Privacy Policy

Effective date: 5 October 2026 · Version 1.2

This policy explains what Mira AI collects, what it deliberately does not collect, where your messages actually travel, and how long anything is kept. It is written to be read, not to be survived.

Data controller: Kervan LLC, a Wyoming limited liability company, United States. Contact: support@kervandeveloper.com Postal address: Kervan LLC, 30 N Gould St Ste N, Sheridan, WY 82801, USA

If you are in the EU, the UK, California or Türkiye, sections 8–11 describe rights that are specifically yours.

1. The short version

• We do not know your name. There is no username, no phone number, no date of birth, no contacts, no photos, no location.
• Your messages leave your phone. They have to: the reply is generated by an AI model running on someone else's servers, not on your device.
• We do not store the text of your messages on our servers, and we do not write it into any log. The request is processed and drops. The one piece of text we do store is what you deliberately type into the feedback form, and only that — see §2.9.
• We do keep a short rolling summary of your conversation on our server, so Mira can remember who you are between sessions.
• Your full conversation history is kept on your device only, is not backed up to iCloud, and is gone if you delete the App.
• We never use your conversations to train AI models. We never sell your data. There are no advertisements, no ad identifiers, no analytics SDKs and no third-party trackers in this App.

2. What we collect, and why

2.1 Account

When you create an account we store: your account identifier, and either the email address you signed up with (with a password we never see in plain form) or the opaque identifier Apple gives us through Sign in with Apple. If you use Apple's private relay address, that relay address is all we receive.

Before you create an account you can send a few introductory messages using an anonymous session. That session is identified by a random internal number stored on your device. It is not linked to you. If you delete and reinstall the App, a new anonymous session is created — the old one is not recoverable, and it is not tied to your device fingerprint.

Why: to give you an account, keep your subscription attached to it, and enforce usage limits.

2.2 Your messages

When you send a message, your device sends that message together with up to the last 28 messages of the current conversation to our server (a Supabase Edge Function). Our server forwards them to an AI model provider, receives the reply, and returns it to you.

On our side this text is processed in memory and discarded. It is not written to our database and it is not written to any log. What we keep from a conversation is described in §2.3.

What the model provider does with the text is governed by their own agreement with us. Section 4 names them and states our contractual position.

Why: this is the service. Without sending the message there is no reply.

2.3 Conversation summary

So Mira can remember your name, what you have told her and where you left off, our server keeps a short rolling summary of your conversation (table conversation_summaries). It is a few sentences, written by the model, that replaces older messages rather than storing them.

The summary is stored per user, is not readable by any other user, and is not readable by the App itself — only the server function that writes it can read it back. It is deleted when you delete the conversation or your account.

The summary is written from your own words, so it can contain personal details you chose to share. Treat it as you would treat a diary entry stored in the cloud: short, but real.

Why: to deliver the memory feature the paid tier promises. Legal basis: performance of the contract.

2.4 Usage counters and subscription status

We store how many messages you have sent in the current period and whether your subscription is active, together with its expiry date.

Why: to enforce the free limit and to unlock the paid tier. Legal basis: performance of the contract.

2.5 Connection records

Every time an action reaches our server — session opened, message sent, rate limit hit, quota blocked, account deleted — we record that it happened. Specifically: your IP address and forwarded-for header, an approximate country code derived from the request, the time, the type of action, the number of bytes transferred, your internal account and device identifiers, and your device platform, user agent and app version.

These records show that something happened, not what was said. There is no copy of your message in them.

Why: security, abuse and fraud prevention, service integrity, and compliance with obligations that apply to providers of hosted services in several of the countries where the App is available. Legal basis: our legitimate interest in a secure service, and legal obligation.

2.6 Payments

We never see your card. Apple processes the purchase and tells us only whether a subscription is active and when it expires. We do not receive your name, billing address or payment instrument.

2.7 Support email

If you write to support@kervandeveloper.com we hold that email and our reply for as long as needed to resolve the matter and to keep a record of it.

