Privacy Policy

Last Updated: July 13, 2026

DRIMSSY SRL ("we," "us," or "our") operates the mi mi Friend mobile application (the "App"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our App.

mi mi Friend is a child-friendly companion app. The companion responds using a curated library of pre-written, pre-recorded content. The App does not use artificial intelligence, does not use the microphone, and does not accept free-form text or voice input.

By downloading, installing, or using mi mi Friend, you agree to the terms of this Privacy Policy. If you do not agree, please do not use the App.

1. Who We Are

DRIMSSY SRL
CUI 52129815
Registered in: Romania, European Union
Address: Jud. Brașov, Sat Hărman, Comuna Hărman, Strada Livezii, Nr. 22, 507085, Romania
Contact Email: std@drimssy.com
Data Protection Officer: std@drimssy.com

For the purposes of the EU General Data Protection Regulation ("GDPR"), we are the data controller responsible for your personal data.

2. Information We Collect

2.1 Information You Provide Directly

2.2 Information Collected Automatically

2.3 Information We Do NOT Collect

• We do not collect date of birth or exact age — only a self-reported age range (e.g. "6-12")
• We do not use the microphone or collect voice recordings
• We do not collect free-form text or chat content from any user
• We do not collect precise geolocation data
• We do not access your contacts or address book
• We do not access your photo library, except a single screenshot you explicitly choose to attach to a support request
• We do not use advertising identifiers (IDFA / Android Advertising ID) and we do not track you across apps
• We do not collect financial or payment card data (payments are handled exclusively by Apple App Store / Google Play Store via RevenueCat)

3. How We Use Your Information

1. Provide and maintain the App — create your account, activate mi mi companions, and deliver core features
2. Power the companion — mi mi responds using a library of pre-written, pre-recorded questions and answers (no AI, no microphone, no free-form input)
3. Provide educational content — deliver mi mi Academy pre-written lessons and quizzes, track progress, and adapt difficulty
4. Provide mi mi Arena — single-player and multiplayer games, leaderboards, an in-game shop, and friend features; in multiplayer we share gameplay state with other players in the same session (see Section 5.3)
5. Manage subscriptions — process and verify in-app purchases and subscription status
6. Track progress — record game and Arena scores, energy, activity completions, leveling, and learning progress
7. Deliver push notifications you have enabled
8. Communicate with you — send verification codes, important updates, and respond to support requests
9. Ensure security and fair play — detect and prevent fraud, abuse, cheating, and unauthorized access through rate limiting, authentication, and anti-cheat validation

4. Third-Party Service Providers

We share data with the following third-party service providers who process data on our behalf:

4.1 Firebase / Google (United States)

4.2 RevenueCat (United States)

4.3 Amazon Web Services — AWS (United States)

4.4 MongoDB Atlas (United States)

4.5 Resend (United States)

We do not sell, rent, or trade your personal data to third parties for their marketing purposes.

5. How mi mi Works (No AI)

5.1 Companion Responses

mi mi replies using a curated library of pre-written text and pre-recorded audio. The child taps a question, and the App plays a matching pre-recorded answer. There is no artificial intelligence, no microphone, no free-form text input, and no conversation is sent to any third-party AI service. All companion content is authored and reviewed by our team in advance.

5.2 mi mi Academy (Educational Lessons)

• Pre-written content: All lessons, facts, and quizzes are authored and reviewed by our team in advance — they are not generated in real time and not generated by AI
• Button answers only: Children answer by selecting buttons. No free-text input is collected
• Progress data: We store lesson completion, numeric quiz scores (0-100%), and spaced-repetition data used solely to adapt lesson difficulty
• Home activities disclaimer: Lessons that suggest hands-on activities include a visible "do these activities together with an adult" notice

5.3 mi mi Arena (Games, Multiplayer and Social Features)

mi mi Arena includes 3D games (some with real-time multiplayer), a library of mini-games, public leaderboards, an in-game cosmetics shop, a daily prize wheel, and shareable friend codes. Please read this section carefully:

• Multiplayer visibility: In real-time multiplayer sessions, your mi mi companion's preset name, in-game position, movement, and equipped cosmetics are visible to other players in the same session. A technical account identifier is shared between players to synchronize gameplay; it is not your real name or email.
• Public leaderboards: Leaderboards display the mi mi companion's preset name (not a real name) and game scores, visible to other players.
• Communication is preset-only: Players can interact only through preset emotes (such as a wave). There is no text chat, no voice chat, and no free-form messaging. Players cannot send personal information to one another.
• Names are presets: Companion names are chosen from a preset list and are not the child's real name. We recommend not treating them as personal information.
• In-game currency: Coins and gems and all in-game items have no real-world monetary value and cannot be purchased with, or exchanged for, real money.

