DAILY MIMI — AI JOURNALING APP
PRIVACY POLICY
Effective Date: August 12, 2026
This Privacy Policy explains what personal data the Daily MIMI application ("the App") collects, why we collect it, who we share it with, and what rights you have. It forms part of, and should be read together with, our Terms of Service.
The App is operated by Commander Mimi LLC, a Wyoming Limited Liability Company ("we", "us", "our"), which is the data controller for the personal data described here.
Contact for all privacy matters: mimi@commandermimi.com
The App is intended solely for adults aged 18 or over. We do not knowingly collect personal data from anyone under 18.
1. SUMMARY
- We collect what you tell us: your account details, your onboarding answers, and your journal entries.
- Your journal entries and AI conversations are encrypted at rest.
- We do not sell your data, do not show advertising, and do not run third-party analytics or tracking SDKs in the App.
- Your entries are not used to train AI models — ours or anyone else's.
- Your data is processed in the United States.
- You can delete your account and its data from within the App at any time.
2. DATA WE COLLECT
2.1 Account Data
When you sign in with Google or Apple through Firebase Authentication, we receive and store:
- your name (as provided by the sign-in provider)
- your email address
- your phone number, if your provider supplies one
- a unique account identifier
- the date of your last sign-in
We never receive or store your Google or Apple password.
2.2 Onboarding Answers
During onboarding the App asks a series of open-ended questions about your circumstances and goals — for example your home and daily routine, the people you rely on, your working life and income, your longer-term aims, and the kind of relationships you want. Your answers are free text, may be as detailed as you choose, and are stored with your account. They are used to personalise the coaching you receive.
2.3 Journal Entries and Conversations
Everything you write in the App — journal entries, chat messages, and the AI responses generated for you — is stored with your account so that your history remains available to you.
2.4 Voice Recordings
If you use voice input, the audio you record is uploaded to our server, transcribed to text, and the audio file is deleted from our server immediately after transcription. We do not retain voice recordings. The resulting transcript is treated as a journal entry (section 2.3).
2.5 Derived Memory Data
To let the AI recall relevant context from your earlier entries, we generate mathematical representations (embeddings) of your entries and store them in a vector database alongside your account identifier. These are derived from your entries and are deleted together with them.
2.6 Usage and Product Data
We store the minimum operational records needed to run the product: monthly and daily usage counters used to enforce plan limits, your reflection streak and points, your notification preferences, and — if you enable notifications — a push notification token for your device.
2.7 Subscription Data
Your subscription status (which plan is active, the product purchased, the renewal or expiry date, and whether the purchase was made in the App Store production or sandbox environment) is stored with your account and kept in sync with RevenueCat and the Apple App Store. We never receive or store your payment card details. All payment processing is performed by Apple.
2.8 Referral Codes
If you redeem a referral code, we record that your account has redeemed that code, so the same code cannot be redeemed twice by the same account.
2.9 What We Do Not Collect
We do not collect your precise location, your contacts, your photos, your health records, or your device advertising identifier. The App contains no advertising SDK and no third-party analytics or tracking SDK, and does not track you across other apps or websites.
3. WHY WE USE YOUR DATA
| Purpose | Data used |
|---|---|
| Creating and securing your account | Account data |
| Generating personalised AI coaching responses | Onboarding answers, journal entries, derived memory data |
| Transcribing voice input | Voice recordings (transient) |
| Enforcing plan limits and providing paid features | Usage data, subscription data |
| Sending reminders you have opted into | Notification preferences, push token |
| Preventing abuse of referral codes | Referral redemption records |
| Complying with legal obligations and defending legal claims | As required in the circumstances |
Where the GDPR or UK GDPR applies to you, we rely on the following legal bases: performance of a contract (providing the App and its features to you), consent (push notifications; you may withdraw it at any time in your device settings), legitimate interests (securing the service and preventing abuse), and legal obligation where applicable.
Your journal entries may reveal information about your health, relationships, or emotional state. Where such information constitutes a special category of personal data, we process it on the basis of your explicit consent, given by choosing to write it into the App. You may withdraw that consent by deleting the relevant entries or your account.
4. AI PROCESSING
The App sends the contents of your entries, and relevant context from your earlier entries, to AI providers in order to generate a coaching response back to you. This is the core function of the App and cannot be disabled while using it.
- Anthropic generates the coaching responses.
- OpenAI transcribes voice input and generates the embeddings described in section 2.5.
Both providers process this data solely to return a result to us. Neither uses your data to train their models, under the API terms that apply to our account. We do not use your entries to train any model of our own.
