miwuu privacy policy
Version 1.0 · In force from 4 November 2026
Summary
- We use your data so you can meet people nearby and to keep miwuu safe.
- The most personal data (intimate side, sexual health, origin, beliefs and who you're looking for) only with your express permission, which you can withdraw whenever you want.
- No ads, no selling of data and no sharing it for advertising.
- Others see you ~600 m from your real position.
- You have the right to see, correct, take away and delete your data.
If you live in Washington, Nevada or Connecticut, also read the Health data policy.
1. Who is responsible for your data
Controller: Oscar Sanchez Medina (NIF 38837289H), trade name miwuu.
Address: Carrer de Pablo Picasso, 21, 6 1, 08304 Mataró, Spain
- Privacy email: privacy@miwuu.com
This policy applies to the miwuu app, to miwuu.com and to the emails and notifications we send you. This website keeps the technical access logs generated by the hosting (such as the IP address) and uses Cloudflare Turnstile on the image removal form to prevent abuse.
2. What data we handle
What you give us:
- Account: email, password (stored encrypted; we don't see it) or your Google account, date of birth and the confirmation that you are 18 or over (with date and time).
- Profile: name, photos, About me, answers to My questions, how you identify, what you're looking for now, Basics (height, education, children, alcohol, smoking, sport), How I live relationships, More about you (occupation, languages, personality, style, diet, pets), interests and meeting place.
- Protected data, only with your permission: see point 3.
- Precise location: the one you choose (GPS position, with your permission, or a street, neighbourhood or city you type in).
- Messages: the text of your conversations (the chat doesn't allow sending photos, audio or video; only sharing your private album of up to 6 photos already reviewed).
- Sintonía: your answers to the daily game.
- App usage (only if you allow it): which screens you open and which buttons you tap, counted on the phone and sent in anonymous packages, without your account or your phone. They don't include messages, photos, intimate data, filters or location. Also, with no data about anyone in particular, every night we count app totals (sign-ups, likes, matches, messages, purchases, retention) from the data we already have.
- Reports and contacts with support: what you tell us and what you attach.
- Removal requests from the website (without an account): your name if you give it, your email, your signature, where the image is and what you tell us.
- Purchases: which plan, pass or pack you buy and when. Payment details (card) are handled by Google Play; we don't see them.
What is generated when you use miwuu:
- likes, matches, profiles seen, blocks, filters you use and credits;
- technical data: phone model, system and app version, language, IP address, token to send you notifications. The app doesn't send error reports;
- record of your permissions: what you accepted, with which text (version) and when.
What we receive from others:
- Google, if you sign in with your Google account: email and identifier. Nothing else.
- Google Play and RevenueCat: the status of your purchases and subscriptions.
- Other people: if they report you, what they say about you.
What is required: the email (or your Google account), the date of birth, the name, at least one photo and a location are needed to have an account; without them we can't offer you the service. Everything else is optional.
What we don't do: we don't use facial recognition or create biometric templates of your face; we don't infer your origin, orientation, health or religion from your photos or your activity; if someone reports a chat, the team only sees the reported conversation (also the hidden 90-day copy if the match was undone).
3. Specially protected data
Some data says a lot about you and the law protects it more (GDPR art. 9 and the laws of several US states). On miwuu:
| Data | What for | Who sees it | How you control it |
|---|---|---|---|
| Who you're looking for (may reveal your orientation) | Showing you profiles of people you're interested in | It doesn't appear on your profile | Settings › Privacy and protected data › Who to meet |
| Your intimate side (sexual orientation, what you're like in intimacy, your tastes, role, type of encounter, in a group, casual encounters, your limits) | Showing it to whoever you choose; if you make it public, people also find you in the filters | Whoever you choose: everyone, only my matches, only in chats I choose or nobody | Settings › Privacy and protected data › Your intimate side |
| Sexual health (how you protect yourself, PrEP, tests, vaccines) | Showing it to whoever sees your intimate side | Whoever sees your intimate side | Settings › Privacy and protected data › Sexual health (its own double permission: store and show) |
| Origin (nationality, country of birth, ethnicity) | Showing it and, if everyone sees it, letting it count in the filters | Whoever you choose: everyone, your matches or nobody | Settings › Privacy and protected data › Origin |
| Beliefs | Same as origin | Whoever you choose | Settings › Privacy and protected data › Beliefs |
| Sensual answers in Sintonía (if you turn those questions on) | Working out matches (how many you have in common); they only count with people who have also turned them on; your individual answers aren't shown and don't appear in the blind detail, suggested messages or what you share | They aren't shown | Settings › Notifications › Sintonía |
Our commitments with this data:
- Only with your express permission, in an empty box that you tick, separate from the Terms. Without that permission it isn't stored.
- Only for what each permission says. We don't use it for advertising or to profile you for other purposes, and we don't sell it.
- We don't share it with third parties, except the hosting provider, which stores it on our behalf (as a processor, under contract), or if a law requires us to.
- It doesn't go to analytics systems or error reports.
- It is kept in separate tables with restricted access.
- Withdrawing the permission removes it from the app instantly.
