Privacy Policy

Last Updated: August 14, 2026

DRIMSSY SRL ("we," "us," or "our") operates the mi mi Friend mobile application (the "App"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our App.

mi mi Friend is a child-friendly companion app. The companion responds using a curated library of pre-written, pre-recorded content. The companion uses no artificial intelligence, the App never uses the microphone, and it accepts no free-form text or voice input. One optional game feature — the photo-to-3D toy workshop described in Section 5.6 — sends a photograph the child takes with the in-game camera to an image-to-3D generation service so it can be turned into a 3D toy. That photograph is never stored; only the 3D toy it produces is kept.

By downloading, installing, or using mi mi Friend, you agree to the terms of this Privacy Policy. If you do not agree, please do not use the App.

1. Who We Are

DRIMSSY SRL
CUI 52129815
Registered in: Romania, European Union
Address: Jud. Brașov, Sat Hărman, Comuna Hărman, Strada Livezii, Nr. 22, 507085, Romania
Contact Email: std@drimssy.com
Data Protection Officer: std@drimssy.com

For the purposes of the EU General Data Protection Regulation ("GDPR"), we are the data controller responsible for your personal data.

2. Information We Collect

2.1 Information You Provide Directly

2.2 Information Collected Automatically

2.3 Information We Do NOT Collect

• We do not collect date of birth or exact age — only a self-reported age range (e.g. "6-12")
• We do not use the microphone or collect voice recordings
• We do not collect free-form text or chat content from any user
• We do not collect precise geolocation data — for demo sessions we derive only the country, never a precise location. The in-game camera does not attach GPS location tags to photographs, and the App does not request location permission
• We do not use any third-party analytics, attribution, or measurement SDK (no Firebase Analytics, no Google Analytics, no advertising or attribution partners). The product analytics described in Section 2.2 is first-party and stays on our own server
• We do not access your contacts or address book
• We do not browse or read your photo library. The only images that ever leave your device are ones you deliberately create or choose: a photo taken with the in-game camera in the photo-to-3D workshop (Section 5.6), and a screenshot you explicitly choose to attach to a support request
• We do not store the photographs taken in the photo-to-3D workshop. A photo is used only to generate the 3D toy and is then discarded — it is never written to a file, a database, or a storage bucket (Section 5.6)
• We do not use the camera outside two explicit actions you start yourself: scanning an activation QR code, and taking a photo in the photo-to-3D workshop. There is no background or continuous camera capture
• We do not use advertising identifiers (IDFA / Android Advertising ID) and we do not track you across apps
• We do not collect financial or payment card data (payments are handled exclusively by Apple App Store / Google Play Store via RevenueCat)

3. How We Use Your Information

1. Provide and maintain the App — create your account, activate mi mi companions, and deliver core features
2. Power the companion — mi mi responds using a library of pre-written, pre-recorded questions and answers (no AI, no microphone, no free-form input)
3. Provide educational content — deliver mi mi Academy pre-written lessons and quizzes, track progress, and adapt difficulty
4. Provide mi mi Arena — single-player and multiplayer games, leaderboards, an in-game shop, and friend features; in multiplayer we share gameplay state with other players in the same session (see Section 5.3)
5. Turn a photo into a 3D toy — where the photo-to-3D workshop is enabled for an account, generate a 3D model from a photograph the child takes and keep the resulting model in the child's collection. The photograph itself is used only for that generation and is never stored (see Section 5.6)
6. Manage subscriptions — process and verify in-app purchases and subscription status
7. Track progress — record game and Arena scores, energy, activity completions, leveling, and learning progress
8. Deliver push notifications you have enabled
9. Communicate with you — send verification codes, important updates, and respond to support requests
10. Ensure security and fair play — detect and prevent fraud, abuse, cheating, and unauthorized access through rate limiting, authentication, and anti-cheat validation
11. Improve and maintain the App — measure which screens are used and for how long, count how many accounts are active each day, and monitor errors and crashes. This is first-party analytics that stays on our own server (see Section 5.4). We never use it for advertising, and we never use it to make automated decisions about a user

4. Third-Party Service Providers

We share data with the following third-party service providers who process data on our behalf:

4.1 Firebase / Google (United States)

4.2 RevenueCat (United States)

4.3 Amazon Web Services — AWS (United States)

4.4 MongoDB Atlas (United States)

4.5 Resend (United States)

4.6 Modal (Modal Labs, United States)

4.7 Cloudflare — R2 (United States)

4.8 Render (Render Services, Inc., United States — hosting in the EU)

4.9 No Analytics, Attribution or Geolocation Providers

We do not sell, rent, or trade your personal data to third parties for their marketing purposes.

