Last updated:
Mibs Privacy Policy
Mibs stores some of your most personal information, so this policy uses plain language to explain what we collect, why, where we keep it, and how to delete it. Mibs is operated by MA YINGJUN, an individual developer trading as Mibs ("we", "us", or "our"). Contact: privacy@mibs.app.
1. What we collect
| Category | Information | Why |
|---|---|---|
| Account | Email address, display name, interface language, a salted hash of your password (we cannot see your password), sign-in method (password / Google) | To let you sign in and contact you |
| Google sign-in | The email address, email verification status, and Google account identifier Google provides when you choose to sign in with Google | To identify you |
| Your memories | Memories stored by you and the agents you connect, the space and section each one is in, sources, and edit and read records | This is the service Mibs provides |
| Agent connections | Which agents you connect, which of your spaces each one may use, and access tokens (stored only as hashes) | To allow access only to agents you authorize |
| Sign-in and security | Signed-in devices (browser type, approximate region), IP addresses, sign-in times, and failed sign-in counts | To show who is using your account and prevent credential stuffing and abuse |
| Waitlist | The email address and language you provide, and confirmation status | To notify you at launch |
| Subscription and transactions | Plan, monthly or yearly billing, status and renewal date, country or region, Paddle customer/subscription/transaction/refund identifiers, amounts, checkout intent and processing times, and cancellation/refund/dispute status | To provide paid features, identify order ownership, reconcile payments, and handle cancellations and refunds |
| Usage counts | Daily counts per account: how many times your agents called each Mibs tool (brief, search, read, remember, status), how many memories were saved, and how many actions you took in the web app; plus the dates of milestones such as connecting your first agent or saving your first memory. Counts only — we do not record memory content, search terms, titles, IP addresses, or devices for this | To maintain and improve the service: see which features are used and spot problems |
We do not collect contacts, precise location, or advertising identifiers. We do not use third-party analytics, advertising, or tracking scripts. Mibs blocks passwords and keys it detects and does not store their original text.
2. How we use your information
Only to provide and protect Mibs: to store and organize your memories, share them with agents you authorize, send necessary emails (email verification, password recovery, security alerts, and service changes), prevent abuse, and troubleshoot problems; and to understand how the service is used, through usage counts, so we can improve Mibs.
We do not sell your data, do not use your memories to train AI models, do not use it for advertising, and do not carry out profiling.
Legal bases for processing (for people covered by the EU / UK GDPR):
| Purpose | Legal basis |
|---|---|
| Accounts, memory storage, sharing with agents you authorize, and transactional emails | Performance of our contract with you (providing the service you request) |
| Sign-in and security records, abuse prevention, and rate limiting | Our legitimate interests in protecting your account and the service from attacks; records are retained only as long as necessary |
| Usage counts | Our legitimate interests in maintaining and improving the service; counts only, no memory content |
| Waitlist emails | Your consent, which you can withdraw at any time by unsubscribing |
| Compliance with legal requirements | Legal obligation |
3. Who can see your information
- You and the agents you authorize. Each agent can use only the spaces you allow, and you can pause or remove it at any time. How an agent handles content after reading it is governed by its provider's own privacy policy.
- We access relevant data only when necessary to respond to your request for help, troubleshoot problems, or address security issues or unlawful activity, and keep access to the minimum necessary.
- Our infrastructure providers process data only on our instructions:
| Provider | Purpose | Data processed |
|---|---|---|
| Cloudflare | Hosting the site and APIs, databases and storage, human verification (Turnstile), and attack protection | All service data |
| Resend | Sending transactional emails | Email addresses and email content |
- Paddle is involved when you pay, manage a payment method, or handle subscription transactions. The isolated payment page loads Paddle's payment script and checkout frame, which process the device, connection, and fraud-prevention information needed for payment; Paddle does not receive your memory content. Paddle is our reseller (Merchant of Record) and processes payment information, including card details, billing addresses, and tax identifiers, as an independent data controller under its own privacy policy. The transaction information Mibs stores is limited to the items listed above, and we never see your full card number.
- Google is involved only when you choose to sign in with Google. Google acts as an independent identity provider and handles your Google account information under its own privacy policy; we receive only the items listed in section 1.
- When required by law, we may disclose necessary data. Where legally permitted, we will notify you first.
4. Where we store data and how we protect it
- Data is stored on Cloudflare's global network and may be processed outside your country or region, including in the United States. International transfers rely on safeguards such as providers' data processing agreements and EU Standard Contractual Clauses. You can write to us to request copies of the relevant documents.
- Data is encrypted in transit using HTTPS. Databases and storage are encrypted at rest by our providers. Each person's memories are kept in a separate storage unit.
- Passwords are stored only as salted hashes; sign-in sessions and agent tokens are stored only as hashes. Sign-up, sign-in, and password recovery use human verification, and all endpoints are rate limited. See Data Security.
- No system can guarantee absolute security. If a data breach affects you, we will notify you as soon as possible within 72 hours of becoming aware of it and explain its impact and our response.
5. How long we keep data
| Data | Retention |
|---|---|
| Account and memories | While your account exists; when you delete your account, it becomes inaccessible immediately and the data is then purged from our systems |
| Individual memories you remove | Removed from your space immediately; undo records in "Recent" are kept for 30 days |
| Sign-in and security records | 90 days |
| Usage counts | 13 months; milestone dates are kept while your account exists. All are deleted when you delete your account |
| Waitlist | Unconfirmed sign-ups are deleted after 14 days; confirmed addresses are kept until you unsubscribe or ask us to delete them. After you unsubscribe, we keep an unsubscribe record (your email address, your original confirmation and consent record, your unsubscribed status, and the contact identifier at our email provider) solely to make sure we never email you again and to evidence your original consent |
| Subscription and necessary financial records | While your account exists; after deletion, we retain only internal account and platform identifiers, amounts, and cancellation/refund/dispute status until 180 days after related compensation is complete. Open disputes extend retention until resolved. Records are then purged, contain no email address or memories, and are not used for marketing. Paddle retains transaction records under its own legal obligations |
| Deletion barrier | An internal deletion marker containing no email address or memories, used to prevent late payments or backup recovery from reactivating a deleted account |
| Provider backups | Cleared through the backup cycle within at most 30 days after deletion |
We do not delete your account because you have not signed in for a long time: your agents may still be using it.
6. Your rights
Wherever you live, you can:
- View and export: export all your memories as Markdown files in settings at any time;
- Correct: edit memories and account information directly;
- Delete: delete individual memories, use "Forget everything", or delete your entire account;
- Withdraw consent or object to processing: remove agents, unsubscribe from emails, or contact us.
If local law, such as the EU GDPR, UK GDPR, or California CCPA, gives you additional rights, we will honor them. If you cannot exercise a right through the product, contact privacy@mibs.app. We will respond within 30 days. You also have the right to complain to your local data protection authority.
7. Cookies and local storage
Mibs uses only a necessary sign-in session cookie (__Host-mibs_session, HttpOnly), and your language and light / dark theme choices stored locally in your browser. We have no analytics or advertising cookies. The isolated payment page also uses necessary storage provided by Paddle for checkout, payment security, and payment-method management; other product pages do not load payment scripts. Any optional analytics or marketing features require separate disclosure and handling under applicable requirements.
8. Age
Mibs is only for people aged 18 or over. If we discover an underage user, we will delete their account.
9. Changes to this policy
We will update the date at the top of the page when this policy changes. We will notify you of significant changes in advance by email or in the product.