5.4 Anonymous Telemetry

We collect anonymous, bucketed event counters for games and multiplayer (for example, game started/finished, multiplayer latency). No user identifier is attached, and these events are automatically deleted after 90 days. They are used only to keep the App reliable.

5.5 Character States

We do not perform emotion recognition or psychological profiling of any user, including children. Any "mood" values displayed in the App are scripted character states. These values are never used for advertising or profiling.

6. Data Storage and Security

6.1 Where We Store Data

• Server-side data (account info, progress) is stored in MongoDB Atlas with encryption at rest and in transit (TLS)
• Media files (audio, images, assets) are stored and delivered via AWS S3 and CloudFront
• Local device data — authentication tokens are stored in the device's encrypted secure storage (iOS Keychain / Android Keystore); other preferences are stored in the device's local storage
• Data location: Our application server is hosted in the European Union (Frankfurt, Germany). Some third-party processors (such as Firebase, AWS, MongoDB Atlas, RevenueCat and Resend) operate in the United States; where data is transferred from the European Economic Area, we rely on Standard Contractual Clauses and other appropriate safeguards

6.2 Security Measures

• Encryption: TLS/HTTPS for all data in transit; encryption at rest for databases
• Authentication: JWT-based token authentication with expiration
• Access control: Role-based access with two-factor authentication for administrative access
• Rate limiting and anti-cheat: Protection against brute-force attacks and server-side validation of gameplay and the in-game economy
• Security headers: HSTS, X-Content-Type-Options, X-Frame-Options
• Path traversal protection: Secure file delivery with access control checks

6.3 Data Retention

7. Children's Privacy (All Ages)

mi mi Friend is designed for users of all ages, including young children. We take children's privacy extremely seriously and apply protections consistent with the U.S. Children's Online Privacy Protection Act (COPPA), the EU General Data Protection Regulation (GDPR, Article 8), and the UK Age Appropriate Design Code (AADC), where applicable.

7.1 The Same Safe Experience for Everyone

There is no AI chat, no microphone, no voice recording, and no free-form messaging for any user, of any age. mi mi responds only with pre-recorded content, and companion names are chosen from preset lists. Content filtering is built into the curated content itself.

7.2 Age Classification and Consent

During registration, users (or their parent or guardian) select a broad age range (1-6, 6-12, 12-16, or 16+). We do not collect date of birth or exact age. Users under 16 require verifiable parental consent. For these accounts we collect the parent or guardian's email address, which serves as the account's identity and consent contact — we do not collect the child's own email address. The parent confirms consent via a secure link sent to that email before the account is fully activated. Users 16 and older may self-consent using their own email address. We keep a consent record (timestamp, IP address, user-agent, agreed clauses, and policy version) for legal compliance.

7.2.1 Age Truthfulness

The age gate presents the options in a neutral, non-leading manner. By proceeding, the user (or their parent or legal guardian) warrants the truthfulness of the age range provided. If we receive credible information that an account's stated age range is inaccurate, we will reclassify the account into the appropriate age tier and request parental consent before any further processing inconsistent with the corrected classification.

7.3 Data We Collect from Children

We apply strict data minimization for child users. The data collected is limited to:

7.4 What We Do NOT Do with Children's Data

• We do not use children's data for behavioral advertising or targeted marketing
• We do not sell, rent, or share children's personal data with third parties for commercial purposes
• We do not allow children to exchange free-form messages, text, or voice with other users
• We do not use persistent identifiers for cross-app tracking on child accounts
• We do not condition a child's participation on providing more data than is reasonably necessary

7.5 Other Players and Multiplayer (Child Safety)

mi mi Arena includes multiplayer games and public leaderboards. Parents should be aware that:

• In multiplayer sessions and on leaderboards, a child's preset companion name, in-game position, and cosmetics are visible to other players.
• Children can send only preset emotes to other players. There is no chat, no voice, and no way to exchange personal information.
• Companion names are presets, not real names. We recommend parents ensure the preset name chosen is not personally identifying.
• Parents may ask us to disable Arena multiplayer for their child's account at any time by contacting std@drimssy.com.

