EN

Privacy Policy

This privacy policy explains which personal data we process when you visit miandju.app or use the Mi & Ju app, what we use it for, which service providers are involved and which rights you have.

If you live in the United States or in Brazil, please also read the additional sections for residents of certain US states and for users in Brazil.

Who is responsible for your data

been together UG (haftungsbeschränkt)
Gutzkowstraße 32
01069 Dresden
Germany

Email: hello@miandju.app

We are the controller for the processing described here. Write to this address with any question about data protection or to exercise your rights.

The short version

  • The website does not use cookies, analytics or advertising. To deliver the pages, our hosting provider processes your IP address.
  • In the app you can use an anonymous account or sign in with Google, Apple or Facebook. We process what you enter so that you, and a partner you invite, can use the app.
  • The app relies on services from Google (Firebase), Apple, RevenueCat and others for sign-in, data storage, notifications, purchases, usage statistics, crash reports and advertising. Every service is listed below.
  • You can ask us at any time which data we hold about you, have it corrected or deleted, and object to its use.

Visiting the website

Hosting and server logs

The website consists of static pages that are hosted on Firebase Hosting, a service of Google Ireland Limited. Whenever your browser requests a page, Google processes your IP address and the technical details your browser sends along with the request, such as the page requested and the browser type. This is necessary to deliver the page and helps to detect abuse. According to Google, IP data is retained for a few months. We do not link this data to other information about you.

No cookies, no tracking

The website sets no cookies, stores nothing on your device and contains no analytics or advertising services. Fonts, images and scripts come from our own hosting.

Embedded content

Some blog posts contain a short video clip that is loaded directly from Giphy (Giphy, Inc., USA). When you open such a post, your browser connects to Giphy’s servers, and Giphy receives your IP address and details about your browser. Giphy’s privacy policy describes how this data is handled.

The website links to other services: the app stores, our support portal on Freshdesk, a feedback form on Google Forms, and share buttons for Facebook, X and LinkedIn. The store buttons use Firebase Dynamic Links, a Google service that forwards you to the Apple App Store or Google Play. All of these are ordinary links. Data only reaches the respective provider once you click, and from then on that provider’s privacy policy applies.

Contacting us

The contact page opens your own email program; the form itself does not send anything to us. When you write to us by email or through the support portal, we process your contact details, such as your name, email address and country, and the content of your message in order to answer you. We manage support requests with Freshdesk.

Using the app

Account

You can use the app with an anonymous account or sign in with Google, Apple or Facebook. Sign-in is handled by Firebase Authentication. If you sign in through one of these providers, we receive the details needed to identify you, such as your first name, last name and email address.

Your content

We process what you enter or upload in the app, for example milestones, moments, photos and voice notes, in order to provide the app’s functions. If you invite a partner, they can view and add to what you record together. If you enter personal data about other people, you are responsible for being allowed to do so.

Unless a field is marked as optional, the information the app asks for is required to provide the service. Without it, we may not be able to offer the app or individual functions. If you are unsure which details are required, just ask us.

Device permissions

Depending on your device, the app asks for your permission before it accesses the following:

  • Camera: to take photos and videos with your device.
  • Photo library: to access the photos stored on your device.
  • Reminders: to read, add and remove entries in the Reminders app.
  • Biometric authentication: to use your device’s biometric data or authentication systems, for example Face ID.

You can withdraw each permission at any time in your device settings or ask us for help. How this works depends on your device and its software. Without a permission, some functions may no longer work properly. Once a permission is granted, the app can read, change or remove the corresponding data.

Push notifications

The app can send you push notifications, for example reminders of anniversaries. You can switch them off in your device’s notification settings; the app may then be less useful to you.

Purchases

Subscriptions and other purchases are paid through the Apple App Store or Google Play. You give your payment details directly to the store; we only learn whether a payment was completed. To manage purchases and unlock paid features we use RevenueCat, which also lets us see your purchase history and how the app is used in connection with it.

