Privacy Policy

1. Introduction

This policy explains what information Mira AI ("Mira") actually collects, stores, and processes today, based on how the Service is currently built — not on aspirational claims. Where a capability is planned but not yet implemented, it is explicitly labeled FUTURE / PLANNED rather than described as something Mira currently does.

2. Information Mira Currently Collects

Authentication information (CURRENTLY COLLECTED). When you create an account, Mira uses Firebase Authentication to handle sign-in (email/password or Google sign-in). Mira stores your Firebase user ID, email address, and email-verification status. Your identity is verified server-side, from your Firebase-issued token, on every request — the app itself is never trusted as proof of who you are.

Account information (CURRENTLY STORED). A user record (internal ID, Firebase UID, email, role) and a subscription record (plan and status — currently every account is on the free plan; there is no working payment system yet) are stored in Mira's database.

Conversations and messages (CURRENTLY STORED). The messages you send to Mira and the responses Mira generates are stored, associated with your account, along with basic metadata such as timestamps, token counts, and which AI provider handled the message. This is what allows a conversation to be resumed later.

Memory (CURRENTLY COLLECTED AND STORED). After each exchange, Mira uses an AI model to identify whether it contains a durable fact worth remembering (for example, a stated preference or an ongoing project) and, if so, stores it in a separate memory record tied to your account. Ordinary conversational content that isn't judged to be a durable fact is not separately stored as memory. Memory is retrieved by relevance and used only in your own future conversations — it is never shared with or visible to other users. You can explicitly ask Mira to forget something, which is handled as a direct instruction rather than left to the AI's judgment.

Information you provide to the knowledge feature (CURRENTLY COLLECTED). If you use Mira's knowledge feature to share text or markdown content with Mira, that content is stored, broken into smaller chunks, and made retrievable in later conversations. This is currently limited to pasted text/markdown — uploading files such as PDFs is not currently supported (FUTURE / PLANNED). By default, this content is retrieved using keyword matching; semantic (meaning-based) search is built into Mira's infrastructure but is not enabled by default in production today.

Web research queries (CURRENTLY PROCESSED, CONDITIONALLY). When web research is enabled and you ask Mira to look something up, your search query is sent to Mira's configured search provider (currently Tavily, where configured) and the resulting pages may be fetched and processed to help answer your question. Fetched page content is treated as untrusted external data, not as instructions to Mira. Metadata about research sessions (such as which sources were used) may be stored to support this feature.

Technical and log information (CURRENTLY COLLECTED). Like most web services, Mira's servers generate operational logs (structured JSON logs) as part of normal operation — for example, request timing, errors, and rate-limit events. We do not currently publish a fixed retention schedule for these operational logs.

Cookies / local storage (CURRENTLY USED, LIMITED). The Mira marketing site (mira.eduverseapp.net) stores a single, non-personal preference — your light/dark theme choice — in your browser's local storage. It does not use tracking cookies or third-party analytics. The Mira web application relies on Firebase Authentication's client SDK, which stores your sign-in session locally in your browser or device so you don't have to sign in on every visit.

3. Information Mira Does Not Currently Collect

• File uploads to the knowledge feature (text/markdown only today — FUTURE / PLANNED).
• Advertising identifiers or third-party ad-tracking data. Mira's infrastructure can determine whether your account is eligible to see an ad based on your subscription tier, but no actual advertising content or ad-network tracking is served by Mira today.
• Payment or billing information. There is currently no working payment processor integrated into Mira, and no way for an account to hold a paid subscription yet (FUTURE / PLANNED).
• Data from other users. Every conversation, memory, and knowledge query is scoped to your own account at the database level, not merely hidden in the interface.

4. Third-Party Services

Mira relies on the following third-party infrastructure to operate:

• Firebase Authentication (Google) — handles sign-in and issues the identity tokens Mira verifies server-side.
• Google Cloud Platform — hosts Mira's backend and web services (Cloud Run), stores secrets (Secret Manager), and hosts container images (Artifact Registry).
• Neon — hosts Mira's PostgreSQL database (conversations, memory, knowledge, accounts).
• Tavily — Mira's web search provider, used only when web research is enabled and a query requires an open web search.
• Anthropic (optional) — an optional cloud AI provider Mira can route requests to. It is disabled by default; Mira's default is a self-hosted AI model, either running on your own device or on Mira's own server infrastructure, so your conversation does not need to reach a third-party AI provider unless cloud AI is explicitly enabled for your account.

5. Data Retention and Deletion

Mira's database is designed to mark records such as conversations as deleted rather than only hiding them from view, which supports removing your data on request. We do not currently publish a fixed data-retention schedule. If you would like your account data reviewed or deleted, contact us as described in "Contact" below and we will address the request — Mira does not yet have a fully self-service deletion tool in the product itself (FUTURE / PLANNED).

6. Your Rights

You may ask what personal data Mira holds about you, ask for it to be corrected, or ask for it to be deleted, by contacting us as described below. Depending on your location, you may have additional rights under applicable law; we will respond to legitimate requests in accordance with applicable law.

7. Security Practices

Concretely, as implemented today:

• Every request that touches your data is authenticated using a server-verified Firebase identity token — the client's claimed identity is never trusted on its own.
• Conversation, memory, and knowledge data are isolated per account at the database query level, not only in the interface.
• Credentials Mira's servers depend on (database connection string, Firebase service credentials, search-provider API key) are stored in Google Cloud Secret Manager, not as plain configuration values or in source code.
• Traffic to Mira's services is served over HTTPS/TLS.
• Requests are rate-limited to reduce abuse.

Mira does not currently use end-to-end encryption. To generate a response, your message content is processed by Mira's backend and by whichever AI provider (self-hosted or, if explicitly enabled, a third-party cloud provider) handles that request — it is not encrypted in a way that only you could decrypt. No security system is perfect, and we cannot guarantee absolute security.

8. Local AI and Data Locality

When Local AI handles a message on a supported device, the prompt is processed by the model running on that device for the generation step itself, rather than being sent to a third-party AI provider. Regardless of which AI path handles a given message, the resulting conversation is still saved to Mira's backend database (Neon/Postgres) in the same way as any other provider's output, so that your conversation history and memory continue to work across sessions and devices.

9. Children's Privacy

Mira is not directed at children, and we do not knowingly collect personal information from children under 13 (or the relevant minimum age in your jurisdiction). If you believe a child has provided us with personal information, contact us and we will address it.

10. Changes to This Privacy Policy

We may update this policy as Mira's implementation changes. Material changes will be reflected by updating the "Last updated" date at the top of this page. We aim to keep this document matched to what Mira actually does, not to what is aspirationally planned.

11. Contact

Mira does not yet operate a dedicated privacy contact channel of its own. For now, privacy-related requests can be routed through Eduverse, Mira's sponsoring organization — see the Contact option in the site footer, or visit eduverseapp.net.