2.8 Launch waitlist (website only)

If you enter your email address in the "tell me when it ships" box on our website (kervangroup.com/mira), we store that email address, the language of the page you used and the fact that it came from that page. Nothing else: no name, no IP address, no tracking cookie, no advertising identifier. This list lives in our own database, is not shared with anyone, and is used for exactly one thing — a single message when Mira launches. You can have your address removed at any time by writing to support@kervandeveloper.com, and the whole list is deleted once the launch message has been sent.

This is separate from the App: it happens on the website, before the App exists on your phone, and it is not linked to any account.

Why: to tell you the product you asked about is available. Legal basis: your consent, given by submitting the form; you may withdraw it at any time.

2.9 Feedback you send us

If you fill in the in-app feedback form, we store what you put in it: a rating from 1 to 5, the optional free-text note you wrote (at most 500 characters), your account identifier, your device identifier and the time. Nothing else.

This is not your conversation. Nothing you have written to Mira is copied into it; the form has its own field and the request that carries it has no room for anything else. Only you decide what goes in that box, so please keep it about the App.

Why: to find out what is wrong with the product and fix it. Filling the form once also unlocks five extra messages — a one-time reward tied to the form itself, not to any store rating. Legal basis: your consent, given by sending the form.

Where it is kept: in our Supabase database, on servers in the European Union, like the rest of our data (§4). No user of the App can read it back — not even the person who wrote it; only we can. It is never sold, never shared with advertisers, and never used to train AI models.

How long: until you delete your account. Deleting your account deletes your feedback with it, in the same operation (§8). The extra messages you were given are a usage counter, not personal text, and follow the rule for counters in §5.

2.10 What we do not collect

No location. No contacts. No camera or microphone access. No photo library. No advertising identifier. No health data. No analytics events. No crash breadcrumbs containing your content. The App requests no runtime permissions on Android and explicitly blocks camera, microphone, contacts and location permissions.

3. Where your conversation history lives

Your full conversation is stored on your device, in the app's cache directory.

Two consequences you should know before you rely on it:

• It is not backed up to iCloud and is not exported anywhere. This is a deliberate design choice.
• If iOS runs short of storage it may clear that directory. If that happens, your conversation history is gone and we cannot restore it, because we never had it.

Mira will still recognise you afterwards, because the summary in §2.3 lives on our server.

4. Who else processes your data

We use a small number of processors. They are named, not hidden behind "our partners":

We instruct our model provider not to use your content to train models and not to retain it beyond what is needed to return a reply and to run their own abuse controls. Model providers do apply short-term abuse monitoring on their side; we cannot switch that off, and we will not pretend it does not exist.

The specific model we route to can change — for cost, quality or availability. When it does, the category of processing does not: text in, text out, no training, no sale. This page is updated to name the current route.

We have no advertisers, no data brokers, no analytics vendors and no affiliate networks. We do not sell or share your personal information, in any sense of those words, including as they are defined by the California Consumer Privacy Act.

5. How long we keep things

6. International transfers

Our database and functions run in the European Union. The AI model provider may be in the United States. If you are in the EU, the UK or Türkiye, your messages are therefore transferred outside your country while a reply is being generated.

These transfers are covered by the European Commission's Standard Contractual Clauses (and the UK Addendum where applicable) in our agreements with those providers, together with the technical measures described here — in particular the fact that we do not persist the message text.

7. Security

Traffic between your device, our server and the model provider is encrypted in transit (TLS). Access to our production database is limited to the operator. Connection records are not readable by any user of the App. Direct client access to the summary table is revoked at the database level, so a stolen public API key cannot read it.

We should be plain about the limit: because your messages travel to a third-party model to be answered, this is not an end-to-end encrypted service. Do not send passwords, financial account numbers, government identifiers, or health information about yourself or anyone else.

No system is perfectly secure. If a breach affects your personal data and creates a risk to you, we will notify you and the competent supervisory authority as required by law.

8. Your rights

Wherever you live, you can ask us to:

• confirm what data we hold about you and get a copy of it;
• correct it if it is wrong;
• delete it — you can do this yourself, immediately, in Settings → Delete Account;
• restrict or object to processing based on our legitimate interests;
• port your data to another service in a machine-readable form;
• withdraw consent where we relied on consent, without affecting what was done before.

