Privacy Policy
Miko — Skincare Routine Builder · Last updated: 10 September 2026 · Effective: on first public release
The Short Version
Miko has no accounts and no user database. Your products, your routine, and everything you told us about your skin are stored on your phone and nowhere else. We could not identify you if we were asked to.
Two things leave your device when you ask for them:
- A photograph of a product label, sent to be read for its ingredients.
- Your skin answers plus the product being discussed, sent to generate advice about it.
Neither is stored on our servers.
And one thing leaves without you asking, which we would rather state up front than bury: which set-up screen you reached while first installing the app, and which subscription plan you tapped. Screen names only — never what you answered on them (full list in §4e).
Your life-state answer — pregnancy, breastfeeding, isotretinoin, post-procedure — never leaves your phone at all, in any flow.
1. Who We Are
Miko is developed and operated as an independent private utility. Contact: privacy@mikocare.pro.
For the purposes of the UK GDPR and EU GDPR, we are the data controller for the limited processing described in §4.
2. There Is No Account
Miko has no sign-up, no login, and no server-side record of you. We do not ask for your name, your email address, or your phone number, and there is no way to give them to us.
This is architectural rather than a policy choice: there is no user table to put you in.
3. What Is Stored on Your Device
All of the following lives in a database on your phone (expo-sqlite) and is never transmitted to us:
| What | Examples |
|---|---|
| Your shelf | Products, when you added them, bottle sizes, what you marked finished. |
| Your scans | Every product you have photographed, and the reads produced for them. |
| Your routine | The generated week, and reminder times you set. |
| Your skin answers | Skin type, concerns, sensitivities, reactions, experience, climate, age range, gender, shaving frequency. |
| Your life-state | Pregnancy, breastfeeding, isotretinoin, post-procedure status. |
| Your Ask Miko conversations | Both sides of every chat. |
| Cached AI answers | So reopening a product costs nothing and works offline. |
| Subscription status | A cached copy of whether your subscription is active. |
Deleting the app deletes all of it. There is no server copy, which also means we cannot restore it for you — see §9.
4. What Leaves Your Device, and When
4a0. You Are Asked First, and You Can Say No
Nothing in this section happens until you have agreed to it.
During set-up, before Miko has sent anything anywhere, a screen lists what would be sent, names every company that would receive it, links their privacy policies, and asks you to agree or decline. Declining is a real answer: scanning and Ask Miko stop working and the rest of the app carries on. You can change your mind either way at any time under Settings → AI processing, which shows the same disclosure and the current setting.
This is enforced in code rather than promised in this document. Every request that could reach the AI service passes through a single gate (src/ai/gate.ts); it refuses before the request is built, and it refuses by default, so a bug that lost track of your answer would send nothing rather than send anything.
4a. Reading a Label
When you take a photograph to scan a product, the image is sent to our processing service and on to an AI model that reads the ingredients from it. The answer comes back and is stored on your phone.
Who receives it, in the order it travels:
| Who | What they do | Their policy |
|---|---|---|
| Miko | Passes the request on. Keeps no copy — there is no account and no user record on our side. | This document |
| OpenRouter, Inc. | Routes the request to the model. | openrouter.ai/privacy |
| Runs Gemini, which writes the answer. | ai.google.dev/gemini-api/terms |
What each of them keeps:
- Miko keeps nothing. The photograph is passed through and discarded, and once the answer has been returned there is no record of the request on our side. There is no table it could be written to — see §3.
- OpenRouter's published policy says they do not persistently store it. In their words: “We do not persist image, audio or video files beyond the duration necessary to route the request, except as required for abuse detection, security, billing, or legal compliance.” They also state that they do not use inputs or outputs for model training.
We quote them rather than paraphrase because those four exceptions are real, and an earlier version of this page said the photograph was “discarded immediately” — a stronger claim than OpenRouter makes about itself, and not ours to make on their behalf. - Google runs the model, and its terms are their own. Retention and training differ between Google's paid and free tiers, and which applies is a property of how the request is routed rather than of anything you do in the app.
Where this leaves you: Nobody in the chain is building a library of your photographs, and none of it is attached to a name, because we do not have one to attach. What we will not do is promise on behalf of two companies we do not control, which is why this section quotes them and links them instead. It is the one part of this document that depends on somebody else, and the app says exactly that before you agree to any of it.
4b. Generating Advice
When you ask for a product read, shelf advice, a week explanation, or use Ask Miko, we send:
- The product or products in question, and their ingredient lists.
- Your skin answers, specifically: skin type, concerns, sensitivities, climate, experience, gender, shaving frequency, age range, and whether products have gone wrong for you before.
- For Ask Miko, the text of your question and up to eight previous turns.
4c. What Is Deliberately Withheld
Your life-state never crosses the network. Pregnancy, breastfeeding, isotretinoin, and post-procedure status stay on your phone.
Where that answer needs to change what the AI says, your phone works out which ingredients to keep out of the answer and sends only a bare list of ingredient names — with no reason attached — and instructs the model not to speculate about why. So the AI can avoid recommending a retinoid without ever being told that you are pregnant.
This is enforced in code, not by policy: the data type the advice request accepts has no field capable of carrying a life-state.
4d. Rate Limiting
To stop one device exhausting the service, we count requests. We store a counter under a value derived by hashing your device's random installation identifier together with the current day.
- The identifier is generated on your device on first launch. It is random and is not linked to you, your Apple ID, or any advertising identifier.
- Because the day is hashed into the stored value rather than kept beside it, two days' counters cannot be linked back to the same device — including by us.
- Counters expire automatically.
These counters are the only thing we store on our own server. They are integers.
