This Privacy Policy explains how Miaru collects, uses, and shares your personal information across our websites, apps, and related services — and names the specific services we rely on, so there are no surprises.
1. General
At Miaru, we care about your personal information, so we have prepared this Privacy Policy to explain how we collect, use, and share it. This Privacy Policy applies to the Miaru websites (miaru.co and app.miaru.co), apps, and related services (together, the “Service”). By using the Service, you agree to the collection, use, and sharing of your personal information as described in this Privacy Policy.
Miaru is a young product that is improving quickly. Features described in this Privacy Policy may change, and we will update this policy as our practices evolve.
2. Information We Collect
a. Account Registration
To create a Miaru account you provide us with your email address, and we sign you in with one-time codes sent to that email — or you sign in with your Google or Apple account. Miaru does not use or store passwords, and we do not collect phone numbers. Your account is managed for us by Amazon Cognito, an authentication service operated by Amazon Web Services.
If you sign in with Google or Apple, Google or Apple confirms who you are and shares your basic profile with us. We keep only your email address, your name (with Apple, only if you choose to share it), and an identifier for your Google or Apple account — we never receive your Google or Apple password. Apple also lets you hide your email address, in which case we receive an Apple relay address that forwards our emails to you. We use your first name, when we receive it, as your display name until you change it, and if a Miaru account already exists for the same email address, signing in with Google or Apple opens that account.
b. Profile & Learning Activity
After you register, you can set a display name and a username (handle), and answer optional onboarding questions such as what you want to learn, why you are learning, your interests, how you heard about Miaru, and your daily practice goal. As you learn, we record your progress: lessons started and completed, answers and scores, experience points (XP), streaks, and spaced-repetition review schedules.
Your display name, XP, and streak may be visible to other Miaru learners in features such as leaderboards. Your email address is never shown to other learners.
Calls with Luffy, in the Miaru mobile apps, use your microphone while you speak your lines, only after you allow it. Your voice is recognized on your device by a speech model the app downloads once; recordings never leave your device and are not stored after your line is scored. What we receive is the text the model heard for each line and your scores, which we keep as part of your learning activity so we can save your results and best scores.
c. Payments
If you subscribe to a paid plan on the web, checkout is handled by Stripe, our payment processor. Your card number and full payment details go directly to Stripe and never touch Miaru’s servers. We receive and store only what we need to run your subscription: your subscription status, plan and billing interval, and renewal date, together with a Stripe customer reference. Stripe’s handling of your data is described in Stripe’s own privacy policy at stripe.com/privacy.
In the Miaru mobile apps, subscriptions are purchased through Apple’s App Store or Google Play in-app purchase systems, and your payment details go to Apple or Google — never to Miaru. We use RevenueCat, a subscription-management service, to activate your subscription and keep it in sync across your devices. RevenueCat receives your purchase receipt, subscription status, and a random app user identifier — never your card details, email address, or name. On iPhone, while ad measurement is on, RevenueCat also receives the Apple Ads attribution described in section g, so we can see subscriptions by campaign. RevenueCat’s handling of your data is described at revenuecat.com/privacy.
d. Activity & Device Data
When you use the Service we automatically generate technical data such as your IP address, browser and device type, the pages you visit, and product events such as opening the app, viewing onboarding steps, completing lessons, clicking links from our marketing site into the app, and completing a purchase.
e. Cookies & Local Storage
We use cookies and browser storage to run the Service: browser local storage that keeps you signed in and remembers your language preference; browser local storage and cookies (“miaru_consent” and “miaru_consent_ads”, kept for up to one year) that remember your choice in the consent banner, so that one answer covers both miaru.co and app.miaru.co; and — while analytics and ad measurement are on (see sections f and g) — Google Analytics cookies (for example “_ga”) and an Amplitude cookie to measure usage, Google Ads cookies (for example “_gcl_au”) and a Meta Pixel cookie (“_fbp”) to measure our ads, and an attribution cookie (“miaru_utm”, kept for up to 90 days) that remembers which campaign first and most recently brought you to Miaru. The attribution cookie stores only standard campaign parameters (such as utm_source) and is shared between miaru.co and app.miaru.co. Most browsers let you block or delete cookies; parts of the Service (such as staying signed in) may not work without them.