AI responses are generated automatically. They are not reviewed by a human before you see them, and they do not constitute a decision producing legal or similarly significant effects about you.
5. WHO WE SHARE DATA WITH
We do not sell your personal data, and we do not share it for advertising or marketing purposes. We share data only with the service providers needed to operate the App, each acting on our instructions:
| Provider | Role | Data involved |
|---|---|---|
| Google (Firebase) | Authentication and database | Account data, entries (encrypted), usage data |
| Anthropic | AI coaching responses | Entry contents and relevant context |
| OpenAI | Voice transcription and embeddings | Voice audio (transient), entry text |
| Qdrant | Vector memory storage | Embeddings, account identifier |
| RevenueCat | Subscription management | Account identifier, subscription status |
| Expo | Push notification delivery | Push token, notification content |
| Vercel | Server hosting | Data in transit through our API |
We may also disclose data where required by law, to enforce our Terms of Service, or as described in section 6.
6. SAFETY DISCLOSURES
We do not monitor your conversations in real time and no member of our staff routinely reads your entries.
In extreme safety situations — where there is a credible and imminent risk of serious harm to you or to another person — we reserve the right to disclose information to emergency services or the appropriate authorities without your prior consent, to the extent permitted or required by law. Because we do not monitor conversations, we cannot guarantee that we will become aware of any such situation, and you should never rely on the App to summon help.
7. SECURITY
- Your journal entries and AI conversations are encrypted at rest using AES-256-GCM. Each account has its own data encryption key, which is itself encrypted with a master key held separately from the stored data. Some older records use an earlier encryption scheme in which the key is derived from a value generated on your device and held in your device's secure storage.
- All traffic between the App and our servers is encrypted in transit over HTTPS.
- Access to production systems is restricted to authorised personnel.
No method of transmission or storage is completely secure. While we take these measures seriously, we cannot guarantee absolute security.
8. DATA RETENTION AND DELETION
We keep your data for as long as your account exists.
- Voice recordings are deleted from our server immediately after transcription.
- Deleting an entry removes it and its derived memory data.
- Deleting your account — available at any time in Settings → Delete Account — permanently deletes your account record, your onboarding answers, your entries and conversations, your usage and points records, your notification settings and push tokens, your subscription record, and your derived memory data from the vector database. Your authentication record is deleted at the same time. This cannot be undone.
Two technical records outlive account deletion, and neither contains any content you wrote:
- a subscription webhook log entry, retained so the same billing event is not processed twice;
- the redemption list of any referral code you used, retained so a code cannot be redeemed repeatedly.
Both hold only your former account identifier. If you want these removed as well, contact us at mimi@commandermimi.com.
Deleting your account does not cancel an active subscription purchased through the App Store. Cancel it separately in your device Settings → your Apple ID → Subscriptions.
9. INTERNATIONAL TRANSFERS
We are based in the United States and all of the providers listed in section 5 process data in the United States. If you use the App from the European Economic Area, the United Kingdom, or Switzerland, your personal data will be transferred to the United States. Where required, these transfers are made on the basis of the European Commission's Standard Contractual Clauses or an equivalent transfer mechanism agreed with the provider concerned.
10. YOUR RIGHTS
Depending on where you live, you may have the right to:
- access the personal data we hold about you
- correct inaccurate data
- delete your data
- restrict or object to our processing
- receive a portable copy of your data in a machine-readable format
- withdraw consent you have previously given
- complain to your local data protection authority
How to exercise them. Access, correction, and deletion are available directly in the App: you can view and edit your profile, copy any entry or AI response, and delete individual entries or your whole account. The App does not currently offer a one-tap download of everything at once — to request a full machine-readable copy of your data, or to exercise any other right, email mimi@commandermimi.com. We will respond within the period required by applicable law, and within one month where the GDPR or UK GDPR applies.
California residents. We do not sell or share personal information as those terms are defined under the CCPA/CPRA, and we do not offer financial incentives in exchange for personal information. You may exercise your rights of access, deletion, and correction using the same contact address, and you will not be discriminated against for doing so.
11. CHILDREN
The App is for adults aged 18 or over. We do not knowingly collect personal data from anyone under 18. If you believe a minor has provided us with personal data, contact us at mimi@commandermimi.com and we will delete it.
12. CHANGES TO THIS POLICY
We may update this Privacy Policy from time to time. Material changes will be notified through the App or by other reasonable means before they take effect. The Effective Date above indicates when this Policy was last revised.
13. CONTACT
Commander Mimi LLC mimi@commandermimi.com
⚔️ Daily MIMI — Built with love. Use with wisdom.