Privacy Policy
Translation of the Japanese original. The Japanese version prevails.
This policy describes how personal information is handled in miggy (the "Service").
1. Information We Collect
| Category | Examples | How collected |
|---|---|---|
| Profile information | Display name, handle (optional), selected avatar number | Entered by the user |
| Device identifiers | Public key generated by the device (identifier for authentication), device ID for sync | Generated automatically |
| Apple ID link information (optional) | A user identifier for the Service received from Apple when you link via "Sign in with Apple" (used for account recovery). We do not obtain your email address or name | User actions (when linking) |
| Notification information | Device tokens for push notifications and incoming calls; display language (Japanese/English) and UTC offset for delivering announcements | Obtained from the device |
| Messages (DMs) | End-to-end encrypted ciphertext (the server cannot decrypt the contents) | Upon sending/receiving |
| Shared content | Photos/videos shared in shared albums and rooms, and associated information | User actions |
| Shared album favorites | Favorites added to photos in shared albums, and who added them and when (visible to the album owner) | User actions |
| Co-browsing activity | The URL, scroll position, and control mode of pages opened during a room's web co-browsing session | User actions |
| Room shared state | For YouTube watch parties: video IDs, titles, channel names, playback position, playback queue, and the room's play history; for Apple Music "Listen Together": song IDs, song titles, artist names, artwork URLs, playback position, playback queue, and the room's temporary playlists; game progress | User actions |
| YouTube search information | Search terms entered in YouTube watch parties; the device's region setting (country/region code) used to fetch recommended videos | User actions / obtained from the device |
| Friends and inbox | Friend relationships and last interaction time; friend requests, approvals, room invitations, shared album access requests | User actions |
| Reports, blocks, etc. | Report target, category, and optional details; block and mute settings | User actions |
| Network/device information | IP address at communication time, device/OS information, access timestamps | Automatic |
| Advertising-related information | Information collected by advertising providers for ad delivery (see Section 5 and the annex) | Ad SDK |
The Service does not collect your name, address, phone number, date of birth, gender, or location. The region setting (country/region code) and UTC offset above are device settings, not location information (such as GPS).
2. Purposes of Use
- Identity verification/authentication and prevention of impersonation (device public key)
- Providing features such as friends, messages (DMs), voice calls, shared albums (including tallying favorites and showing them to the owner), web co-browsing, YouTube watch parties, Apple Music "Listen Together", and games
- Account recovery via Apple ID link
- Delivering push notifications (including announcements)
- Preventing abuse and nuisance behavior, handling reports and blocks, ensuring safety
- Troubleshooting and responding to inquiries
- Displaying advertisements (Section 5)
3. Retention Periods
- DM ciphertext: deleted upon successful delivery; automatically deleted after 14 days if undelivered. Records kept for unread management (sender and recipient identifiers, sender display name, sent time) are deleted when the conversation is opened, and in any case automatically within 14 days of sending.
- Decrypted message history: stored only on the user's device (not retained on the server).
- Profile, friends, shared albums, favorites, etc.: until deleted by the user or until the Service ends. However, friend relationships with no interaction for one year are removed automatically. Shared album favorites are deleted when removed or when the album is deleted.
- Apple ID link information: until you unlink it (you can unlink from the app's settings).
- Co-browsing activity (URLs, etc.): used only to relay to room participants and deleted when the room ends (max 1 hour). Not stored on our servers as browsing history.
- Room shared state (YouTube, Apple Music, games): used only to relay to room participants and sync participants who join mid-session, and deleted when the room ends (max 1 hour). Not stored on our servers as viewing or listening history.
- YouTube search results: to reuse responses for identical searches, kept per search term for up to 1 hour without being linked to any information identifying the user.
- Account deletion: Users can delete their account at any time from the app's settings. Upon deletion, we immediately erase the profile, handle, friend relationships, shared albums (including photos and videos), favorites, undelivered messages, Apple ID link information, and similar data. However, for safety purposes, records of reports received from other users are retained with only the identifier, and reports made by the user are retained with the reporter anonymized.
- Report records and communication logs: within the scope and period necessary for operations and abuse prevention.