f. Analytics — Google & Amplitude
On our websites (miaru.co and app.miaru.co), we use two analytics providers to understand how Miaru is used and where learners get stuck: Google Analytics (loaded through Google Tag Manager) and Amplitude. Website analytics are optional, and the consent banner asks for your choice. If you are in the European Union, the European Economic Area, the United Kingdom, or Switzerland, nothing is loaded and no analytics data is collected until you choose “Allow”. Everywhere else, analytics are on from your first visit: until you answer the banner, the providers receive the activity and device data described above tied only to a random browser identifier — never an account identifier — and no session replay is recorded. Choosing “No thanks” turns analytics off; choosing “Allow” additionally ties the data, when you are signed in, to a random account identifier generated by Miaru, and allows session replay as described below. In no case do the providers receive your email address, name, or payment identifiers, and declining does not change how the Service works. We tell which rule applies from your device’s time zone.
In the Miaru mobile apps for iOS and Android, we use Amplitude and Google Analytics for Firebase (a Google LLC service) to collect the product events described above — such as installing and opening the app, sessions, starting and completing lessons, viewing the paywall, and purchases with their price. Google Analytics for Firebase also collects device information and an approximate location worked out from your IP address. The events are tied to random identifiers: for Google, Firebase’s installation ID and app instance ID and, on iPhone, Apple’s identifier for vendors (IDFV); and, once you are signed in, a random account identifier generated by Miaru — never your email address or name. Mobile analytics are on by default; the “Share anonymous usage data” toggle on your profile screen turns off both Amplitude and Google Analytics immediately, and the ad measurement described below with them. The first time the app starts, before you have made any choice, Firebase registers its installation ID with Google once (on Android, the app also uses that ID for push notifications). The mobile apps do not use session replay. They share app activity with Meta and Google to measure our ads as described in “Advertising Measurement — Meta & Google” below, and use your device’s advertising identifier only if you allow it. The iPhone app also asks Apple which Apple Ads campaign, if any, led to the download, as described there.
On the web, and only after you choose “Allow”, Amplitude also provides session replay, which records how a small sample of visits interact with our pages — clicks, scrolls, and page structure — so we can find and fix confusing screens. Replay is sampled (roughly 1 in 10 marketing-site visits and at most 1 in 20 app sessions), masks text conservatively, and blocks everything you type (inputs and other sensitive areas such as sign-in, profile, billing, and issue-report screens are excluded). Session replay does not capture your payment details (payment happens on Stripe’s pages, outside our app).
You can change your analytics choice at any time via “Analytics preferences” in the website footer or on your profile page in the web app, or with the “Share anonymous usage data” toggle in the mobile apps; declining stops all analytics collection immediately. You can additionally opt out of Google Analytics with Google’s browser add-on (tools.google.com/dlpage/gaoptout). We use analytics only to improve Miaru — we do not run third-party advertising on the Service and we do not sell your personal information.
g. Advertising Measurement — Meta & Google
We advertise Miaru on Facebook, Instagram, Google, and Apple’s App Store. To learn which ads bring people to Miaru, we use ad measurement from Meta (Meta Platforms) and Google (Google LLC): on our websites, the Meta Pixel and Google Ads conversion measurement, loaded through Google Tag Manager together with Google Analytics; in our mobile apps, the Meta SDK and Google Analytics for Firebase. Ad measurement is optional, and one choice covers both.
On the websites, ad measurement follows the same rule as analytics, and our websites tell Google what you have allowed using Google’s consent signals. In the European Union, the European Economic Area, the United Kingdom, and Switzerland, nothing from Google or Meta is loaded until you choose “Allow” in the consent banner. Everywhere else, ad measurement is on from your first visit: until you answer, Google may set its advertising cookies and use the data to measure our ads, but not to personalize ads. After “Allow”, Google may also use it to personalize ads, for example to show Miaru ads to people who have visited our websites. After “No thanks”, Google is told it may use nothing, and Google’s and Meta’s tags stop sending.
