Privacy Policy

1. Who we are

Mikson Core (“we”, “us”) develops apps, websites and other software. We are the controller of the personal data described in this policy.

• Mikson Core, obrt za informatičke usluge, vl. Matej Zlatunić
• Slovenska ulica 9, 10000 Zagreb, Croatia
• Privacy questions and requests: privacy@miksoncore.com
• General questions: info@miksoncore.com

2. What this policy covers

This policy applies to all apps we publish under the Mikson Core name, including their test versions, to our website miksoncore.com, and to our other services. Not every app has every feature described here. Where a feature does not exist in an app, the parts of this policy about it do not apply to that app.

When we build or run software for a client, the client’s own privacy policy applies to the people who use it.

3. Summary

• Most of what you enter in our apps is stored on your device.
• Data leaves your device only for online features, such as an account, cloud sync, sharing with other people or AI features. The app tells you when a feature sends data.
• Our servers for app data are in the European Union.
• We do not sell personal data, show advertising or track you across other companies’ apps and websites.
• You can delete your account and your data, withdraw consent and use your rights at any time.

4. Data we process

Depending on the app or service and the features you use, we process the following kinds of data:

• Content you enter or create: entries, logs, notes, lists, settings, photos and other content you add.
• Account data: an account identifier, and where you choose Sign in with Apple, the identifier, name and e-mail address Apple shares with us.
• Content for online features: the text, photos and figures a feature needs to work, for example to sync, to share with people you choose, or to answer an AI request.
• Health and fitness data: for example nutrition, body measurements, activity and cycle data, where an app offers such features (section 7).
• Purchase data: your plan, the products you bought, Apple’s transaction identifiers and dates. Apple handles all payments; we never see your payment details.
• Technical data: app and system versions, device type, error reports, request logs, IP addresses in server logs, push notification tokens and security checks that confirm a request comes from our genuine app.
• Communication data: your e-mail address and the content of messages you send us.
• Website data: technical data every website receives, and, only with your consent, statistics on how the website is used (section 13).

We collect this data from you and from your device. Apple provides some of it, for example sign-in details, purchase confirmations, crash reports and TestFlight feedback.

5. Where your data is stored

On your device. What you enter in our apps is stored on your device. Where an app labels data as “Yours” or says it stays on your device, that data is not sent to us; we cannot read or recover it. Your device’s backups (for example iCloud backup) can include it, under your Apple settings. Features such as widgets, watch apps, Siri and Shortcuts use this data on your own devices.

On our servers. When you use an online feature, the data that feature needs is sent to our servers. Our servers for app data are in the European Union.

With services you choose. If you connect an app to an Apple service such as Apple Health or Apple Calendar, or send a file through the share sheet, the data goes to that service or recipient under your control.

6. Why we use data

We use personal data only to:

• provide the apps, the website and the features you use, including your account, sync, sharing and AI features;
• process purchases and give you what you paid for;
• keep our services secure and prevent abuse;
• find and fix errors and improve our services;
• answer your messages and support requests;
• meet our legal obligations.

7. Health and fitness data

Health data is a special category of personal data. We process it on our servers or send it to an AI feature only with your explicit consent, which the app asks for before the first time. Apple Health data is read or written only for the types you allow in Apple’s permission screen. We never use health data for advertising and never sell it. You can withdraw your consent in the app or by writing to us.

8. AI features

Some apps offer AI features. An AI request is sent only when you use such a feature, and only with the content the feature needs to answer you. Requests go through our servers to our AI provider, Anthropic, without your account details. Anthropic processes them on our behalf, does not use them to train its models and deletes them within 30 days. We do not store the photos or texts you send to AI features; we keep only records about the requests, such as their number and time, to apply limits and allowances. AI answers are estimates and not professional advice.

9. Legal bases

• Providing the apps, accounts, sync, sharing, purchases and the features you use: performance of a contract, Art. 6(1)(b).
• Health data on our servers or in AI features; optional features you agree to: consent, Art. 6(1)(a) and, for health data, Art. 9(2)(a).
• Security, abuse prevention, server logs, error reports, keeping purchase records after account deletion: legitimate interests, Art. 6(1)(f).
• Answering your messages: legitimate interests, Art. 6(1)(f), or steps before a contract, Art. 6(1)(b).
• Website statistics: consent, Art. 6(1)(a).
• Records we must keep by law: legal obligation, Art. 6(1)(c).

