Privacy policy

When you use the scan feature, you upload a photo. That photo is sent directly to our AI provider (OpenAI) for analysis and deleted from our servers immediately after the response is returned. Typically within a few seconds. We never store, cache, or log your photo. OpenAI processes it under their data processing agreement and does not use it to train their models (via our API agreement). We also send the request with retention switched off, so the image is not kept on their side for abuse monitoring either.

What the analysis reads: texture, light and the visible signals in your skin. Your skin tone is one of those inputs, deliberately. You can tell MIRU your tone before a scan, and the analysis also estimates it from the photo. A read calibrated to your own tone is more accurate than one calibrated to a single narrow band.

MIRU uses your tone to read you against yourself. It is never used to rank you, grade you, or compare you with anyone else. We do not sell it and we do not share it with advertisers.

Legal basis: legitimate interests (Article 6(1)(f) GDPR). You asked for a skin analysis, which requires processing the photo to provide it. The photo is deleted immediately, so retention is zero.

The result of your scan (focus area, observations, suggested routine) is stored in your browser’s local storage on this device only. It does not leave your device unless you are signed in, in which case it syncs to our Supabase database (Frankfurt, EU).

Legal basis: contract performance (Article 6(1)(b)) for signed-in users; legitimate interests for device-only storage.

If you choose to create an account, we store your email address, your skin profile (skin type, concerns, onboarding answers), and your scan history in Supabase. This lets your data survive a device change.

We use magic-link email authentication, no password is created or stored. Legal basis: contract performance.

Payments are handled by Stripe. MIRU never sees or stores your card details. Stripe is the data controller for payment information; their privacy policy applies. We store only your subscription status (active / cancelled / trial) and its renewal date.

If you choose to receive a scan summary by email, we store your email address to send it. You can ask us to delete it at any time by emailing privacy@miru.skin.

We use PostHog in a cookieless, anonymous mode to understand how people use MIRU. Which pages are visited, where people drop off, which features are used. No cookies are set, no persistent device identifier is stored, and we never call any “identify” function. Each visit is an anonymous session that is not linked to you or to other sessions. No photos. No skin observations. No name or email. No cross-site tracking.

Product analytics are off by default. Nothing is sent unless you explicitly switch analytics on (during onboarding or in Settings → Data & privacy), and you can switch them off again at any time. With analytics off, no behavioural event about you is recorded.

Separately, and regardless of that setting, MIRU keeps a small operational record of its own machinery so we can tell whether the product is working: that a scan finished or failed, how long it took, which model served it, and the failure category. Alongside it we keep an anonymous count of the product being used: that a screen was opened and which public page it was, that a scan was started or finished, that a product check was run, that a partner link was tapped. These rows carry no session identifier, no account, no cookie, no device identifier, no photo, no skin observation and no free text. Nothing is stored on or read from your device to produce them, they carry no properties beyond the fact that the thing happened, and they cannot be joined to each other or traced back to a person. We keep them because a founder who cannot see that scans are failing, or that a feature is unused, cannot fix it. Our lawful basis is legitimate interests. This is not behavioural analytics and it is never used to build a picture of you.

We use Sentry to capture technical errors so we can fix them. Before any error is reported, our code strips photos, skin observations, and email addresses. Sentry receives only technical crash data (stack traces, route names, browser version). Legal basis: legitimate interests.

When you click a product link, the affiliate network receives a click identifier embedded in the URL. This is standard for affiliate links and is disclosed in our affiliate disclosure. No profile data, no photo, no questionnaire answers are shared with affiliate networks.