5. How mi mi Works (Pre-Written Companion, No Microphone)

5.1 Companion Responses (No AI)

mi mi replies using a curated library of pre-written text and pre-recorded audio. The child taps a question, and the App plays a matching pre-recorded answer. The companion contains no artificial intelligence, uses no microphone, accepts no free-form text input, and no conversation is ever sent to any third-party AI service. All companion content is authored and reviewed by our team in advance.

The only generative model anywhere in mi mi is the image-to-3D model used in the photo-to-3D toy workshop (Section 5.6). It works on a photograph and produces a 3D shape. It never takes part in what mi mi says, and it never receives speech or text.

5.2 mi mi Academy (Educational Lessons)

• Pre-written content: All lessons, facts, and quizzes are authored and reviewed by our team in advance — they are not generated in real time and not generated by AI
• Button answers only: Children answer by selecting buttons. No free-text input is collected
• Progress data: We store lesson completion, numeric quiz scores (0-100%), and spaced-repetition data used solely to adapt lesson difficulty
• Home activities disclaimer: Lessons that suggest hands-on activities include a visible "do these activities together with an adult" notice

5.3 mi mi Arena (Games, Multiplayer and Social Features)

mi mi Arena includes 3D games (some with real-time multiplayer), a library of mini-games, public leaderboards, an in-game cosmetics shop, a daily prize wheel, and shareable friend codes. Please read this section carefully:

• Multiplayer visibility: In real-time multiplayer sessions, your mi mi companion's preset name, in-game position, movement, and equipped cosmetics are visible to other players in the same session. A technical account identifier is shared between players to synchronize gameplay; it is not your real name or email.
• Public leaderboards: Leaderboards display the mi mi companion's preset name (not a real name) and game scores, visible to other players.
• Communication is preset-only: Players can interact only through preset emotes (such as a wave). There is no text chat, no voice chat, and no free-form messaging. Players cannot send personal information to one another.
• Names are presets: Companion names are chosen from a preset list and are not the child's real name. We recommend not treating them as personal information.
• In-game currency: Coins and gems and all in-game items have no real-world monetary value and cannot be purchased with, or exchanged for, real money.

5.4 Telemetry and Product Analytics

We use two kinds of measurement. Both are first-party: collected by our own server, never shared with an analytics provider, never used for advertising or cross-app tracking, and never used for automated decision-making or profiling of a user.

• Anonymous gameplay telemetry: bucketed event counters for games and multiplayer (for example, game started/finished, multiplayer latency). No user identifier is attached. Automatically deleted after 90 days.
• Product analytics: which screens are opened, how long they stay open, and how many unique accounts are active each day. These records are linked to an internal account identifier — not to a name — and are used in aggregate to decide what to build and what to fix. Automatically deleted after 13 months. A separate live "in app now" record (current screen, platform, app version) exists only while the App is open and is deleted within minutes of closing it.

Under GDPR Article 21 you may object to this processing at any time. The App has a built-in switch: Settings → Data & Privacy → Usage analytics. Turning it off stops collection on the device immediately and deletes the analytics records already collected for that account. You can also write to std@drimssy.com (see Section 8). Deleting an account also deletes its analytics and diagnostic records.

5.5 Character States

We do not perform emotion recognition or psychological profiling of any user, including children. Any "mood" values displayed in the App are scripted character states. These values are never used for advertising or profiling.

5.6 Photo-to-3D Toy Workshop (Camera)

Inside one of the mi mi Arena games a child can point the in-game camera at a real object — a toy, a drawing, an everyday thing — and turn that photograph into a 3D toy that appears in their own mi mi world. The feature is intended for objects, not people. It is switched off by default and is currently available only to a small closed beta group; where it is enabled, generation is capped (5 per day and 6 attempts per hour per companion).