Statistics, stability and testing

We use Google Analytics for Firebase to understand how the app is used, Crashlytics to find and fix crashes, and Firebase Remote Config to adjust settings and compare variants of the app (A/B tests). Beta versions are distributed through TestFlight and Google Play Beta Testing. The app stores additionally give us aggregated usage and diagnostic figures.

Advertising

The app may show advertising delivered by AdMob (Google) and Yandex. These services use identifiers such as your device’s advertising ID together with usage data. They may show ads based on your interests and may also take into account your behaviour outside the app (retargeting). Not all of your data is used for this. How to restrict personalised advertising is explained under Opting out of personalised advertising.

Service providers we use

The providers below process personal data for us or receive it when you use the website or the app. Where an entry refers to the provider’s privacy policy for the data involved, the provider itself determines in detail which data it collects. Some providers work with servers distributed around the world, so the exact place of storage cannot always be determined.

Sign-in

  • Firebase Authentication (Google Ireland Limited): registration and sign-in, also through third-party identity providers. Data: first name, last name, email address. Place of processing: Ireland. Privacy policy

Hosting and backend

  • Firebase Hosting (Google Ireland Limited): hosting of the website. Data: IP address and request data; further data according to the provider’s privacy policy. Place of processing: Ireland. Privacy policy
  • Firebase Cloud Firestore and Firebase Cloud Functions (Google Ireland Limited or Google LLC, depending on the configuration): database and server functions of the app. Data: usage data; further data according to the provider’s privacy policy. Place of processing: Ireland. Privacy policy
  • Amazon Web Services (AWS) (Amazon Web Services, Inc.): hosting and backend infrastructure. Data: according to the provider’s privacy policy. Place of processing: Ireland. Privacy policy
  • Cloudflare (Cloudflare, Inc.): distribution and optimisation of traffic. Communication between your device and our systems passes through Cloudflare’s network, which also allows statistical evaluation. Data: according to the provider’s privacy policy. Place of processing: United States. Privacy policy

Notifications

  • Firebase Cloud Messaging and Firebase Notifications (Google Ireland Limited or Google LLC, depending on the configuration): sending push notifications to individual devices, groups of devices or user segments. Firebase Notifications can be combined with Firebase Analytics to address specific audiences and to measure opens and conversions. Data: according to the provider’s privacy policy. Place of processing: Ireland. Privacy policy

Purchases and app stores

  • RevenueCat (RevenueCat, Inc.): management of in-app purchases and subscriptions, including insight into purchase history and related usage. Data: app opens, usage data, user ID. Place of processing: United States. Privacy policy. To opt out, write to compliance@revenuecat.com.
  • Apple App Store (Apple Inc.): distribution of the iOS app. Apple collects basic usage statistics and makes them available to us in aggregated form, for the most part only if you have agreed to this on your device. You can change this in your device settings. Data: usage data. Place of processing: United States. Privacy policy
  • Google Play Store (Google Ireland Limited): distribution of the Android app. Google collects usage and diagnostic data and gives us aggregated figures, for the most part only if you have agreed to this. You can change this in your Google settings. Data: usage data. Place of processing: Ireland. Privacy policy

Statistics, stability and testing

  • Google Analytics for Firebase (Google Ireland Limited): usage statistics for the app. The service works with mobile device identifiers and technologies similar to cookies and may exchange data with other Firebase tools such as Crashlytics, Authentication, Remote Config or Notifications. You can limit some Firebase features in your device settings, for example in the advertising settings. Data: app updates, device information, region, in-app purchases, app launches, number of sessions, number of users, operating system, session duration, trackers, usage data. Place of processing: Ireland. Privacy policy and how Google uses data from partner apps
  • Crashlytics (Google Ireland Limited): crash reports and monitoring of the app’s stability. Data: crash data, device information, universally unique identifier (UUID). Place of processing: Ireland. Privacy policy
  • Firebase Remote Config (Google Ireland Limited): remote configuration and A/B testing. Data: according to the provider’s privacy policy. Place of processing: Ireland. Privacy policy
  • TestFlight (Apple Inc.): distribution of beta versions for iOS. Data: app information, device information, device logs, email address, usage data; further data according to the provider’s privacy policy. Place of processing: United States. Privacy policy
  • Google Play Beta Testing (Google Ireland Limited): distribution of beta versions for Android. Data: data transmitted while using the service, device logs, email address, usage data; further data according to the provider’s privacy policy. Place of processing: Ireland. Privacy policy
  • Firebase Dynamic Links (Google Ireland Limited): links that lead into the app or to the matching app store, for example the store buttons on our website. The use of these links is evaluated within Firebase and Google Analytics for Firebase. Data: according to the provider’s privacy policy. Place of processing: Ireland. Privacy policy

