Privacy Policy
The short version. Your camera is analysed on your phone and never recorded or uploaded. Apple never tells us which apps you lock. We store your account and your practice history so your streak follows you, and we collect usage analytics to improve the app. We don’t sell your data or use it for advertising.
Who we are
Mivu (“the app”, “we”) is made by Aleksandr Borisov, trading as Appshift. For any privacy question or request, write to privacy@appshift.xyz.
What stays on your phone
- Camera. During a practice Mivu uses the front camera to check that you’re moving. Frames are processed on your device with Apple’s Vision framework to detect body position. Video and images are never saved, recorded or sent anywhere. Only the resulting practice time is kept.
- Apps you choose to lock. You pick apps through Apple’s Screen Time picker. Apple gives Mivu only opaque tokens, not app names, so we can’t see which apps you chose. The lock is applied by iOS on your device.
- Your schedule and settings (lock time, days, language) are stored on your device.
What we collect
| Data | Why | Where it’s stored |
|---|---|---|
| Account: email address, name if you share it via Sign in with Apple or Google, a user ID | To create your account and let you sign in on any phone | Supabase (our database and sign-in provider) |
| Practice history: date, practice type, active minutes, goal | Your streak, progress and history across devices | Supabase |
| Together: your username, who you see check-ins from (everyone, friends or nobody), friends and friend requests, reactions, blocks and reports | To run Together. Others see only your username, practice type, minutes, streak and the day, as your setting allows; never your email, times, health answers or apps | Supabase |
| Onboarding answers: areas of discomfort, how long you sit, practice experience, what gets in the way, gender (optional) | To personalise your plan and understand who Mivu helps | On your device; sent as anonymous-by-default analytics events (below) |
| Usage events: screens viewed during setup, permissions granted, sessions started and completed, app opens; device model, iOS version, app version, language | To see where the app is confusing and improve it | PostHog (analytics) |
| Email address (only if you sign in with email) | To send your one-time sign-in code | Resend (email delivery), via Supabase |
Some onboarding answers relate to how you feel physically. We treat them as health-related information: we use them only to personalise Mivu and to improve it, never for advertising, and never sell or share them with data brokers.
What we don’t do
- We don’t record, store or upload camera images or video.
- We don’t track you across other apps or websites, and we don’t use advertising identifiers.
- We don’t sell your personal data.
- We don’t record your screen or collect what you type.
Legal bases (EEA, UK)
We process account and practice data to provide the service you asked for (contract). Analytics and the optional onboarding answers are processed on the basis of our legitimate interest in improving Mivu and, for health-related answers, your explicit choice to provide them. You can skip optional questions and delete your data at any time.
Service providers
- Supabase — database and authentication.
- PostHog (US cloud) — product analytics.
- Resend — delivery of sign-in code emails, and of feedback you send us to our support inbox.
- Telegram — forwards feedback you send from the app (“Ideas?”) to our team chat, with your username and the reply email you entered, if any.
- Apple Push Notification service — if you allow notifications and use Together, we store your device’s push token with your account to tell you about friend requests, friends’ practice and reactions. Turn this off in Settings → Together, or sign out to remove the token.
- Apple and Google — only if you choose to sign in with them.
These providers process data on our behalf under their own data protection terms. Some of them store data in the United States; where required we rely on standard contractual clauses for international transfers.
How long we keep data
We keep your account and practice history while your account exists. Analytics events are kept for up to 24 months. When you delete your account, your account and practice history are deleted immediately from our database; residual copies in backups expire within 30 days.
Your choices and rights
- Delete your account anytime in Mivu: Settings → Account → Delete account.
- Permissions (camera, Screen Time, notifications) can be turned off anytime in iOS Settings.
- You can ask us for a copy of your data, to correct it, or to delete it, by writing to privacy@appshift.xyz. Depending on where you live (for example the EEA, UK, California or Brazil), you may also have the right to object, restrict processing, or complain to your local data protection authority.
Children
Mivu is not intended for children under 13 (or under 16 where local law requires). We don’t knowingly collect data from children. If you believe a child has created an account, contact us and we’ll delete it.
Changes
If we change this policy in a meaningful way, we’ll update the date above and tell you in the app.