Miranda Privacy Policy

Last updated: November 2, 2026

This policy explains what data the Miranda iOS app and its widgets process. Data controller: Deniz Koca (denizzkocaa@gmail.com).

In short

What stays on your phone

Your cards, learned words, favourites, mistakes, your own list, profiles, XP, level, coins, streak, badges and settings are kept only on your device, in the space the app shares with its widgets. Unless you use "Save with Apple", they are never sent to us.

What reaches our server

Content and subscription. When the app asks for new content, it sends the transaction signed by the App Store (product, transaction number, dates) so we can check whether Pro is active. It is checked during the request and not stored. Apple takes the payments; your card details never reach us.

Player account. If you play the Word Wheel with friends or join a league, a player account is created without sign-up. It holds your player name, avatar and colour; the app language; a random player id and friend code; a one-way hash of your device id (so one device cannot create unlimited accounts or invite rewards); your notification address if you allowed notifications; your friends and blocked players; duel and league results; pending coin rewards and reports you sent. The account's key stays in your device's Keychain; the server only keeps a hash of it.

Your player name and avatar are visible to your friends, your duel opponents and, while "Appear in leagues" is on, the players in your league group.

Save with Apple (optional). If you back up your progress, we store the user id Apple gives this app, Apple's session token and the backup itself (the data under "What stays on your phone"). We do not ask for your name or email address.

Invite rewards. So an invite reward is paid once per device, the app uses Apple's DeviceCheck; Apple only keeps a per-device "this device was invited" flag.

Technical records. To limit the number of requests, the server keeps IP addresses in memory only, for at most a minute; its own logs contain no IP addresses. The provider our server runs on (Railway) may keep its own technical logs. Our servers are in the European Union.

Ads (free plan only)

On the free plan, Google AdMob shows the ads. Google processes data such as your IP address, device and app information, approximate location, ad interactions and, if you allow it, your advertising identifier (IDFA) to show and measure ads, prevent abuse and, if you allow it, personalise them. In the European Economic Area, the UK and Switzerland you are asked for consent first.

You can change tracking permission at any time in iOS Settings → Privacy & Security → Tracking, and your ad consent in the app's Settings. Details: Google's policy. Pro has no ads at all.

AI tutor (Pro only)

When you chat with Miranda, your latest messages, your native language, the language you learn, your level and, if you chose one, your player name are sent through our server to OpenAI's AI service so it can write the reply; OpenAI does not get anything that identifies you (no name or account), only a one-way code derived from your subscription. Your subscription is checked with the App Store's signed transaction. Our server does not store conversations; the chat history stays on your device and can be deleted from the chat screen.

OpenAI processes this data to write replies and to prevent abuse; under its API terms it does not use it to train its models and may keep it for up to 30 days for abuse monitoring. We suggest not writing sensitive personal information, such as health details, in the chat.

Notifications

Reminders are scheduled on your device. For duel, invite and league notifications your notification address is used through Apple's push service (APNs). You can turn notifications off in iOS Settings.

Who we share data with

We do not sell your data. To run the service we only use these providers: Railway (server and database), Apple (payments, notifications, Sign in with Apple, DeviceCheck) Google (ads on the free plan only) and OpenAI (the AI tutor in Pro only). They process the data only for these purposes and with protection equal to this policy. If the law requires it, we may disclose information to the authorities.

Keeping and deleting data

Your player account and everything linked to it is kept until you delete it. Settings → Player account → Delete account removes everything on the server at once (your name, friends, duels, league records and progress backup) and revokes Sign in with Apple; the progress on your phone stays. Deleting the app deletes the data on your phone.

The server's safety backups are kept for at most 30 days; deleted data leaves the backups within that time.

Your rights

Under the GDPR and Turkey's KVKK you can ask to access, correct, delete or take your data with you and object to its processing. You can do most of this in the app yourself (changing your name, "Appear in leagues", "Delete account"). For anything else, write to us: denizzkocaa@gmail.com; we answer within 30 days. You can also complain to your data protection authority.

Changes

If we change this policy, we update this page and the date at the top, and announce important changes in the app.