Privacy Policy

This policy describes how personal information is handled in miggy (the "Service").

Effective date: September 19, 2026 ／ Last revised: October 24, 2026
Business operator: masaya shiramizu
Address: Shibuya Dogenzaka Tokyu Bldg. 2F-C, 1-10-8 Dogenzaka, Shibuya-ku, Tokyo 150-0043, Japan ／ Contact: [email protected]

1. Information We Collect

The Service does not collect your name, address, phone number, date of birth, or gender. Our servers do not collect your location either. The region setting (country/region code) and UTC offset above are device settings, not location information (such as GPS).

The following features handle location on your device:

• Sending a location in a conversation: only when you choose to send a location, the app reads your current location once, with iOS permission (While Using the App). The location (latitude, longitude and place name) is end-to-end encrypted like other messages and delivered to the recipient; our servers handle only the encrypted data.
• Photo search: the app reads the location recorded in your photos on your device so you can find photos by place name. The search index is stored only on your device.
• In both cases, the location is sent to Apple's map service to show place names (for photo search, rounded to an area of about 5 km). See the Disclosure on External Transmission for details.

2. Purposes of Use

• Identity verification/authentication and prevention of impersonation (device public key)
• Providing features such as friends, messages (DMs), voice calls, shared albums (including tallying favorites and showing them to the owner), web co-browsing, YouTube watch parties, Apple Music "Listen Together", and games
• Account recovery via Apple ID link
• Providing the paid service (Treats: Juice and Candy) and checking purchases, renewals, cancellations and refunds
• Delivering push notifications (including announcements)
• Preventing abuse and nuisance behavior, handling reports and blocks, ensuring safety
• Troubleshooting and responding to inquiries
• Displaying advertisements (Section 5)

3. Retention Periods

• DM ciphertext: deleted upon successful delivery; automatically deleted after 14 days if undelivered. Records kept for unread management (sender and recipient identifiers, sender display name, sent time) are deleted when the conversation is opened, and in any case automatically within 14 days of sending. When scheduled sending (Snack) is used, the ciphertext, recipient and time are kept until the scheduled time (up to 30 days later) and deleted when delivered or cancelled.
• Decrypted message history: stored only on the user's device (not retained on the server). Users subscribed to Juice can choose, per person, how long it stays on the device (1, 2 or 3 months); older history is deleted from the device automatically.
• Profile, friends, shared albums, favorites, etc.: until deleted by the user or until the Service ends. However, friend relationships with no interaction for one year are removed automatically. Albums saved to storage (including photos and videos) are deleted automatically 90 days after the owner or a permitted viewer last opened them (the owner's device is notified at 60 days). Shared album favorites are deleted when removed or when the album is deleted.
• Apple ID link information: until you unlink it (you can unlink from the app's settings).
• Treats purchase information: until you delete your account. For users subscribed to a paid plan that extends retention (Snack; in preparation), storage albums are deleted automatically 365 days after they were last opened (after the subscription ends, 90 days from the later of the last open and the end of the subscription).
• Co-browsing activity (URLs, etc.): used only to relay to room participants and deleted when the room ends (max 1 hour). Not stored on our servers as browsing history.
• Room shared state (YouTube, Apple Music, games): used only to relay to room participants and sync participants who join mid-session, and deleted when the room ends (max 1 hour). Not stored on our servers as viewing or listening history.
• YouTube search results: to reuse responses for identical searches, kept per search term for up to 1 hour without being linked to any information identifying the user.
• Account deletion: Users can delete their account at any time from the app's settings. Upon deletion, we immediately erase the profile, handle, friend relationships, shared albums (including photos and videos), favorites, undelivered messages, Apple ID link information, subscription purchase information, and similar data (Apple's billing does not stop, so please cancel first). However, for safety purposes, records of reports received from other users are retained with only the identifier, and reports made by the user are retained with the reporter anonymized.
• Backups: to recover from failures, we back up the server database (profiles, friend relationships, shared album indexes, ciphertext of undelivered messages, etc.; the photo and video files themselves are not included) daily and keep each backup for 14 days. The database can also be restored to any point within the past 30 days. Even after account deletion or after the periods above, data remains in these backups until those periods have passed, and is then erased automatically. Backups are used only for recovery.
• Report records and communication logs: within the scope and period necessary for operations and abuse prevention.

4. Third-Party Provision, Outsourcing, and Transfers to Foreign Third Parties

The Service uses services of the following external providers (all foreign (U.S.) corporations). These constitute "provision to third parties in foreign countries" or "outsourcing" under the Act on the Protection of Personal Information of Japan.

• About storage locations: because the backend is an edge computing platform, data may be processed and stored around the world. While the contractor is incorporated in the U.S., the actual storage locations may span multiple countries including Japan and may not be identifiable.
• The names of external providers to which information is transmitted from the user's device are listed in the annex "Disclosure on External Transmission".
• For information about data protection systems in these countries, refer to materials published by the Personal Information Protection Commission of Japan.
• Except as required by law, we do not provide personal information to third parties without prior consent.