• The photograph is never stored. It is uploaded over an encrypted connection, held in our server's memory only for the length of the generation, passed to the generation provider, and then discarded. It is never written to a file, a database, or a storage bucket, and we never keep a copy.
• Where the photograph goes: to Modal (Modal Labs, United States), which runs the image-to-3D model on our behalf (Section 4.6). The image is sent on its own — no name, no email address, and no account or device identifier travels with it.
• No location data: the in-game camera does not attach GPS tags to photographs, and the App does not request location permission.
• What is kept: only the result — the generated 3D model file and its thumbnail image — stored with Cloudflare R2 (United States) (Section 4.7) and recorded against the child's mi mi companion so the toy stays in their collection.
• Progress records: while a photo is being developed into a toy we keep a short-lived job record (identifier, status, timings). It contains no photograph and is deleted automatically after 24 hours.
• Never shown to other players: a generated toy is visible only to the child who made it. It is never surfaced to another player — not to a visitor in that child's world, and not in a live multiplayer session. This is enforced on our server, which removes generated toys from anything another player receives.
• Deletion: deleting the account erases the record of every generated toy. That record is the only place the file's storage key exists, and every access link is signed per request and never stored — once the record is gone the file can no longer be retrieved or associated with any person, and it carries no name, email, or account identifier of its own.
• Parental control: camera access can be withdrawn at any time in your device settings, and the rest of the App keeps working. You may also ask us to disable the workshop for your child's account by writing to std@drimssy.com.

We use a child's photograph for one purpose only: producing the 3D toy the child asked for. It is not used for advertising, not used to profile anyone, and not analysed for any other reason.

6. Data Storage and Security

6.1 Where We Store Data

• Server-side data (account info, progress) is stored in MongoDB Atlas with encryption at rest and in transit (TLS)
• Media files (audio, images, assets) are stored and delivered via AWS S3 and CloudFront
• Generated 3D toys (the model file and its thumbnail) are stored with Cloudflare R2 and reached only through short-lived signed links. The photographs they were generated from are not stored anywhere
• Local device data — authentication tokens are stored in the device's encrypted secure storage (iOS Keychain / Android Keystore); other preferences are stored in the device's local storage
• Data location: Our application server is hosted on Render (Section 4.8) in its European Union region (Frankfurt, Germany). Some third-party processors (such as Firebase, AWS, MongoDB Atlas, RevenueCat, Resend, Modal and Cloudflare) operate in the United States; where data is transferred from the European Economic Area, we rely on Standard Contractual Clauses and other appropriate safeguards

6.2 Security Measures

• Encryption: TLS/HTTPS for all data in transit; encryption at rest for databases
• Authentication: JWT-based token authentication with expiration
• Access control: Role-based access with two-factor authentication for administrative access
• Rate limiting and anti-cheat: Protection against brute-force attacks and server-side validation of gameplay and the in-game economy
• Security headers: HSTS, X-Content-Type-Options, X-Frame-Options
• Path traversal protection: Secure file delivery with access control checks

6.3 Data Retention

We keep personal data only for as long as is reasonably necessary for the purpose it was collected for, and we do not retain personal data indefinitely. This applies with particular strictness to children's data. Each retention period below is enforced automatically by our systems — when it ends, the data is deleted without any manual step. When an account is deleted, its data is erased as described in Section 7.6, including its analytics and diagnostic records.

7. Children's Privacy (All Ages)

mi mi Friend is designed for users of all ages, including young children. We take children's privacy extremely seriously and apply protections consistent with the U.S. Children's Online Privacy Protection Act (COPPA), the EU General Data Protection Regulation (GDPR, Article 8), and the UK Age Appropriate Design Code (AADC), where applicable.

7.1 The Same Safe Experience for Everyone

There is no AI chat, no microphone, no voice recording, and no free-form messaging for any user, of any age. mi mi responds only with pre-recorded content, and companion names are chosen from preset lists. Content filtering is built into the curated content itself.

The one place a model generates something is the photo-to-3D toy workshop (Section 5.6), which turns a photograph of an object into a 3D shape. It never speaks to the child, never receives speech or text, and its results are reviewed before they can be seen by anyone other than the child who made them.

7.2 Age Classification and Consent

During registration, users (or their parent or guardian) select a broad age range (1-6, 6-12, 12-16, or 16+). We do not collect date of birth or exact age. Users under 16 require verifiable parental consent. For these accounts we collect the parent or guardian's email address, which serves as the account's identity and consent contact — we do not collect the child's own email address. The parent confirms consent via a secure link sent to that email before the account is fully activated. Users 16 and older may self-consent using their own email address. We keep a consent record (timestamp, IP address, user-agent, agreed clauses, and policy version) for legal compliance.

