Milio privacy policy
This policy explains what the Milio app does with your information. We wrote it to match what the app actually does. If something here is unclear, write to us at hello@getmilio.app.
On this page
The short version
- There is no account. We do not ask for your email, phone number or real name.
- Your diary, voice notes, photos, mood check-ins, goals and chat history are kept on your phone. Diary entries, photos, voice notes, chats and memories are encrypted on the phone with a key kept in its secure storage.
- When you talk to your companion, your messages go through our server to an AI provider so the companion can reply. This only starts after you agree, and you can switch it off at any time.
- When the app starts, it asks our update service (Expo) whether there is a newer version. This sends a random update ID and technical details, never your diary or chats.
- There are no ads, no tracking and no analytics tools in the app. We do not sell your information.
Who we are
Milio is provided by Covesight Limited, a company incorporated in Hong Kong (Company No. 81337743), with its registered office at Unit 2904-05, 29/F Universal Trade Centre, 3 Arbuthnot Road, Central, Hong Kong (“we”, “us”). We are the controller of the personal data described here. Contact: hello@getmilio.app.
What stays on your phone
These are stored only on your device. We cannot see them.
- Diary entries (text, titles, tags, transcripts), voice notes and photos. Entries, voice notes and photos are encrypted with XChaCha20-Poly1305. The key is kept in your phone’s secure storage (the iOS Keychain or Android Keystore). It is never part of a phone backup and is never sent to us. The only copy outside secure storage is inside a backup file you make yourself, locked with your passphrase (see “Your own backup file” below).
- Your chat history with the companion and the things you have asked it to remember (encrypted the same way).
- Mood check-ins, adventure stories, goals, plans, the garden, your pet and its items, and your settings.
- Your diary PIN, if you set one. The PIN itself is never stored; only a protected check value is.
- Face ID or fingerprint: your phone checks these. The app only learns whether the check passed.
- Your birth year, if you use Talk. Talk is for adults, so the app asks for the year once. It stays on your phone and is never sent to us. You can correct it in Settings.
Diary voice typing is done on the phone. If your phone cannot transcribe on the device, the app keeps the voice note as audio and does not transcribe it.
Backups. On Android the app opts out of Google backups. On iOS, the app’s files can be part of your own iCloud or computer backup under your Apple account. Encrypted items stay unreadable in a backup, because the key is not backed up. Some plain data, such as goals, plans, mood check-in levels and your names, is readable in such a backup. We have no access to your backups.
Your own backup file. Settings > Back up diary makes one file with your diary, photos, voice notes, chats, memories, check-ins, goals, plans, your pet and your settings, so you can bring them to a new phone. It also holds the key that unlocks your diary. The file is encrypted with a passphrase you choose (XChaCha20-Poly1305, key derived with scrypt). The app hands it to your phone’s share sheet and you decide where it goes. We never receive it, we do not know the passphrase and we cannot reset it. Anyone who has both the file and the passphrase can read your diary, so keep the passphrase to yourself.
Sharing a story. When you share an adventure story as a picture, the app makes the picture on your phone and hands it to the share sheet. The picture holds the story and your pet’s name. It leaves out any sentence with your own name, and it never holds diary, mood, goal or chat content.
What leaves your phone, and why
1. Talking with your companion
Talk is optional. Before your first message the app asks for your permission. Nothing is sent until you agree.
When you send a message, the app sends to our server:
- your recent conversation (up to the last 20 messages);
- the things your companion remembers about you, each of which you approved;
- your name, if you gave one, and your pet’s name and stage;
- the focus areas you chose (for example sleep, stress or low mood);
- today’s mood word from your latest check-in, if any (for example “steady” or “heavy”);
- your device language;
- whether you have Milio Plus;
- a diary entry, but only if you choose to share it, and only with the next message;
- if the app has noticed signs that you may be in danger, a note saying so, so the reply can be careful;
- a random install ID (see “Identifiers” below).
Our server passes this to an AI provider (see “Who processes your data”), which writes the reply. Our server does not store your messages and does not write them to logs.
Some of this may reveal things about your health, such as your mood or what you are going through. We only process it because you ask us to, to give you the replies.