The providers of beta testing may automatically collect crash data and usage statistics in a form that identifies you.

  • AdMob (Google LLC): advertising in the app. Data: trackers, device advertising IDs (for example the Google Advertising ID or IDFA), usage data. Place of processing: United States. Privacy policy, Google’s rules for partner sites and apps and opt-out
  • Yandex (YANDEX, LLC): advertising. Data: trackers, usage data. Place of processing: Russian Federation. Privacy policy
  • Amazon affiliate programme (Amazon.com, Inc.): links to third-party products. Amazon registers clicks on these links and reports them to us. Data: trackers, usage data. Place of processing: United States. Privacy policy

Fonts and embedded content

  • Google Fonts (Google Ireland Limited): delivery of fonts. The website does not use this service; it serves its fonts itself. Data: trackers, usage data. Place of processing: Ireland. Privacy policy
  • Giphy (Giphy, Inc.): video clips embedded in blog posts. Data: IP address, browser details. Place of processing: United States. Privacy policy

Support and feedback

  • Freshdesk (Freshworks, Inc.): support portal and management of support and contact requests. Data: what you tell us in your request; further data according to the provider’s privacy policy. Place of processing: United States. Privacy policy
  • Google Forms (Google LLC): feedback forms and surveys, for example for feature requests. Data: the answers you give, for example gender and language. Place of processing: United States. Privacy policy

We process personal data to operate the website and the app and to provide their functions, to meet our legal obligations, to respond to requests from authorities, to protect our rights and interests and those of our users or third parties, and to detect malicious or fraudulent activity. In addition, we process data for the purposes described above: sign-in, hosting and backend, notifications, purchases, statistics, testing, advertising, support and feedback.

We only process personal data if at least one of the following applies:

  • you have given your consent for one or more specific purposes (Art. 6(1)(a) GDPR);
  • the processing is necessary to perform a contract with you or to take steps before entering into one (Art. 6(1)(b) GDPR);
  • we are legally obliged to process the data (Art. 6(1)(c) GDPR);
  • the processing serves a task in the public interest or the exercise of official authority (Art. 6(1)(e) GDPR);
  • the processing is necessary for our legitimate interests or those of a third party (Art. 6(1)(f) GDPR).

Ask us if you want to know which legal basis applies to a particular processing activity, or whether providing certain data is required by law or by contract or is needed to conclude a contract.

Where your data is processed

Your data is processed at our offices and wherever the providers involved are located. This can mean that data is transferred to a country other than your own, including countries outside the European Union such as the United States or the Russian Federation. The list of service providers shows the place of processing for each service.

Where a transfer from the EU to a third country is based on the standard contractual clauses of the European Commission, the recipient has undertaken to handle the data in line with EU data protection standards. You can ask us on which legal basis data is transferred to a country outside the EU or to an international organisation, and which safeguards protect it.

Security and access to your data

We take appropriate technical and organisational measures to protect your data against unauthorised access, disclosure, alteration and destruction. Besides us, access may be given to people involved in running the website and the app (system administration, administration, legal, marketing, sales) and to external parties such as hosting providers, IT companies, technical service providers, postal and delivery services and communications agencies. Where necessary, we appoint these parties as processors. You can request the current list from us at any time.

How long we keep your data

We keep personal data only for as long as the purpose for which it was collected requires:

  • Data needed to perform a contract with you is kept until the contract has been fully performed.
  • Data processed on the basis of our legitimate interests is kept for as long as those interests require. Ask us if you want to know more about them.
  • Data processed on the basis of your consent may be kept until you withdraw it.
  • We may have to keep data longer if a law or an order from an authority requires it.