In the mobile apps, one answer covers both: the app asks whether it may share app activity with our advertising partners to measure our ads (on iPhone, this is Apple’s tracking permission prompt; on Android, Miaru’s own question). In the European Union, the European Economic Area, the United Kingdom, and Switzerland, it asks before anything is shared for advertising. If you choose “Allow”, Meta and Google may use your device’s advertising identifier and receive full conversion data, including for personalized ads. Elsewhere, until you answer, Google receives conversion events without the advertising identifier and may not use them to personalize ads, and Meta receives the events below without the advertising identifier. If you choose “Don’t allow” (on iPhone, “Ask App Not to Track”), and in those European countries until you choose “Allow”, Google is told it may not use the app’s data for advertising at all, while the product analytics in section f continue as long as usage data is on, and Meta receives no app events and no advertising identifier.
Even then, the Meta SDK starts with the app, fetches its settings from Meta, and on iPhone registers with Apple’s SKAdNetwork and may tell Meta your tracking choice. To tell which ad led to an install, the apps also use Apple’s SKAdNetwork, which lets Apple report installs from ads without identifying you (the Meta SDK chooses the value Apple reports), and the Google Play install referrer, which tells the app which campaign link it was installed from.
In our iPhone app, we also use Apple’s AdServices framework, which tells us whether the download came from one of our Apple Ads campaigns on the App Store and, if it did, which campaign, ad group, ad, and (for a search ad) keyword led to it, where on the App Store the ad appeared, whether you tapped the ad or only saw it, whether it was a first download, a re-download, or a pre-order, and the campaign’s country or region — and, when Apple includes it, the time you tapped or saw the ad, to the minute. Apple works this out from its own records, and its answer does not identify you or your device: the app sends Apple only a token that Apple’s framework creates on your iPhone, with the technical data any request carries, such as your IP address, and no advertising identifier is used. It follows the same choice as the rest of our ad measurement: outside the European Union, the European Economic Area, the United Kingdom, and Switzerland, the app asks Apple once you are signed in, unless you have chosen “Ask App Not to Track” or turned off “Share anonymous usage data”; in those countries, it asks only after you choose “Allow”. We keep Apple’s answer with your Miaru account and, while usage data is on, add it to our product analytics in Amplitude, so we can see how people who came from each campaign go on to learn and subscribe. RevenueCat also receives it, to report subscriptions by campaign. We do not share it with Meta or Google.
When ad measurement is on, Meta and Google learn which of our ads led to a visit, an install, a new account, a checkout, or a subscription. Meta receives a short list of events: that you viewed a page on our websites or installed and opened the app, created an account, started checkout, or subscribed (with the price and currency). Google learns this from the activity and device data described in section f, together with the ad click information in the link you followed. For a purchase, Google also receives the price, the currency, and a reference for it: on the website, a reference number of our own; on iPhone, the App Store transaction ID; on Android, Google Play itself reports app purchases and subscriptions to Google Analytics. Along with these, Meta and Google receive technical data such as your IP address, your browser or device type, the address of the page, their own cookies on the websites, and — in the mobile apps, if you chose “Allow” — your device’s advertising identifier. We never send Meta or Google your name or email address, and we never send Meta your Miaru account identifier.
Meta and Google use this information to report to us how our ads perform and to deliver and improve their advertising services, as described in their own privacy policies; Google uses it to personalize ads only after you choose “Allow”. Google’s privacy policy is at policies.google.com/privacy, and how Google uses information from sites and apps that use its services is explained at policies.google.com/technologies/partner-sites. You can withdraw your choice at any time: via “Analytics preferences” in the website footer or on your profile page in the web app, and in the mobile apps with the “Share app activity with advertising partners” setting on your profile screen or, on iPhone, the tracking setting for Miaru in Settings. Declining changes nothing about how the Service works.