4e. How Far You Got While Setting Up (Funnel Telemetry)
We use Mixpanel to record how people move through first-time set-up, and nothing else. Set-up is twenty screens, and without this we cannot tell whether people give up — or which question they give up on.
This is the complete list of what is sent. It is short on purpose, so it can be checked rather than taken on trust:
| Sent | Example |
|---|---|
| The name of the set-up screen shown | life-state |
| Its position in the run | 15 |
| Whether it counts toward the progress bar | true |
| Whether you moved forward, went back, or skipped | — |
| Which subscription plan you tapped | annual |
The name of a screen is not the answer given on it, and that distinction is the whole design. life-state records that the pregnancy question was shown to somebody. It does not record, and cannot record, what they said. Your skin type, concerns, sensitivities, and life-state are never sent here in any form.
It is enforced in code rather than by policy: the event shapes have nowhere to put an answer, a fixed allowlist of four field names strips anything else before it is sent, and an automated test fails if any answer field is ever added to that list (src/analytics/events.ts).
One event can occur outside set-up. The subscription screen is also reachable later from Settings, so “which plan you tapped” may be recorded then too. Nothing else in the app is instrumented: we do not know which screens you open after set-up, how often you use Miko, what you scan, or what is on your shelf.
We also disable:
- Mixpanel's location lookup, so your IP address is not used to derive a city or country.
- Autocapture and session recording. No screen contents, no taps, no video. A recording of set-up would be a recording of the pregnancy question, which is precisely what the rest of this document exists to prevent.
There is no account, so none of it is linked to you. Mixpanel sees an anonymous per-install identifier that it generates itself — not the identifier in §4d, and not linked to anything else. We never call any function that would attach an identity to it.
5. What We Do Not Do
- No analytics outside set-up. The one exception is the set-up funnel in §4e — screen names and the plan you tapped, never an answer. We do not know which screens you open afterwards, how often you use Miko, or what is on your shelf.
- No session recording and no autocapture — see §4e.
- No advertising and no ad identifiers. We do not use the Advertising Identifier (IDFA) and do not show ads.
- No tracking across apps or websites, and no data shared for any third party's advertising or profiling.
- No selling of personal information, under any definition, ever.
- No third-party SDK receives your skincare data. The AI processing in §4a and §4b is the only flow that carries anything about your skin, and the set-up funnel in §4e carries no personal information at all.
6. Payments
Subscriptions are sold through Apple. Apple processes the payment and we never see your payment details.
Entitlement is managed by RevenueCat using an anonymous application user identifier, with no email address or account attached. We never call their login API and we never attach subscriber attributes, so nothing you told Miko during set-up reaches them.
7. Permissions We Ask For
| Permission | Why | If you decline |
|---|---|---|
| Camera | To photograph product labels | You can type ingredient lists in by hand instead; everything else works. |
| Notifications | Reminders you switch on yourself, per routine slot | No reminders. Nothing else changes. |
Notifications are scheduled locally on your device. There is no push server and no device push token is ever sent to us.
8. Children
Miko is not directed at children and is rated for ages 12+. We do not knowingly collect information from children. Since we hold no personal data at all, there is nothing to delete on request — but see §10.
9. Your Rights, and the Honest Limits of Them
Under GDPR and similar laws you have rights of access, rectification, erasure, restriction, portability, and objection.
In practice these are unusually simple here, because we hold nothing about you:
- Access and portability — your data is on your phone. Settings includes an export that writes your shelf to a file you can keep or move.
- Erasure — delete the app, or use “Erase everything” in Settings. Both are immediate and complete. We do not hold a copy to delete.
- Rectification — every answer you gave is editable in Settings.
Because there is no backup, data loss is permanent. If you delete the app, lose the phone, or set up a new device without an iCloud restore, your shelf is gone and we cannot recover it. Use the export feature in Settings if preserving your catalog matters to you.
To exercise a right, or to complain, write to privacy@mikocare.pro. In the UK you may also complain to the Information Commissioner's Office (ICO); in the EU, to your local supervisory authority.
10. Legal Basis for Processing
For the limited processing in §4 we rely on:
- Contract — sending a label photograph or an advice request in order to provide the feature you asked for.
- Legitimate interests — the request counters in §4d, for service protection and abuse prevention; and the set-up funnel in §4e, to understand and improve a flow people otherwise abandon silently.
We do not rely on consent for advertising, because we do not advertise.
On health data: answers about your skin, and about pregnancy or medication, may constitute special-category data. Our approach is to keep the sensitive part out of scope entirely (§4c) so that the special-category answer is never transmitted or stored by us in any form.
11. International Transfers
Two processors may handle data outside the UK/EEA, including in the United States:
| Processor | For | Safeguard |
|---|---|---|
| OpenRouter, Inc. (routing to Google's Gemini) | §4a, §4b | Standard Contractual Clauses (SCC) |
| Mixpanel | §4e | Standard Contractual Clauses (SCC); Mixpanel offers EU data residency. |
Mixpanel offers an EU-hosted endpoint, and the SDK can be configured to route strictly to EU servers.
12. Medical Disclaimer
Miko is not a medical device and does not provide medical advice or individual clinical care. See our Terms of Use (§5). Nothing in this policy should be read as suggesting we hold or process a medical health record about you.
13. Changes
If we change this policy we will update the date at the top, and where the change is material we will say so in the app before it takes effect.
App Store Privacy Label Disclosure
In accordance with Apple App Store transparency standards, Miko's privacy label declares:
• Usage Data → Product Interaction: Set-up screen progression and plan tapped (§4e).
• None. No IDFA, no cross-app or cross-site tracking.
• None. No account, no user table, no identity attached.