After that the data is deleted. From then on, the rights of access, erasure, rectification and data portability can no longer be exercised for it.

You can also delete your account yourself in the app under Settings → Profile → Delete Account. This permanently deletes your data.

Your rights

Under the General Data Protection Regulation (GDPR) you have the following rights, to the extent the law provides for them:

  • Withdraw consent: you can withdraw a consent you have given at any time.
  • Object: you can object to processing that rests on a legal basis other than consent.
  • Access: you can find out whether we process data about you, receive information about the processing and obtain a copy of the data.
  • Rectification: you can check whether your data is accurate and ask us to update or correct it.
  • Restriction: you can ask us to restrict processing. We will then only store the data and not use it in any other way.
  • Erasure: you can ask us to delete your data.
  • Data portability: you can receive your data in a structured, commonly used and machine-readable format and, where technically feasible, have it transmitted to another controller.
  • Complaint: you can lodge a complaint with the data protection authority responsible for you.

Right to object

If we process your data in the public interest, in the exercise of official authority or on the basis of our legitimate interests, you can object for reasons arising from your particular situation. If your data is processed for direct marketing, you can object at any time, free of charge and without giving reasons; we will then stop using it for that purpose.

How to exercise your rights

Send your request to the contact address given above. Requests are free of charge. We answer as quickly as possible and at the latest within one month. If we correct, delete or restrict data, we inform every recipient to whom we have disclosed it, unless this is impossible or involves disproportionate effort. On request we tell you who these recipients are.

Opting out of personalised advertising

Besides the opt-out options of the individual services listed above, you can set your preferences for many advertising tools through YourOnlineChoices (EU), the Network Advertising Initiative (US), the Digital Advertising Alliance (US), DAAC (Canada) and DDAI (Japan). For mobile apps, the Digital Advertising Alliance offers the AppChoices app. You can also limit ad personalisation in your device settings, for example in your phone’s advertising settings.

Additional information for residents of certain US states

This section supplements the rest of this policy for residents of California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Nevada, Delaware, Iowa, New Hampshire, New Jersey, Nebraska, Tennessee, Minnesota, Maryland, Indiana, Kentucky, Rhode Island and Montana. For them it takes precedence over any conflicting statement elsewhere in this policy. It uses the terms “personal information” and “sensitive personal information” as defined in the laws of these states.

Personal information collected in the past 12 months

The categories follow California law, but they give residents of other states a useful overview as well.

  • Identifiers: first and last name, email address, user ID, universally unique identifier (UUID), device advertising IDs, trackers, country, gender, language, device and app information, device logs, crash data, app opens, usage data and what you send us when using a service. Used for sign-in, hosting and backend, notifications, purchases, support and contact, surveys, testing, statistics, monitoring, traffic distribution and advertising. Disclosed to Google Ireland Limited, Google LLC, Apple Inc., Freshworks, Inc., Cloudflare, Inc., Amazon Web Services, Inc. and RevenueCat, Inc.
  • Commercial information: in-app purchases together with usage figures such as device information, region, number and duration of sessions, number of users, app launches, app updates and operating system. Used for statistics. Disclosed to Google Ireland Limited.
  • Internet or other electronic network activity: usage data, trackers, device advertising IDs, device and app information, device logs, crash data, app opens, user ID, email address, in-app purchases, the camera, photo library and reminders permissions and what you send us when using a service. Used for statistics, beta testing, device permissions, embedded content, monitoring, support, app stores, hosting and backend, affiliate links, purchases and advertising. Disclosed to Google Ireland Limited, Google LLC, Apple Inc., Freshworks, Inc., Amazon Web Services, Inc., RevenueCat, Inc., YANDEX, LLC and Giphy, Inc.
  • Geolocation data: your region as recorded in usage statistics. Used for statistics. Disclosed to Google Ireland Limited.
  • Biometric information: the device permissions for camera, photo library and reminders and, as sensitive personal information, the permission to use your device’s biometric authentication. Used for device permissions.
  • Inferences: gender and language. Used for surveys. Disclosed to Google LLC.