2. Adventure stories
When your pet comes back from an adventure, the app can ask our server for a short story. This sends your pet’s name and stage, your name if you gave one, the place, your focus areas, your device language, whether you have Milio Plus and the install ID. It only happens if you have Milio Plus, you have agreed to Talk, Talk is switched on and your birth year shows you are 18 or over. Otherwise the app uses its own built-in stories.
3. Reporting a reply
If you report a reply from your companion, the app sends the text of that one reply and the reason you picked. The reply may contain your name if your companion used it. We keep reports for 90 days to review them and improve safety. A report is stored without your install ID and without your IP address.
4. Voice typing in Talk
The microphone button in Talk uses your phone’s speech recognition. Depending on your phone and settings, Apple (on iPhone) or Google (on Android) may process the audio on their servers to turn it into text. This happens under Apple’s or Google’s own privacy terms. The app does not send audio to us.
5. Reading replies aloud
If you turn on “Hear Milio speak” (the switch shows the name you gave the fox), the app uses your phone’s built-in text-to-speech voice. This normally happens on the phone. Some Android voices may use their maker’s online service. The app does not send the replies to us for this.
6. Purchases
If you buy Milio Plus, you buy it through the App Store or Google Play. Apple or Google handle payment; we never see your card details.
7. Reminders
Reminders are scheduled on your phone. We do not use push notifications and do not receive a notification token.
8. App updates
Each time the app starts, it asks our update service, Expo (650 Industries, Inc.), whether a newer version of the app’s code is available, and downloads it if there is one. The request carries your IP address, a random ID that the update system creates on your phone, your phone’s system (iOS or Android), the app version, the update channel and which update the app is running. If the app closed because of an error the last time it started, the request also carries the technical error message, so a broken update can be found and fixed. It does not include your diary, chats or names. Expo uses this information to deliver updates and to tell whether they were downloaded.
Identifiers
The app creates a random install ID the first time it needs one. It is not linked to your name, your device’s hardware ID, an advertising ID or any account. The app sends it with each request to our server so we can apply daily limits (for example 15 free messages a day) and stop abuse. Our server stores only a scrambled (hashed) form of it, next to a daily count, for 2 days. “Delete all data” removes the install ID from your phone, and the app makes a new one.
The update system keeps its own random ID (see “App updates”). It goes only to Expo, not to our server, and is not linked to the install ID. “Delete all data” does not remove it; deleting the app does.
Our hosting provider sees your IP address when your phone connects, as with any internet service. Our server uses a scrambled form of it for one minute to limit how many requests one address can send. We do not store your IP address.
This website
This website (getmilio.app) sets no cookies and has no analytics, no tracking and no content from other companies: its fonts and pictures come from the site itself. Cloudflare, which hosts it, receives your IP address and the details your browser sends with every request (such as the page and the browser type) so it can deliver the page and protect the site from attacks. We do not keep logs of visits.
When you write to us
If you email hello@getmilio.app, we receive your email address and what you write. Your email reaches us through our email forwarding and mailbox providers, which store it for us. We use it only to answer you, and keep it only as long as we need to help you or the law requires us to.
Who processes your data
We use these service providers. They process data only to provide their service to us, under data processing terms.
| Provider | What it does | Where |
|---|---|---|
| Cloudflare, Inc. | Hosts our server and this website, stores usage counts and reports, and runs the Workers AI models that write replies | Cloudflare’s global network, which can include countries outside the EU |
| 650 Industries, Inc. (Expo) | Delivers app updates when the app starts | United States |
Apple and Google are separate controllers for app downloads, payments, and their speech recognition and text-to-speech services. Their own privacy policies apply.
We do not sell or rent your information, and we do not share it for advertising.
International transfers. We are based in Hong Kong, and our providers process data outside the European Economic Area, including in the United States. Where this happens we rely on the European Commission’s adequacy decision for the EU-US Data Privacy Framework for certified providers, or on Standard Contractual Clauses. Cloudflare, Inc. and 650 Industries, Inc. (Expo) are certified under the EU-US Data Privacy Framework, its UK Extension and the Swiss-US Data Privacy Framework. Where these do not apply, we rely on Standard Contractual Clauses.