5. Advertising (External Transmission)

The Service uses third-party advertising services. Information is transmitted from the user's device to the advertising provider for this purpose. Details are in the annex "Disclosure on External Transmission".

6. Integration with External Services (YouTube, Apple Music, Google, AI, Wikipedia, KLIPY)

In the following features, your device communicates directly with each provider's services. Information obtained by these providers is handled in accordance with their respective privacy policies.

(1) YouTube Watch Parties

• The Service uses YouTube API Services.
• Searching for videos and fetching recommended and related videos is performed by our servers querying the YouTube Data API with our own API key. We do not request access to your Google account.
• Videos are played in the official YouTube embedded player (IFrame Player) on your device, which communicates directly with YouTube (Google). Google may collect information about your device and viewing through cookies and similar technologies. Thumbnail images are also fetched by your device directly from YouTube.
• Video IDs, playback positions, etc. shared in a room are deleted when the room ends (max 1 hour), as described in Section 3.
• For how Google handles information, see the Google Privacy Policy (https://policies.google.com/privacy).
• If you have linked a Google account to the Service (see (3) below), you can revoke the Service's access at any time from Google's security settings page (https://security.google.com/settings/security/permissions).

(2) Apple Music "Listen Together"

• Available only to Apple Music subscribers. Searching for and playing songs is done by your device communicating directly with Apple through Apple's MusicKit; our servers do not distribute or relay music.
• To synchronize playback among room participants, song IDs, song titles, artist names, artwork URLs, playback position, playback queue, and temporary playlists are shared with room participants via our servers and deleted when the room ends (max 1 hour).
• Temporary playlists created in a room may be saved to your own Apple Music library.
• For how Apple handles information, see Apple's Privacy Policy (https://www.apple.com/legal/privacy/).

(3) Google Integration (Google Calendar, Google Sheets, Google Slides)

• If you choose to link a Google account, the Service authenticates using Google's official SDK (Google Sign-In) and accesses Google APIs within the scope you authorize. The scopes requested are viewing, creating, editing, and deleting Google Calendar events, and access to only the files in your Google Drive that you choose and files created by the Service (drive.file). Permission is requested the first time you use each feature. The Service does not access any other files in your Drive or list your files.
• Google Sheets: the Service reads the title, list of sheets, and cell values and formulas of spreadsheets you choose or that the Service created, using the Google Sheets API, and sends to Google the cell values you edit, rows and columns you add or delete, title changes, and new spreadsheets you create.
• Google Slides: the Service reads the order and text of presentations you choose or that the Service created, using the Google Slides API, and sends to Google the text you rewrite, slides you add or delete, title changes, and new presentations you create. With “Create from Photos”, the deck you build (a .pptx file that contains the photos you selected) is uploaded to your own Google Drive using the Google Drive API and converted to Google Slides.
• Files are chosen with Google's official file picker (Google Picker). The app displays a page on the Service's public website (miggy-project.com), and that page loads Google's services (apis.google.com). The access token is passed to that page within the app and sent only to Google; it is not put in the URL and is not sent to our servers. The app receives only the ID, name, and type of the file you choose. As with any web page, loading it sends your IP address, device information, etc. to the infrastructure that serves the public website.
• Credentials such as access tokens are managed on your device by the SDK. Calendar events, the contents of spreadsheets and presentations, your Google account email address, etc. are communicated only between your device and Google and are not sent to or stored on our servers. However, only if you choose an AI with your own API key and agree after reviewing what will be sent, the contents of a table or slides are sent from your device to that AI provider (see (4) below).
• The “Recent” list (file IDs, names, and when you opened them) and in-progress “Create from Photos” drafts are stored only on your device.
• The Service's use and transfer to any other app of information received from Google APIs (Google Calendar, Google Sheets, Google Slides, Google Drive, and Google Picker) will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. We do not use Google user data for advertising, and we do not provide or sell it to third parties.
• You can unlink at any time from the app's settings (the Service's access is also revoked when you unlink, and Google Calendar, Sheets, and Slides can no longer be opened from the Service). You can also revoke access from Google's security settings page (https://security.google.com/settings/security/permissions).

(4) AI Using Your Own API Key (Anthropic, OpenAI, Google Gemini)

• Only if you choose to add another company’s AI API key and agree after reviewing what will be sent, the Service sends your question, parts of the text being written, the selected photo and your request directly from your device to the provider you chose, for writing Mi Dictionary entries and for “Transform Photo” in shared rooms. It does not pass through our servers.
• When Mi Dictionary’s “look things up” option is used (on by default), the Service uses the chosen provider’s web search feature (web search for Anthropic and OpenAI, grounding with Google Search for Google Gemini) before writing. The provider’s AI searches based on your question and the section headings. Search fees are charged to your API key.
• Google Sheets AI (Tidy Up, Summarize, Suggest Columns) sends the table’s title, headings, and cell contents. Google Slides AI sends the heading and body text of the slide for “Rewrite” and “Shorten”, and for “Plan Slides with AI” in “Create from Photos”, the note you enter and a description of each selected photo (the date taken, the place name, and words for what is in it). The photos themselves are not sent. The descriptions are made on your device (place names are ones already recorded on your device for photo search; the Service does not look them up anew to send them). You are asked to confirm each time before anything is sent.
• If you choose the on-device AI (Apple Intelligence), the contents of tables and slides and the photo descriptions are not sent off your device.
• API keys are stored only in your device’s Keychain and are never sent to our servers. You can delete a key at any time from the app’s settings.
• Each provider’s terms and privacy policy govern how the data is handled (free tiers may use it for training). See the annex "Disclosure on External Transmission" for details.