We keep this information for as long as the respective purpose requires. We do not use it for purposes that are incompatible with the purposes described here, or not reasonably necessary for them, unless you consent.

Sale, sharing and targeted advertising

The laws of these states define these terms broadly. A “sale” is any disclosure of personal information to a third party for money or other valuable consideration. “Sharing” is its disclosure for cross-context behavioural advertising. “Targeted advertising” means advertising selected on the basis of your activity across different websites or apps over time. Disclosures to a service provider under a contract that meets the legal requirements are not a sale.

In this sense, information from all of the categories above is sold or shared and used for targeted advertising:

  • AdMob: a sale in all of the states listed above, a sharing in California and targeted advertising in the other states.
  • In California, a sale and a sharing: Amazon affiliate programme, Firebase Cloud Messaging, Firebase Notifications and Google Forms.
  • In California, a sale: Google Analytics for Firebase, TestFlight, Google Play Beta Testing, Firebase Remote Config, Google Fonts, Freshdesk, Firebase Authentication, Firebase Dynamic Links and Cloudflare.
  • In California, a sharing: Firebase Cloud Firestore, Firebase Cloud Functions and Amazon Web Services.

Where the information comes from

We receive it directly from you, for example when you enter data in the app or contact us; automatically when you use the website or the app; and from third parties that work with us to provide the service.

Your rights

To the extent the law of your state provides, you have the right to:

  • know whether we process personal information about you and access it;
  • have inaccurate personal information corrected;
  • have your personal information deleted;
  • receive a copy of your personal information in a portable, usable format, where technically feasible;
  • opt out of the sale of your personal information;
  • not be discriminated against for exercising your rights.

California: you can also object to your personal information being shared for cross-context behavioural advertising, and you can ask us to limit the use and disclosure of your sensitive personal information to what is necessary to provide the service. The law provides for exceptions, for instance where the processing is needed to verify or maintain the quality or safety of the service.

Virginia, Colorado, Connecticut, Texas, Oregon, Nevada, Delaware, Iowa, New Hampshire, New Jersey, Nebraska, Tennessee, Minnesota, Maryland, Indiana, Kentucky, Rhode Island and Montana: you can also opt out of targeted advertising and of profiling that leads to decisions with legal or similarly significant effects, and you are free to give, refuse or withdraw consent to the processing of your sensitive personal information. Exceptions apply, for example where the processing is needed for a product or service you have specifically requested. In Maryland we only process sensitive personal information where this is strictly necessary for a product or service you have requested. In Minnesota and Maryland you can request a list of the specific third parties to which we have disclosed your personal data. In some states, such as Minnesota, you also have rights relating to profiling: to question its result, to learn why it led to a decision where feasible, to learn what you could have done or could do in future to obtain a different decision, to review the personal data used, and to have inaccurate data corrected and the decision re-evaluated.

Utah and Iowa: you can also opt out of targeted advertising and of the processing of your sensitive personal information. Exceptions apply, for example where the processing is needed for a product or service you have specifically requested.

How to exercise these rights

Send your request to the contact address given above. We need to verify your identity before we can respond; you do not have to create an account for this. We use the information you provide for verification only for that purpose and keep it no longer than necessary. Adults can submit a request on behalf of a child in their care.

To restrict sale, sharing and targeted advertising you can also limit ad personalisation in your device’s advertising settings. If your browser or device sends an opt-out preference signal such as the Global Privacy Control, we honour it.

We respond without undue delay and within the period set by law. If we need more time, we tell you why and how long. If we refuse a request, we explain the reasons, and where the law provides for it you can complain to the competent authority. Requests are free of charge unless they are manifestly unfounded or excessive; in that case we may charge a reasonable fee or decline to act, and we will explain why.

