Privacy at Miora

Controller and contact

The controller is Nicolás Costa, a natural person domiciled in Peru. Contact hola@mioraapp.com, +51 983 135 455, or Avenida Arequipa 4704, Miraflores, Lima, Peru.

App data and purposes

We process the data needed to create and protect your account, including email and authentication identifiers. Your chosen provider participates when you sign in with Apple or Google. After verifying your account and before entering the main features, we request your declaration that you are at least 18 and your express acceptance of the Terms. The server records your account identifier, the versions of the Terms and privacy notice presented, your adult declaration, and the UTC acceptance date. The app also keeps an auxiliary local confirmation. We do not collect a birth date or identity documents for this declaration; it is not documentary age verification. Account verification, sign-in, or previous activity does not create legal acceptance or AI permission. The privacy notice explains processing; it is not general authorization for optional processing.

Your library includes links, images or other content you submit, originals where applicable, extracted text and information, and organisation or analysis results. Video features may process images, audio, subtitles and descriptions from shared content. This does not activate your microphone to record your surroundings. Queries and conversations may contain messages and library excerpts used to answer you.

Miora subscriptions are not available yet. This version does not offer subscription purchases or restoration. In Contact support, the message and image are optional. Your account email is included only if you enable Allow email replies. Limited technical context is also included to address your request. Requests submitted through Contact support are not analysed with AI. Avoid unnecessary sensitive data or information about others. Support requests are retained for up to 12 months from submission.

AI features and choice

Before sharing content with OpenAI for AI features, we request specific permission. The notice identifies the provider and the data that may be sent: saved or shared content, images, audio and text extracted from videos, queries, messages and selected context. Numerical representations of text are also generated to retrieve relevant content.

Miora requires this permission for its main features. If you decline or withdraw it in Privacy, you cannot enter those features, save new content, start analysis, or use AI chat. A limited area remains available to view and delete existing data, recover content from trash where applicable, manage privacy, contact support, or delete your account. Declining or withdrawing AI does not automatically erase saved data. Withdrawal stops new submissions to OpenAI; it cannot retrieve data already sent or guarantee immediate cancellation of a request that has already left Miora. AI permission is requested and recorded separately, with a version, decision, and date, and is bound to current legal acceptance. New legal acceptance does not automatically authorize AI.

OpenAI states that API data is not used for training by default unless voluntarily shared. Technical logs and persistent state have different controls; conversations may remain until deleted. Disabling response storage does not mean zero retention. OpenAI data controls.

Providers and international processing

Supabase provides authentication, database and storage; Vercel hosts APIs and Trigger.dev executes jobs. Apple and Google participate according to sign-in; OpenAI processes permitted AI features. Sentry receives diagnostics. PostHog may receive aggregate indicators and, when enabled, technical telemetry about requests and processing. The website may use Cloudflare; email delivery may use Resend. Content retrieval requests data from the source site. When video transport through Decodo is enabled, it connects to the source through a tunnel with TLS verification.

These services may process data outside Peru. They do not all have the same location, retention period or training controls. We do not sell your content or use it for personalised advertising.

Diagnostics and measurement

Sentry helps detect technical errors and crashes with limited technical information. We apply filters to reduce personal data and private content. This diagnostic integration does not record screens or replay sessions, and it cannot guarantee detection of every failure.

Miora APIs retain observations linked to accounts to calculate activity, entries, sessions, saves, opens, activation and return. Internal and test accounts are excluded. This source permits deduplication and return calculations; we do not describe it as anonymous. When initial-journey measurement is enabled, a random identifier allows observation of steps before account creation for up to 24 hours. After you authenticate, that journey may be linked internally to your account and to the references needed to verify saving and opening the same content. It does not establish who downloaded or installed the app. These events do not contain email, text, URLs or saved content.

PostHog receives operational indicators containing counts and periods, without individual account, session or content identifiers. Previous event collection linked to an account pseudonym is not resumed. Where that previous history exists, account deletion retains its erasure request. Aggregate counts do not make the internal individual source anonymous. Separately, when technical telemetry is enabled, PostHog may receive trace identifiers and data such as duration, technical status, model and token counts. Device query telemetry depends on its corresponding permission; server processing telemetry depends on its configuration. These events are not described as aggregate counts alone or as zero-retention processing. Operational measurement differs from optional website analytics.

Previous permissions and session replay

This version does not offer new authorizations for optional onboarding measurement or Microsoft Clarity app session replay. Replay remains disabled. If you previously authorized those features, Privacy lets you withdraw the retained permission and retry a pending withdrawal. Withdrawing onboarding measurement synchronizes erasure of its individual records when connected; completion is not shown before confirmation. Withdrawing Clarity updates the local permission and keeps replay disabled. Individual events from that previous onboarding measurement have a 30-day retention period; its grouped PostHog totals, up to 12 months. Once a total is published, your individual contribution cannot be separated from it. Declining or withdrawing AI does not accept or reauthorize these features.

Retention and deletion

Active account data will be deleted within 30 days after a confirmed deletion request. This deadline does not establish a backup deletion deadline.

Account, library, and current acceptance and permission records remain while needed to provide the service and manage your choices, until you request deletion, subject to applicable legal exceptions. Acceptance records retain current state and the latest operation receipt; they are not a complete immutable history of every previous version. Trash and purge follow the status shown in the app. Account deletion coordinates removal of individual data, images, originals and conversation context. A dependency failure may leave deletion pending and require a retry. We do not promise instant erasure or an unverified backup deletion deadline.

Operational observations and initial-journey records stop contributing to calculations after 72 days. Daily maintenance physically deletes them when it runs successfully. A minimal first-activity marker remains until account deletion. Historical aggregate counts and diagnostics have separate retention.

Website, survey and waitlist

The survey collects answers, language and visit source without requiring email or phone. The waitlist collects email, language, source and permission to send updates. You may answer or browse without signing up. Website analytics with Microsoft Clarity and Google Analytics activate only with permission and may use cookies, usage measurement and session replays with form fields masked. You may decline or withdraw through Privacy. Survey and waitlist records remain for up to 24 months after the last interaction while needed to validate and launch Miora.

Rights and changes

Request information, access, correction, deletion, objection and, where applicable, portability, withdraw permission or unsubscribe at hola@mioraapp.com. Additional rights and remedies apply where required by applicable law. We may request reasonable information to verify your identity; do not send sensitive documents before an appropriate channel is provided. If you believe someone under 18 is using the app, contact us to review and delete the relevant account. Material changes will be reflected in this notice and relevant app notices.