7.2.1 Age Truthfulness

The age gate presents the options in a neutral, non-leading manner. By proceeding, the user (or their parent or legal guardian) warrants the truthfulness of the age range provided. If we receive credible information that an account's stated age range is inaccurate, we will reclassify the account into the appropriate age tier and request parental consent before any further processing inconsistent with the corrected classification.

7.3 Data We Collect from Children

We apply strict data minimization for child users. The data collected is limited to:

7.4 What We Do NOT Do with Children's Data

• We do not use children's data for behavioral advertising or targeted marketing
• We do not sell, rent, or share children's personal data with third parties for commercial purposes
• We do not allow children to exchange free-form messages, text, or voice with other users
• We do not use persistent identifiers for cross-app tracking on child accounts
• We do not build behavioural profiles of children, and we do not make automated decisions about a child based on analytics — usage data is read in aggregate to improve the App, not to score, rank, or target an individual child
• We do not condition a child's participation on providing more data than is reasonably necessary
• We do not keep the photographs children take in the photo-to-3D workshop — a photo is used to generate the 3D toy and is then discarded
• We do not send a child's name, email address, or account identifier together with that photograph
• We do not use a child's photograph for anything other than producing the 3D toy they asked for
• We do not publish a child's generated 3D toy to other players; it stays visible only to the child who made it

7.5 Other Players and Multiplayer (Child Safety)

mi mi Arena includes multiplayer games and public leaderboards. Parents should be aware that:

• In multiplayer sessions and on leaderboards, a child's preset companion name, in-game position, and cosmetics are visible to other players.
• Children can send only preset emotes to other players. There is no chat, no voice, and no way to exchange personal information.
• Companion names are presets, not real names. We recommend parents ensure the preset name chosen is not personally identifying.
• Parents may ask us to disable Arena multiplayer for their child's account at any time by contacting std@drimssy.com.

7.6 Parental Rights and Controls

Parents and legal guardians can exercise the following rights at any time, in-app or by contacting std@drimssy.com:

• Review and export: The App provides in-app data export; you may also request a copy of the child's data
• Delete: The App provides in-app account deletion that erases the child's personal data (email, learning and game progress, any stored memory, the 3D toys generated in the photo-to-3D workshop, and device links). You may also request deletion by email
• Withdraw consent: Revoke consent at any time, resulting in deletion of the child's data
• Restrict processing: Ask us to disable specific features (such as Arena multiplayer) for the child's account
• Modify: Request correction of any inaccurate data

We respond to all parental requests within 30 days. Deletion erases personal data and unlinks your devices; the activation code that pairs a physical mi mi is reset so the toy can be re-registered later. Deletion is performed without undue delay, residual copies in encrypted backups expire on a rolling basis (within 30 days), and consent records are retained only where legally required.

7.7 Third-Party Data Processing for Children

• All third-party processors are contractually bound to comply with COPPA and GDPR requirements for children's data
• Data shared with third parties is limited to what is necessary for the specific feature
• We maintain Data Processing Agreements (DPAs) with all processors
• Photo-to-3D workshop: a child's photograph is shared with exactly one processor — Modal (United States), which runs the image-to-3D model (Section 4.6). It receives the image and nothing else: no name, no email address, no account or device identifier. The resulting 3D model and its thumbnail are stored with Cloudflare R2 (United States) (Section 4.7), which never receives the photograph

7.8 School and Educational Use

If mi mi Friend is used in an educational setting, the school may provide consent on behalf of parents for the collection of children's data solely for educational purposes, in accordance with COPPA's school consent exception. Schools must notify parents and provide them the opportunity to review this Privacy Policy.

8. Your Rights Under GDPR

If you are located in the European Economic Area (EEA), you have the following rights regarding your personal data:

To exercise any of these rights, contact us at std@drimssy.com. We will respond within 30 days of receiving your request.

9. International Data Transfers

Your personal data may be transferred to and processed in countries outside the European Economic Area, including the United States (where some of our third-party providers operate).

Two of these transfers concern the photo-to-3D workshop (Section 5.6) and are worth stating plainly: a photograph taken in the workshop is transmitted to Modal (United States) for the sole purpose of generating a 3D model from it, and the generated model and thumbnail are stored with Cloudflare R2 (United States). The photograph is not stored in either place by us, and nothing identifying the child is transferred with it.