3. How We Use Your Information
Miaru processes your personal information to provide products and services you request, to pursue our legitimate interest in improving the Service, to comply with legal obligations, and with your consent where required. In particular, we use your information to:
- Operate your account and sign you in, with one-time email codes or through Google or Apple.
- Save and sync your learning progress, streaks, XP, and review schedules across devices.
- Personalize your experience, such as resuming where you left off and scheduling reviews of the characters and words you found hardest.
- Start, renew, and manage your subscription, through Stripe on the web or through Apple, Google, and RevenueCat in the mobile apps.
- Send you transactional email, such as login codes and replies to issue reports you submit.
- Measure and improve the Service, and learn which of our ads work, through the analytics and ad measurement described above.
- Keep the Service secure, prevent abuse, and comply with the law.
We may also create aggregated, de-identified, or otherwise anonymous information (for example, overall lesson completion rates) and use it for any purpose. Such information is not personal information.
5. Your Data Subject Rights
In addition to any rights granted by the law that applies to you, you can always ask us to:
- Tell you what personal information we hold about you.
- Give you a copy of your personal information in a portable format.
- Correct inaccurate personal information.
- Delete your account and the personal information we have collected about you.
- Object to, or ask us to restrict, certain processing of your information.
- Withdraw consent you previously gave us.
To exercise any of these rights, email us at privacy@miaru.co from the address on your account. Account and data deletion is described step by step on our Data Deletion page at miaru.co/data-deletion. We may need to verify your identity before acting on a request, and we may decline requests where we have a legitimate reason, such as when the request would violate the law or the rights of another person. If you are in the European Economic Area or the United Kingdom, you also have the right to lodge a complaint with your local data protection supervisory authority.
6. Data Retention
We keep your personal information for as long as your account exists. If you ask us to delete your account, we will delete or anonymize your personal information, except where we must keep it longer — for example billing records we are legally required to retain, information needed to resolve disputes or enforce agreements, or data needed to investigate misuse of the Service. We may retain anonymous data indefinitely.
7. Children
Miaru is not directed to children, and we do not knowingly collect personal information from children under 13 (or under the age of digital consent where you live, such as 16 in parts of the European Union). Miaru does not currently offer child accounts or parental controls. If you believe a child has created a Miaru account, please contact us at privacy@miaru.co and we will delete the account and its information.
8. Security
We protect your information with encryption in transit, one-time login codes instead of stored passwords, access controls on our infrastructure, and payment processing that keeps card details entirely with Stripe. No method of transmission or storage is completely secure, so we cannot guarantee absolute security — if we learn of a breach affecting your personal information, we will notify you as required by law.
9. Do Not Track
The Service does not currently respond to “Do Not Track” signals sent by some browsers. On the web, you turn analytics and ad measurement on or off in the consent banner; in the mobile apps, you can turn analytics off with the “Share anonymous usage data” toggle. The controls described in Sections 2(f) and 2(g) are the most reliable way to limit collection.
10. Links to Third-Party Websites
The Service may link to websites we do not operate, and checkout takes place on pages operated by Stripe. We are not responsible for the content or privacy practices of third-party websites. Any information you submit to a third party is governed by that third party’s privacy policy.
11. International Data Transfer
Miaru is based in the United States and processes data on servers located in the United States, which may not provide the same level of data protection as your home jurisdiction. By using the Service, you understand that your information will be transferred to and processed in the United States as described in this Privacy Policy.
12. Privacy Policy Updates
We may update this Privacy Policy as our practices change. Changes take effect when we post them on this page, and we will always show the date this policy was last revised. Your continued use of the Service after changes take effect means you accept the updated policy.
13. Contact Us
Miaru, LLC is the data controller of your personal information for the purposes of the General Data Protection Regulation (GDPR) and equivalent local laws. Miaru’s headquarters are located in the United States at:
Miaru, LLC., Austin, TX 78735, United States of America.
For privacy inquiries, data subject requests, or any questions about this Privacy Policy, email us at privacy@miaru.co. For anything else, hello@miaru.co reaches us too.