Additional information for users in Brazil

This section supplements the rest of this policy for users in Brazil in accordance with the Lei Geral de Proteção de Dados (LGPD). For them it takes precedence over any conflicting statement elsewhere in this policy. “Personal information” has the meaning given in the LGPD.

We only process your personal information if one of these legal bases applies:

  • your consent;
  • a legal or regulatory obligation we have to comply with;
  • the implementation of public policies laid down in laws or regulations or based on contracts, agreements or similar instruments;
  • studies by research bodies, preferably using anonymised information;
  • the performance of a contract to which you are a party, or of preliminary steps related to it;
  • the exercise of our rights in judicial, administrative or arbitration proceedings;
  • the protection of your life or physical safety or that of a third party;
  • the protection of health, in procedures carried out by health professionals or health entities;
  • our legitimate interests, unless your fundamental rights and freedoms prevail;
  • the protection of credit.

Which categories of personal information we process and for what purposes is described in the sections on the website, the app and our service providers. Contact us if you would like to know more about the legal bases.

Your rights

You have the right to:

  • obtain confirmation that we process your personal information;
  • access your personal information;
  • have incomplete, inaccurate or outdated information corrected;
  • have unnecessary or excessive information, or information not processed in compliance with the LGPD, anonymised, blocked or deleted;
  • be informed about the possibility of giving or refusing consent and about the consequences;
  • learn with which third parties we share your personal information;
  • have your personal information (other than anonymised information) transferred to another service or product provider at your express request, while our commercial and industrial secrets remain protected;
  • have information processed on the basis of your consent deleted, unless an exception under Art. 16 LGPD applies;
  • withdraw your consent at any time;
  • complain to the Brazilian data protection authority (ANPD) or to a consumer protection body;
  • object to processing that does not comply with the law;
  • request clear and adequate information about the criteria and procedures used for automated decisions;
  • request a review of decisions that are based solely on automated processing and affect your interests, including decisions that define your personal, professional, consumer or credit profile or aspects of your personality.

You will not suffer any disadvantage for exercising these rights.

How to make a request and how we respond

You or your legal representative can make a request at any time and free of charge using the contact address given above. We do our best to respond promptly. If we cannot comply immediately, or at all, we tell you the factual or legal reasons. If we do not process your personal information ourselves, we tell you, where we can, whom you should contact instead.

If you ask for access or for confirmation of processing, please tell us whether you want the information in electronic or printed form, and whether a simplified answer straight away is enough or you need a complete statement. We provide a complete statement within 15 days of your request. It covers the origin of your information, whether records exist, the criteria used and the purposes of the processing, while our commercial and industrial secrets remain protected.

If you ask for correction, deletion, anonymisation or blocking, we pass your request on without delay to the parties with whom we have shared the information so that they can comply as well, unless this is impossible or involves disproportionate effort.

Transfers outside Brazil

We may transfer your personal information outside Brazil where:

  • international law provides for the transfer as part of legal cooperation between public intelligence, investigation and prosecution authorities;
  • it is necessary to protect your life or physical safety or that of a third party;
  • the ANPD has authorised it;
  • it results from a commitment made in an international cooperation agreement;
  • it is necessary to carry out a public policy or a legal duty of a public service;
  • it is necessary to comply with a legal or regulatory obligation, to perform a contract or preliminary steps related to it, or to exercise rights in judicial, administrative or arbitration proceedings.

Other information

We may use your personal data in court or in the preparation of legal action that arises from improper use of the website, the app or related services. We may also be required to disclose personal data at the request of public authorities.

Logs and maintenance

To operate and maintain the website and the app, we and the service providers we use may record interactions in log files. Further personal data, for instance the IP address, may be used for the same purpose.

Further information

In individual cases we may give you additional information about a particular function or about the collection and processing of your data, in the app itself or on request. You can ask us for more details on any processing at any time.

Changes to this policy

We may change this privacy policy at any time. Changes are published on this page and, where technically and legally possible, also announced in the app or sent to you using the contact details we have. Please check this page regularly; the date of the last change is shown below. If a change affects processing that is based on your consent, we will ask for your consent again where required.

Last updated: 5 November 2026