7.6 Parental Rights and Controls

Parents and legal guardians can exercise the following rights at any time, in-app or by contacting std@drimssy.com:

• Review and export: The App provides in-app data export; you may also request a copy of the child's data
• Delete: The App provides in-app account deletion that erases the child's personal data (email, learning and game progress, any stored memory, and device links). You may also request deletion by email
• Withdraw consent: Revoke consent at any time, resulting in deletion of the child's data
• Restrict processing: Ask us to disable specific features (such as Arena multiplayer) for the child's account
• Modify: Request correction of any inaccurate data

We respond to all parental requests within 30 days. Deletion erases personal data and unlinks your devices; the activation code that pairs a physical mi mi is reset so the toy can be re-registered later. Deletion is performed without undue delay, residual copies in encrypted backups expire on a rolling basis (within 30 days), and consent records are retained only where legally required.

7.7 Third-Party Data Processing for Children

• All third-party processors are contractually bound to comply with COPPA and GDPR requirements for children's data
• Data shared with third parties is limited to what is necessary for the specific feature
• We maintain Data Processing Agreements (DPAs) with all processors

7.8 School and Educational Use

If mi mi Friend is used in an educational setting, the school may provide consent on behalf of parents for the collection of children's data solely for educational purposes, in accordance with COPPA's school consent exception. Schools must notify parents and provide them the opportunity to review this Privacy Policy.

8. Your Rights Under GDPR

If you are located in the European Economic Area (EEA), you have the following rights regarding your personal data:

To exercise any of these rights, contact us at std@drimssy.com. We will respond within 30 days of receiving your request.

9. International Data Transfers

Your personal data may be transferred to and processed in countries outside the European Economic Area, including the United States (where some of our third-party providers operate).

When we transfer data outside the EEA, we ensure appropriate safeguards are in place:

• EU-US Data Privacy Framework — where the provider is certified under the DPF
• Standard Contractual Clauses (SCCs) approved by the European Commission — where applicable
• Adequacy decisions by the European Commission — where available

10. In-App Purchases and Subscriptions

mi mi Friend may offer optional premium subscriptions. Where a subscription is offered, all payments are processed exclusively through the Apple App Store or Google Play Store. We do not collect, process, or store any payment card information. Subscription management and billing are handled entirely by the respective app store. RevenueCat acts as our intermediary to verify subscription status; only an anonymous transaction identifier and subscription status are shared with us.

In-game currency (coins, gems) and items have no real-world monetary value and cannot be purchased with, or exchanged for, real money.

11. Device Permissions

mi mi Friend may request the following device permissions:

You can manage these permissions at any time through your device settings. Denying optional permissions will only disable the related feature — the App will continue to function. The App does not request microphone access and does not request advertising/tracking permission.

12. Cookies and Tracking Technologies

The mi mi Friend mobile app does not use cookies. In addition:

• Analytics is fully disabled — no behavioral analytics or screen-view events are collected for any user, regardless of age
• We do not use any advertising trackers or cross-app tracking; the Android Advertising ID permission is explicitly removed and no iOS tracking prompt is shown
• Local storage stores functional data on your device (authentication tokens, preferences, settings)
• Email tracking (open and click tracking) is disabled

13. Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will:

1. Notify the relevant Data Protection Authority within 72 hours of becoming aware of the breach
2. Notify affected users without undue delay if the breach is likely to result in a high risk to their rights and freedoms
3. Document the breach, its effects, and the remedial actions taken

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we do:

• We will update the "Last Updated" date at the top of this document
• For significant changes, we will notify you through the App or via email
• Continued use of the App after changes constitutes acceptance of the updated Privacy Policy

15. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

• Email: std@drimssy.com
• Data Protection Officer: std@drimssy.com

If you are not satisfied with our response, you have the right to lodge a complaint with your local Data Protection Authority.

16. Legal Basis Summary (GDPR Article 6)