(5) Looking Things Up for Mi Dictionary (Wikipedia)

• When you write Mi Dictionary entries with the on-device AI (Apple Intelligence) and the “look things up” option is used (on by default), the Service sends the words of your question and the terms directly from your device to Wikipedia (Wikimedia Foundation, Inc., US) before writing, to search for articles and fetch their summaries. It does not pass through our servers.
• Section headings, the text being written, and information that identifies you are not sent. As with any connection, your IP address and device information are sent to the Wikimedia Foundation.
• You can turn this off by setting reference: off in Mi Dictionary’s settings (harness). When it is off, nothing is sent to Wikipedia or to any provider’s web search.
• See the Wikimedia Foundation’s privacy policy (https://foundation.wikimedia.org/wiki/Policy:Privacy_policy) for how it handles information.

(6) GIFs in Conversations (KLIPY)

• When you search for GIFs via "+" → "GIF" in a conversation, our servers query the API of KLIPY (Kikliko, Inc., US). We send the search terms and an identifier derived from your user ID (not the user ID itself). The KLIPY API key is kept only on our servers.
• A GIF you send is sent as its location (a KLIPY URL), title, and size only, end-to-end encrypted between devices like other messages. The image itself is not stored on our servers.
• The list of GIFs and the GIFs shown in conversations are loaded directly from KLIPY's servers by your device. As with any connection, your IP address and device information are sent to KLIPY. Message text and which friend you sent a GIF to are not sent to KLIPY.
• See KLIPY's privacy policy (https://klipy.com/support/privacy-policy) for how it handles information.

7. Information Processed Only on Your Device

The following information is processed and stored only on your device and is not sent to our servers.

• Photos and videos in your photo library (except those you share to shared albums or rooms, and those you place in your own Google Drive with “Create from Photos” in Google Slides)
• Events in your device calendar (read and written through iOS calendar features)
• Reminders and their notifications (delivered as local notifications on your device)
• Decrypted message (DM) history
• What you type with the “Mi Keyboard” keyboard. Mi Keyboard does not use the network and does not record what you type. iOS’s “Allow Full Access” is used only to copy an image favorite to the clipboard when you tap it (phrases work without it).

8. Security Measures

• DMs are end-to-end encrypted; only ciphertext is stored on the server (the contents cannot be decrypted).
• Voice calls are encrypted with DTLS-SRTP.
• Communication with the server is encrypted with TLS (HTTPS/WSS).
• Device private keys and authentication tokens are stored in the iOS Keychain.
• We monitor the environment of contractors (including those abroad) and supervise them as necessary.

Information We Do Not Keep

To minimize harm in the unlikely event of a data breach, the Service is designed not to hold important information on its servers in the first place. We do not store the following on our servers:

• Your name, address, phone number, email address, date of birth, gender, or location
• Passwords (the Service does not use passwords) or payment information such as credit cards
• Apple or Google access tokens or other credentials, or the contents of your Google Calendar, Google Sheets, or Google Slides
• Photos and videos in your photo library (except those you share), or your device's calendars and reminders
• The contents of messages (DMs) (we only relay ciphertext temporarily and cannot decrypt it)

Information That Could Be Affected by a Leak

Our servers store the information listed in the table in Section 1. The information that could be affected if it were ever leaked is mainly:

• Photos and videos you share to shared albums or rooms. They are not end-to-end encrypted, so their contents are viewable within our systems. Access to storage is restricted by the Service's authentication and time-limited URLs, but they could be viewed if our systems were compromised. Please avoid sharing photos or videos you especially do not want others to see.
• Display names, handles, avatars, friend relationships, records of message delivery (who sent to whom and when; up to 14 days), report contents, device tokens for notifications, and IP addresses at the time of communication

9. Requests Regarding Retained Personal Data

Users may request notification of purposes of use, disclosure, correction, addition, deletion, suspension of use, or suspension of third-party provision of their personal data. Please contact the office below; we respond in accordance with the law after verifying identity.

10. Use by Minors

Persons under 13 may not use the Service. Minors should use the Service with the consent of a parent or guardian.

11. Contact for Inquiries and Complaints

Operator: masaya shiramizu ／ Contact: [email protected]

12. Revisions

This policy may be revised in response to changes in laws or the Service. Important changes will be announced in the app or by other means.