occasional push messages through OneSignal, which receives a device token, your app language, your country (from your IP address) and whether you are on the free plan, a trial or PRO. You can turn notifications off in Profile → Notifications or in your phone's settings.

## Usage analytics and crash reports
Unless you turn it off in Profile → Privacy & Security → Share usage data, the app sends usage events — screens opened, buttons tapped, purchases — to PostHog, hosted in the EU, linked to a random ID. If the app crashes or freezes, a crash report goes to Sentry, stored in the EU: the error, the app version, the phone model and system version, and the app’s last steps, with a random ID and without your IP address. Your photos, messages and results are never included in either.

## Your rights
You can delete your data at any time from Profile → Account & data → Delete all data, or by emailing support@mirabu.app.

## This website: cookies and analytics
This section covers the website www.mirabu.app; the sections above cover the app.

The website uses Google Tag Manager and Google Analytics 4, provided by Google, to count visits and see which pages are read. Google Analytics sets two first-party cookies, _ga and _ga_<ID>, that last up to two years, and receives your browser and device details. According to Google, Google Analytics 4 does not log or store IP addresses. No advertising cookies are used.

You can turn analytics off any time with Cookie settings at the bottom of every page: its cookies are deleted and no analytics script loads on later visits. That choice is saved in your browser’s local storage, not in a cookie. Questions: support@mirabu.app.