Where we rely on legitimate interests, our interest is a secure, working service that is not abused. You can object to this processing (section 15).

10. Who receives data

We share personal data only with:

• Service providers that process data for us under a data processing agreement:
  • Supabase: databases, file storage, sign-in and server functions (data stored in the EU);
  • Anthropic: AI features (United States);
  • Apple: App Store purchases, sign-in, push notifications, app security checks, crash reports and TestFlight;
  • Google: website statistics, only with your consent;
  • our web host: the website and e-mail (Croatia).
• Other users, only the data you choose to share with them, for example in a shared space or on a leaderboard.
• Independent services you use through an app, for example a public food database the app looks up when you scan a barcode. They receive only the lookup and their own privacy policies apply.
• Authorities, when the law requires it.

Our service providers may use the data only to provide their service to us, and must protect it at least as well as this policy describes.

11. Transfers outside the EU

Some providers process data outside the European Union, mainly in the United States. We use only transfers that the GDPR allows: the European Commission’s adequacy decision for the EU–U.S. Data Privacy Framework for certified companies, or the European Commission’s Standard Contractual Clauses.

12. How long we keep data

We keep personal data only as long as we need it for the purpose it was collected for:

• Data on your device: until you delete it or the app.
• Your account and the data synced to it: until you delete the account.
• Photos and texts sent to AI features: not stored by us; deleted by Anthropic within 30 days.
• Technical details linked to your account, such as app version, security keys and request counters: until you delete the account.
• Server logs and error reports: a short period, at most 90 days, unless we need them to investigate an incident.
• Purchase records: while the account exists; afterwards only the records needed to prevent a purchase from being claimed twice, without your name or contact details.
• Messages you send us: as long as needed to answer and follow up.
• Website statistics: at most 14 months.
• Server backups: until the backup expires, about 7 days.

Records we must keep by law, for example for accounting, are kept for the period the law sets.

13. Website and cookies

Our web host receives the technical data every website receives, such as your IP address, browser and the page you asked for, to deliver the website and keep it secure; its security service sets a strictly necessary cookie. The cookie banner stores your choice in a functional cookie.

With your consent, the website uses Google Analytics to count visits and see which pages people read. It runs only if you accept statistics cookies, and you can change your choice at any time through “Manage consent”. Google Analytics does not store your IP address. We have turned off data sharing with other Google services and do not use Analytics for advertising. All cookies are listed in our Cookie Policy.

14. Your choices and deleting data

• Online features are either started by you, asked for first, or can be turned off in the app.
• Deleting your account: every app with an account lets you delete it in its settings. This deletes the account and the data synced to it. Content you shared into a space with other people stays there without your name, so it keeps working for them.
• Apps without an account: delete the data with the app’s erase option or by deleting the app.
• Subscriptions are managed by Apple; deleting your account does not cancel them. Cancel them in iOS Settings under your Apple Account.
• Consent can be withdrawn at any time in the app, in the cookie banner or by writing to us. Withdrawal does not affect processing that happened before it.

You do not have to give us any personal data. Without it, online features such as an account, sync, sharing and AI features do not work, but the rest of the app does.

15. Your rights

Under the GDPR you have the right to access your personal data, to have it corrected or deleted, to restrict its processing, to receive it in a portable format, to object to processing based on legitimate interests, and to withdraw consent at any time.

Write to privacy@miksoncore.com. We answer within one month. We may ask for details that let us find your account, and no more than that.

You also have the right to lodge a complaint with a data protection authority. In Croatia this is the Agencija za zaštitu osobnih podataka (AZOP), azop.hr. You can also complain in the EU country where you live or work.

16. What we do not do

• We do not sell or rent personal data.
• Our apps show no advertising and do not track you across other companies’ apps or websites.
• We do not combine your data with data from other sources to build a profile of you.
• We do not make decisions about you based solely on automated processing, including profiling, that have legal or similarly significant effects.

17. Children

Our apps and services are not directed at children under 13, or under the minimum age set by local law (16 in Croatia and some other EU countries). We do not knowingly collect personal data from children. If we learn that we have, we delete it.

18. Security

We protect personal data with technical and organisational measures: encrypted connections, encrypted storage on our servers, access rules that let each account reach only its own data and what others shared with it, and access to our systems limited to us. Data that stays on your device is protected by your device’s own security.

19. Changes to this policy

When we change how we handle personal data, we update this policy before the change takes effect and change the date at the top. For important changes we also tell you in the app.