How long data is kept
| Data | How long |
|---|---|
| Everything on your phone | Until you delete it, use “Delete all data”, or remove the app |
| Talk messages and context on our server | Not stored. Processed only to create the reply |
| Talk messages at the AI provider | Workers AI (Cloudflare): not kept after the reply |
| Daily usage counts with the hashed install ID | 2 days |
| Reported replies | 90 days |
| Update requests at Expo | As long as Expo needs them to deliver updates. Expo does not give a fixed period |
| Server logs | Contain only the route, status, timing, provider, an error code, the name of the AI model, the number of tokens used, whether the request came from a Plus subscriber and, for chat, whether the safety check was on. They hold no message text, install ID or IP address, so a line cannot be tied to a person. Kept for up to 7 days |
Our AI provider does not use your messages to train its models.
Legal bases (EU and UK)
| Purpose | Legal basis |
|---|---|
| Providing Talk replies and AI stories you ask for | Performance of our contract with you (Article 6(1)(b) GDPR). Where your messages contain health information, your explicit consent (Article 9(2)(a)), which you give on the consent screen before your first message |
| Daily limits and abuse prevention using the hashed install ID and IP address | Our legitimate interest in keeping the service available and fair (Article 6(1)(f)) |
| Reviewing reported replies | Our legitimate interest in making the companion safe (Article 6(1)(f)) |
| Checking your subscription | Performance of our contract (Article 6(1)(b)) |
| Delivering app updates and finding broken ones | Our legitimate interest in keeping the app working and safe (Article 6(1)(f)) |
| Delivering this website and keeping it secure | Our legitimate interest in running a safe website (Article 6(1)(f)) |
| Answering your emails | Our legitimate interest in answering you, or steps you ask for under our contract (Article 6(1)(f) and (b)) |
| Keeping records the law requires (for example tax records held by the app stores) | Legal obligation (Article 6(1)(c)) |
You can withdraw your consent at any time: switch off “Talk with Milio” in Settings (the switch shows the name you gave the fox). This stops all messages and story requests. Withdrawal does not affect what was processed before.
No decisions with legal or similarly significant effects are made about you by automated means.
Your rights
If you are in the EU, the UK or another place with similar laws, you have the right to access, correct, delete, restrict or object to the processing of your personal data, the right to data portability, and the right to withdraw consent.
Because there is no account, almost all of your data is on your phone and in your control:
- See and export: Settings > Export diary creates a readable file with your diary entries, a list of your photos and your plans.
- Take it with you: Settings > Back up diary creates an encrypted file with everything, and Restore from a backup reads it on a new phone.
- Delete: Settings > Delete all data removes your diary, photos, voice notes, chats, memories, check-ins, goals, plans, your pet, the install ID and the encryption key from your phone. It cannot be undone.
- Stop sharing with the AI: switch off Talk in Settings.
The little data on our server is not linked to you, and we cannot normally tell which records are yours (Article 11 GDPR). Usage counts delete themselves after 2 days and reports after 90 days. If you still want to make a request, write to hello@getmilio.app. If you can give us information that lets us find your data (for example the exact text of a reply you reported), we will act on it.
You also have the right to complain to a data protection authority. We have no establishment in the EU, so you can complain to the data protection authority in the country where you live or work. Our home regulator is Hong Kong’s Privacy Commissioner for Personal Data (PCPD, www.pcpd.org.hk).
Children
Milio is meant for people aged 16 and over. Talk and AI-written stories are for adults (18 and over): before your first chat, the app asks for your birth year and keeps it on your phone. We do not knowingly process data of younger children. If you believe a child under 16 is using the app, write to us.
Security
We use encryption on the phone (XChaCha20-Poly1305 with a key in secure storage), HTTPS for every connection, and we keep as little as possible on our server. No system is perfectly secure. If you lose your phone, a diary lock (PIN, Face ID or fingerprint) adds another layer.
Crisis support
If something you write suggests you may be in danger, the app shows helplines and your local emergency number. This check runs on your phone for what you write in the diary and in Talk, and on our server for Talk messages, as part of creating the reply. The app never contacts anyone on your behalf.
Changes
If we change this policy, we will update the date at the top and, for important changes, tell you in the app.
Contact
Covesight Limited, Unit 2904-05, 29/F Universal Trade Centre, 3 Arbuthnot Road, Central, Hong Kong. Email: hello@getmilio.app