Short version: MIRA has no servers, no accounts, and no analytics. The only time we receive anything about you is if you write to us.
1. We do not collect your data
MIRA does not create an account, does not ask you to sign in, and does not send your activity anywhere. There is no MIRA server: the app talks directly to your own machines, on your own network or through your own internet connection.
We do not use analytics, advertising networks or tracking of any kind, and we do not profile you.
2. What stays on this device
The following is stored on your device only, and is never sent to us:
- your layouts: buttons, positions, names and background colours;
- the nickname you pick;
- the machines you save, with their addresses and ports;
- the pairing keys that prove a machine is yours;
- your settings and preferences.
Deleting the app removes all of it.
A note on the password you type when setting up a machine. If you ask the app to prepare a machine for you, it asks for that machine's own username and password to open an SSH connection to it. Those credentials are used for that connection and nothing else: they go to that machine on your own network, never to us, and they are kept on this device only so you are not asked again for the same machine. Deleting the app removes them too.
3. What travels, and only between your devices
While you play, this device and the machine exchange directly: the aim and the buttons you press, the video and audio of that machine's screen, the nickname you chose, and — as with any network connection — the IP addresses of the two ends. None of this passes through us and none of it is stored by us.
Your nickname and the layouts you decide to share are visible to the other people in the same session, because that is what they are for. Share only what you are comfortable being seen.
4. When someone else is involved
If someone joins a session on your machine, that machine records their address in its own local history so you can see who connected and block them if you want. That list lives on that machine, belongs to you, and is never sent anywhere.
That history is created and kept by you, on your own equipment, for a purely personal purpose. Under Article 2(2)(c) of the GDPR, processing carried out in the course of a purely personal or household activity falls outside the scope of the Regulation. We are not the controller of it, and we have no access to it.
Two practical consequences. If you use MIRA outside a personal context — and the Terms of Use do not allow that — the exemption does not apply and the responsibility is entirely yours. And if you want that history gone, you delete it on that machine: we cannot do it for you, because we never see it.
5. If you write to support
This is the one case in which we do receive something about you.
When you email support@mirastation.com — including through the “Report this content” button, which simply opens your email app with a message already written — we receive what you send us: your email address, your message, and whatever you decide to include, such as the name of a device, an address, or a screenshot.
- Why: to answer you and to fix what you reported.
- Legal basis: our legitimate interest in replying to someone who contacted us, and in keeping the app working correctly (GDPR art. 6(1)(f)). Where your message concerns a purchase, the basis is the performance of that contract (art. 6(1)(b)).
- How long: up to 24 months from the last message of the exchange, then deleted. Longer only if we need it to defend a legal claim.
- Who else sees it: our email provider, acting as a data processor under a data processing agreement. Nobody else.
Nothing is sent automatically, ever. If you never write to us, we never receive anything about you.
6. Other companies
Purchases are handled by Apple. We receive no personal data from Apple: not your name, not your email, not your payment details. Whether a purchase is valid is verified on your own device, against a receipt signed by Apple. Apple's own privacy policy applies to what Apple does.
Apart from Apple and the email provider mentioned above, we use no other third-party service: no analytics, no advertising, no crash reporting, no cloud.
7. Permissions the app asks for
- Motion sensors — to work out where you are aiming.
- Local network — to find your machines on your Wi-Fi. Nothing is sent outside it.
- Bluetooth — to see game controllers paired with the phone, and to let a nearby friend join.
- Camera — only to scan a QR code, when you ask for it. No image is stored or sent.
Each of them is used for that purpose alone, and you can revoke any of them in iOS Settings.
8. Children
MIRA is not directed at children and we do not knowingly collect personal data from children. The Terms of Use set a minimum age of 13, or the higher age required where you live — 14 in Italy.
Since a session lets people play together, we recommend that a parent or guardian supervises who a minor connects with, and that they set up the machine themselves.
If you believe a child has sent us personal data by writing to support, tell us at support@mirastation.com and we will delete it.
9. How we keep it, and what we do not do
Retention
On your devices, your data stays until you delete it — a layout, a saved machine, a pairing key, or the app itself. Support emails: up to 24 months (section 5). We keep nothing else, because we have nothing else.
Security
What protects a session, precisely:
- Pairing is proved by a cryptographic signature (HMAC-SHA256) and the key never leaves your device — it is never sent, not even to the machine you paired with.
- Every person who connects must be approved individually, on the machine itself, and can be disconnected or banned at any moment.
- An approval is single-use and expires: it does not become a standing permission.
- The nearby co-op link between two phones is encrypted end to end.
- The browser page is served over HTTPS, with a certificate the machine generates for itself. The connection is encrypted, but since that certificate is not issued by a public authority your browser will warn you the first time: that warning is expected, and it means the identity is not vouched for by a third party.
What is not encrypted
The session itself — the video of the screen and the commands you send — travels directly between your device and your machine without a layer of encryption of its own. On a home network your Wi-Fi already encrypts what leaves your device; over the internet it does not.
This is one of the reasons MIRA is designed around a dedicated machine, and why the Terms of Use ask for one. The protection that matters most is not what scrambles a stream, it is having nothing on that screen worth intercepting: keep the machine for playing, and there is nothing of yours in there. One practical note, though — don't use MiraKey to type passwords during a remote session.
We are working on encrypting the session as well. Until then, this is what it is, written plainly rather than left out.
No transfers outside the EU
Beyond those, if any, performed by our email provider under the safeguards required by the GDPR. We operate no servers of our own, in any country.
No automated decision-making
And no profiling of any kind. Nothing about you is decided by a machine, because nothing about you is held.
10. Your rights
Under the GDPR you have the right to access, correct, delete and port your data, to object to its processing and to restrict it, and to withdraw consent where consent is the basis.
In practice these rights apply to two very different things. The data on your devices you control directly: delete it whenever you want, without asking us. The only data we actually hold is what you sent us by email (section 5), and for that you can write to support@mirastation.com and ask us to show it to you or erase it. We answer within one month.
If you believe your data has been mishandled, you may complain to your national data protection authority — in Italy, the Garante per la protezione dei dati personali (garanteprivacy.it).
11. Changes
If this policy changes, the new version appears inside the app.
12. Contact
Data controller: Edoardo Fioroni
support@mirastation.com — mirastation.com
MIRA Host, the free companion program for Windows, is a separate piece of software with its own terms and its own list of third-party components. You are shown them when you install it, and you can reopen them at any time from the host's Settings window.