Data subject requests

You can send any request about your personal data through one channel: support@kervandeveloper.com. This covers requests to find out whether we process your data, to get information about it or a copy of it, to have it corrected or deleted, to object to its processing, to withdraw consent where we rely on consent, and to exercise any other right you have under the law that applies to you, including Article 11 of Turkish Law No. 6698.

• Free of charge. You do not need to fill in a form, call us or send a copy of an identity document. An email saying who you are and what you want is enough.
• Identity. For a product with accounts, we may ask you to write from the email address registered to your account. For a product without accounts, we ask only for the minimum information needed to act on your request. We ask for more only if we have reasonable doubts about who is asking.
• Deadline. We complete your request no later than 30 days after it reaches us. If one calendar month ends sooner, we complete it within that month. We do not extend this period.
• Form of reply. Our reply is always in writing, by email. Information given by phone or orally does not count as our reply.
• Content of reply. We state clearly which part of your request we accepted and what we did. If we refuse any part, we give the reasons.
• Complaints. If we refuse your request, if you find our reply inadequate, or if we do not reply in time, you can complain. In Türkiye, complain to the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu) within 30 days of learning of our reply and in any case within 60 days of your request (Law No. 6698, Art. 14). In the European Union, complain to the data protection authority of the country where you live or work or where the alleged infringement took place. In the United Kingdom, complain to the Information Commissioner's Office (ICO). Elsewhere, complain to the competent data protection authority in your country. You may also go to court.
• Records. We keep the date of each request, the request, the date of our reply and the reply for 24 months after the request is closed. We keep them only to be able to prove that we answered correctly and on time.

We will never charge you, degrade the service, or treat you differently for exercising a right.

Deleting your account removes your login identity, your usage counters, your subscription record, your conversation summary and any feedback you sent us. Connection records already created are kept until their 12-month period expires, because retaining them is a legal obligation we cannot waive at request.

If you are in the EU or the UK (GDPR / UK GDPR): our legal bases are set out beside each purpose in §2 — performance of the contract for the service itself, legitimate interests for security and abuse prevention, and legal obligation for the retention in §2.5.

If you are in California (CCPA/CPRA): the categories of personal information we collect are identifiers, commercial information (your subscription), internet activity (connection records), the content of your messages while in transit, and the feedback you choose to send us. We collect them for the purposes in §2, from you and from your device. We do not sell or share personal information and we do not use it for cross-context behavioural advertising. We do not knowingly collect data from anyone under 18. You have the rights to know, delete, correct, and to non-discrimination, listed above; an authorised agent may act for you with proof of authority.

If you are in Türkiye (KVKK, Law No. 6698): Mira AI is not marketed in Türkiye, but it can be downloaded there. Kervan LLC acts as data controller (veri sorumlusu). Processing is based on KVKK art. 5/2(c) (necessary for the performance of a contract) and art. 5/2(f) (legitimate interests), and the cross-border transfer in §6 is carried out with your explicit consent under art. 9 and on the basis of the standard contractual undertakings in our processor agreements. You hold the rights listed in art. 11 and you may apply to us as described above and, if unsatisfied, to the Personal Data Protection Board (KVKK).

9. Children

The App is for adults. You must be 18 or older. We do not knowingly collect personal data from anyone under 18. If we learn that an account belongs to a minor we delete the account and its data. If you believe a minor is using the App, write to support@kervandeveloper.com and we will act.

10. Automated decisions and AI transparency

Replies are generated automatically by an AI model. The App tells you this permanently and non-dismissibly on the conversation screen, in line with Article 50 of the EU AI Act.

We do not use automated decision-making that produces legal effects concerning you or similarly significantly affects you. Rate limits and abuse controls are technical thresholds, not profiling, and you can reach a human at support@kervandeveloper.com about any account action.

11. Changes to this policy

If this policy changes materially, we will show it to you in the App and ask you to accept the new version before you continue. The version number and effective date at the top always identify the text in force. Older versions are available on request.

Kervan LLC support@kervandeveloper.com Privacy Policy v1.2 — 5 October 2026