When we transfer data outside the EEA, we ensure appropriate safeguards are in place:

• EU-US Data Privacy Framework — where the provider is certified under the DPF
• Standard Contractual Clauses (SCCs) approved by the European Commission — where applicable
• Adequacy decisions by the European Commission — where available

10. In-App Purchases and Subscriptions

mi mi Friend may offer optional premium subscriptions. Where a subscription is offered, all payments are processed exclusively through the Apple App Store or Google Play Store. We do not collect, process, or store any payment card information. Subscription management and billing are handled entirely by the respective app store. RevenueCat acts as our intermediary to verify subscription status; only an anonymous transaction identifier and subscription status are shared with us.

In-game currency (coins, gems) and items have no real-world monetary value and cannot be purchased with, or exchanged for, real money.

11. Device Permissions

mi mi Friend may request the following device permissions:

You can manage these permissions at any time through your device settings. Denying optional permissions will only disable the related feature — the App will continue to function; declining or later withdrawing camera access simply means QR scanning and the photo-to-3D workshop are unavailable. The App does not request microphone access, does not request location access, and does not request advertising/tracking permission.

12. Cookies and Tracking Technologies

The mi mi Friend mobile app does not use cookies. In addition:

• No third-party analytics or tracking SDKs — we do not use Firebase Analytics, Google Analytics, or any attribution or measurement provider
• First-party product analytics only — screen views, time spent per screen, and daily-active records are collected by our own server as described in Sections 2.2 and 5.4. They are never shared with third parties, never used for advertising, and never used to profile an individual user. You can switch this off at any time in Settings → Data & Privacy → Usage analytics
• We do not use any advertising trackers or cross-app tracking; the Android Advertising ID permission is explicitly removed and no iOS tracking prompt is shown
• Local storage stores functional data on your device (authentication tokens, preferences, settings)
• Email tracking (open and click tracking) is disabled

12.1 Our Website and QR Landing Page

This section covers our website (including the QR landing page a mi mi box leads to), which is separate from the App:

• No cookies are used for advertising or cross-site tracking, and there are no third-party trackers.
• Analytics on the website asks first. On your first visit a banner asks whether we may count your visit. Declining is one tap and is exactly as easy as accepting; nothing is pre-selected.
• If you decline (or ignore the banner): we record only that a page was opened or a store button was clicked — with no information about your device at all.
• If you accept: we additionally record your city (resolved on our own server, never sent to a geolocation provider), device type, browser, and an irreversible keyed value used to recognise repeat visits. No IP address is stored.
• Your choice is remembered in your browser's local storage so we do not ask again. Clearing your browser data lets you choose again.
• Retention: website analytics records are deleted automatically after 13 months.

13. Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will:

1. Notify the relevant Data Protection Authority within 72 hours of becoming aware of the breach
2. Notify affected users without undue delay if the breach is likely to result in a high risk to their rights and freedoms
3. Document the breach, its effects, and the remedial actions taken

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we do:

• We will update the "Last Updated" date at the top of this document
• For significant changes, we will notify you through the App or via email
• Continued use of the App after changes constitutes acceptance of the updated Privacy Policy

August 14, 2026 update: we added the photo-to-3D toy workshop (Section 5.6) — what the in-game camera is used for, that the photograph is never stored, that only the generated 3D toy is kept, and that generated toys are never shown to other players. We named the two processors it relies on, Modal and Cloudflare R2, both in the United States (Sections 4.6, 4.7 and 9), listed the new data and its retention (Sections 2.1, 2.2, 6.1, 6.3 and 7.3), added the camera permission (Section 11), and rescoped the "no artificial intelligence" statement so it says precisely what remains true: the companion uses no AI, there is still no microphone and no free-form input, and the only generative model in mi mi works on photographs in the workshop (Sections 5.1 and 7.1). We also named Render (Section 4.8) — the cloud provider that has always hosted our application server in the European Union (Frankfurt). Naming it adds no new data flow; it makes the existing hosting explicit.

July 26, 2026 update: we described our first-party product analytics and diagnostic error logs in full (Sections 2.2, 3, 5.4 and 12), added their retention periods (Section 6.3), confirmed that no third-party analytics or geolocation provider is used (Section 4.8), and stopped storing IP addresses for demo sessions.

15. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

• Email: std@drimssy.com
• Data Protection Officer: std@drimssy.com

If you are not satisfied with our response, you have the right to lodge a complaint with your local Data Protection Authority.

16. Legal Basis Summary (GDPR Article 6)