4. Third-Party Provision, Outsourcing, and Transfers to Foreign Third Parties
The Service uses services of the following external providers (all foreign (U.S.) corporations). These constitute "provision to third parties in foreign countries" or "outsourcing" under the Act on the Protection of Personal Information of Japan.
| Provider (country) | Role | Main information handled | Storage location |
|---|---|---|---|
| Backend infrastructure contractor (U.S. corporation) | Contractor for servers, storage, and communication relay | Profile, identifiers, notification tokens, DM ciphertext, shared media, network information | The company's global edge network; may span multiple countries including Japan, and the storage country may not be identifiable |
| Push notification infrastructure provider (U.S. corporation) | Delivery of push notifications | Notification tokens, delivery information | The company's global infrastructure |
| Advertising provider (U.S. corporation) | Ad delivery | See the annex "Disclosure on External Transmission" | The company's global infrastructure |
| Google LLC (U.S.) | Video search for YouTube watch parties (YouTube Data API, queried from our servers) | Search terms, video IDs, region codes (no information identifying the user is sent) | The company's global infrastructure |
- About storage locations: because the backend is an edge computing platform, data may be processed and stored around the world. While the contractor is incorporated in the U.S., the actual storage locations may span multiple countries including Japan and may not be identifiable.
- The names of external providers to which information is transmitted from the user's device are listed in the annex "Disclosure on External Transmission".
- For information about data protection systems in these countries, refer to materials published by the Personal Information Protection Commission of Japan.
- Except as required by law, we do not provide personal information to third parties without prior consent.
5. Advertising (External Transmission)
The Service uses third-party advertising services. Information is transmitted from the user's device to the advertising provider for this purpose. Details are in the annex "Disclosure on External Transmission".
6. Integration with External Services (YouTube, Apple Music, Google)
In the following features, your device communicates directly with each provider's services. Information obtained by these providers is handled in accordance with their respective privacy policies.
(1) YouTube Watch Parties
- The Service uses YouTube API Services.
- Searching for videos and fetching recommended and related videos is performed by our servers querying the YouTube Data API with our own API key. We do not request access to your Google account.
- Videos are played in the official YouTube embedded player (IFrame Player) on your device, which communicates directly with YouTube (Google). Google may collect information about your device and viewing through cookies and similar technologies. Thumbnail images are also fetched by your device directly from YouTube.
- Video IDs, playback positions, etc. shared in a room are deleted when the room ends (max 1 hour), as described in Section 3.
- For how Google handles information, see the Google Privacy Policy (https://policies.google.com/privacy).
- If you have linked a Google account to the Service (see (3) below), you can revoke the Service's access at any time from Google's security settings page (https://security.google.com/settings/security/permissions).
(2) Apple Music "Listen Together"
- Available only to Apple Music subscribers. Searching for and playing songs is done by your device communicating directly with Apple through Apple's MusicKit; our servers do not distribute or relay music.
- To synchronize playback among room participants, song IDs, song titles, artist names, artwork URLs, playback position, playback queue, and temporary playlists are shared with room participants via our servers and deleted when the room ends (max 1 hour).
- Temporary playlists created in a room may be saved to your own Apple Music library.
- For how Apple handles information, see Apple's Privacy Policy (https://www.apple.com/legal/privacy/).
(3) Google Integration (Google Calendar and Google Drive)
- If you choose to link a Google account, the Service authenticates using Google's official SDK (Google Sign-In) and accesses Google APIs within the scope you authorize (viewing, creating, editing, and deleting Google Calendar events; viewing, moving, and deleting Google Drive files and creating folders).
- Credentials such as access tokens are managed on your device by the SDK. Calendar events, Drive files, your Google account email address, etc. are communicated only between your device and Google and are not sent to or stored on our servers (files may be stored temporarily on your device for preview).
- The Service's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. We do not use Google user data for advertising, and we do not provide or sell it to third parties.
- You can unlink at any time from the app's settings (the Service's access is also revoked when you unlink). You can also revoke access from Google's security settings page (https://security.google.com/settings/security/permissions).
7. Information Processed Only on Your Device
The following information is processed and stored only on your device and is not sent to our servers.
- Photos and videos in your photo library (except those you share to shared albums or rooms)
- Events in your device calendar (read and written through iOS calendar features)
- Reminders and their notifications (delivered as local notifications on your device)
- Decrypted message (DM) history
8. Security Measures
- DMs are end-to-end encrypted; only ciphertext is stored on the server (the contents cannot be decrypted).
- Voice calls are encrypted with DTLS-SRTP.
- Communication with the server is encrypted with TLS (HTTPS/WSS).
- Device private keys and authentication tokens are stored in the iOS Keychain.
- We monitor the environment of contractors (including those abroad) and supervise them as necessary.
9. Requests Regarding Retained Personal Data
Users may request notification of purposes of use, disclosure, correction, addition, deletion, suspension of use, or suspension of third-party provision of their personal data. Please contact the office below; we respond in accordance with the law after verifying identity.
10. Use by Minors
Persons under 13 may not use the Service. Minors should use the Service with the consent of a parent or guardian.
11. Contact for Inquiries and Complaints
Operator: masaya shiramizu ／ Contact: support@miggy-project.com
12. Revisions
This policy may be revised in response to changes in laws or the Service. Important changes will be announced in the app or by other means.