Privacy Policy

Last updated: 21 October 2026

1. Information Mira accesses

Mira only accesses Google services after the account owner approves access on Google's OAuth consent screen. The permissions actually granted are the ones shown on that screen at the time of approval. Depending on what has been authorised, they may include:

• Google Calendar (…/auth/calendar) — read and manage calendars and events, for example to list upcoming events or to create, change or delete an event when asked.
• Google Sheets (…/auth/spreadsheets) — read and write spreadsheets, used to record and read back expenses in a sheet the account owner chooses.
• Google Drive permission — the Calendar/Sheets authorisation tool may also request the broad …/auth/drive permission. This is broader than Mira needs for its current features. Mira does not use it to browse or manage other Drive files; the permission requested is still disclosed on the consent screen.
• Google Health, read-only — activity and fitness, health metrics and measurements, sleep, nutrition, profile, settings, location, electrocardiogram and irregular-rhythm-notification permissions may be requested by the CLI’s read-only preset. Mira currently uses the data needed for its enabled health summaries; some requested permissions may not be used. Mira does not write health data.

Mira also handles:

• OAuth tokens issued by Google, which let Mira act within the approved permissions without asking for a password. Mira never sees or stores a Google password.
• Messages and requests sent to Mira through the messaging channel the operator has set up, along with Mira's replies.
• Assistant records such as conversation history, notes Mira keeps to stay useful over time, and operational logs. These can include Google data that came up in a conversation.

2. How information is used

Information is used only to provide the assistant features the account owner asks for:

• answering questions about and managing calendar events;
• recording, reading and summarising expenses in Google Sheets;
• summarising activity, sleep and body-measurement trends;
• showing the operator a private status view of these features;
• keeping the assistant working, secure and fixable.

Google user data is not sold, not used for advertising, and not used to develop, improve or train generalised AI or machine-learning models. Humans do not read Google user data except where the account owner asks for it, where it is needed for security or to fix a problem, or where the law requires it.

3. AI service providers

Mira relies on external AI service providers to understand requests and write replies. When a request involves Google data — for example, "what is on my calendar tomorrow?" — the relevant part of that data is sent to the configured provider so it can produce an answer. This means some Google user data does leave the server Mira runs on.

• Data is sent to AI providers only to perform the requested assistant function.
• The operator is responsible for choosing and configuring providers whose terms are consistent with this policy, including that the data is not used to train generalised models. Requests may pass through a model-routing service before reaching the model provider.
• Each provider handles data under its own terms and may keep it for a limited time, for example for abuse monitoring. Those retention periods are set by the provider, not by Mira.

4. Google API Services User Data Policy

Mira's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

This is a commitment made by Mira's operator. It is not a certification, endorsement or approval by Google.

5. Sharing and disclosure

Google user data is not shared with or transferred to anyone except:

• the AI service providers described above, to perform a requested function;
• the messaging service that carries conversations with Mira, which delivers Mira's replies (and anything they contain) to the account owner;
• infrastructure the operator uses to run Mira, such as the server host and backup storage;
• where needed to comply with applicable law, or to protect security;
• Google itself, when Mira reads from or writes to Google services.

6. Storage and security

Mira runs on a server managed by its operator. OAuth tokens and assistant records are stored there with access restricted to the operator, and administrative access is limited to a private network. The operator may keep backups of assistant records on separate storage the operator controls.

These measures reduce risk but no system is completely secure, and no guarantee of security is made.

7. Retention and deletion

Because Mira is self-hosted, retention is under the operator's control. Google data is generally fetched when needed rather than copied in bulk, but conversation history, notes, logs, short-lived caches and backups may contain Google data until they are deleted or expire.

To delete data, the operator can remove the stored OAuth tokens and the relevant local records, and allow or force older backups to expire. Deleting data from Mira does not delete it from Google services themselves, and does not remove copies an AI provider may keep under its own retention terms. Mira does not currently offer a self-service deletion page.

8. Revoking Google access

Access can be withdrawn at any time from the Google Account's third-party connections page. Once revoked, Mira can no longer read or change Google data with the old tokens. Revoking access does not by itself delete data Mira already holds; see Retention and deletion.

9. Health information

Health summaries are informational only. They are not medical advice, diagnosis or treatment, and may be incomplete or wrong. Please consult a qualified health professional about any health concern.

10. Changes and questions

This policy may be updated when Mira's features or data practices change; the date at the top shows the latest revision. Mira is not intended for children.

Questions about this policy can be sent to the developer contact shown on Mira's Google consent screen.