- It only counts in the filters if you show it to everyone (origin, beliefs and intimate side). People who don't state it aren't excluded.
Data that may reveal something sensitive without that being its purpose. Some visible options on your profile, such as certain diets (Halal, Kosher, Gluten-free, Lactose-free), some Style labels or your limits, may hint at your religion, your health or your orientation. They are optional: if you don't want them seen, don't fill them in. By choosing them, you choose to show them.
4. What we use it for and on what legal basis
| What for | Data | Legal basis (GDPR) |
|---|---|---|
| Creating and keeping your account | Account | Contract (art. 6.1.b) |
| Checking that you are 18 or over | Date of birth, declaration, app store age signal | Contract and legitimate interest (protecting minors); in some US states, legal obligation |
| Showing your profile and showing you profiles | Profile, shifted location, filters, likes | Contract |
| Showing and filtering by protected data | Those in point 3 | Explicit consent (art. 9.2.a) |
| Ordering profiles (including the priority of people with a plan or pass) | Activity, active plan or pass | Contract |
| Chat and Sintonía | Messages, answers | Contract; sensual answers: explicit consent |
| Notifications (matches, messages, likes, Sintonía) | Notification token, preferences | Consent (system permission) and contract |
| Measuring usage to improve the app | Anonymous counts of screens and buttons | Consent (Settings › Privacy and protected data); the nightly totals, legitimate interest (no data about specific people) |
| Purchases and credits | Purchases | Contract; retention by legal obligation |
| Reviewing photos, handling reports, blocking and preventing fraud and fake accounts | Profile, photos, reports, technical data, reported messages | Legitimate interest (people's safety) and legal obligation (DSA). If a report contains protected data: defence against claims (art. 9.2.f) or vital interests (art. 9.2.c) |
| Handling removal requests for intimate images (in the app or on the website) | The request's data, the image and what you tell us | Legal obligation (DSA, art. 16, and your right to erasure, GDPR art. 17) and legitimate interest (complying with the US TAKE IT DOWN Act). If the image or what you tell us reveals intimate or health data, we process it only to handle your request and defend it against claims (GDPR art. 9.2.f): only Moderation sees it and it is deleted as set out in point 8 |
| Keeping proof of your permissions | Permission record | Legitimate interest and defence against claims (we must be able to prove your consent) |
| Answering you in support | What you write to us | Contract and legitimate interest |
| Fixing bugs and improving the app | Technical data and aggregated statistics | Legitimate interest |
| Complying with the law and defending ourselves | What is needed in each case | Legal obligation and legitimate interest |
When we rely on legitimate interest, we have checked that it doesn't outweigh your rights. You can object by writing to us (point 9).
5. Who sees your data
- People on miwuu see your public profile (name, age, photos, city and approximate distance, and whatever you have filled in) and your protected data as you choose.
- If you like someone, that person can see a heavily blurred version of your main photo, without your name or age, until they answer.
- Your dot is shifted by about 600 m: we don't show your exact position.
- Your messages are seen by the two people in the conversation. If someone reports a conversation, they share their copy with the moderation team, which reads it to decide; the team doesn't access the other conversations.
- Sintonía matches show how many answers you have in common, not your individual answers. We don't give any compatibility percentage. Before you choose each other, only the 3 rarest matches are shown, without sensual answers that would let anyone work out yours. With a plan or a pass, Discover can be sorted by the week's Sintonía (how many answers you have in common).
- What isn't shown: who you're looking for, your email, your date of birth (only your age), your real position.
6. Who we share it with
We don't sell your data or share it for advertising.
Processors (they can only use your data to provide their service to us, under contract):
| Who | What for | Where |
|---|---|---|
| Supabase | Hosting the database, photos and authentication | EU (Ireland) |
| Google (Firebase Cloud Messaging) | Sending notifications to your phone (without protected data) | EU and US |
| RevenueCat | Knowing which plan or purchase you have | US |
| Resend | Sending the emails of your account and the notices | With the safeguards the law requires |
The miwuu.com website and our email use Cloudflare (hosting of the website, Turnstile on the image removal form and forwarding of the emails sent to privacy@miwuu.com and support@miwuu.com), and those emails arrive in a mailbox managed with Google.
The protected data in point 3 is only handled by Supabase (hosting).
Independent controllers (they handle data under their own policies, which we recommend you read):
| Who | What for |
|---|---|
| Google Play | Charging purchases and managing subscriptions and refunds |
| Google (sign-in) | Signing in with your Google account |
| Google Maps (Google) | Drawing the Discover map. It receives the area of the map you look at and your phone's IP address, like any map on the internet. We don't send it the exact location of any person: profiles appear at their approximate position, and the dot showing where you are is drawn by your own phone. Google processes that data on its own account, under its own privacy policy |
| The phone's geocoder | Turning your position into an address, on your own phone |
We may also share data:
- with authorities, when a law or a court order requires it, or to protect someone's life or safety;
- with the competent authorities, to whom we may report child sexual abuse when the law requires it;
- with a buyer, if miwuu is sold or merged; this policy will keep protecting your data.
7. Transfers outside the European Economic Area
Some providers handle data in the US. We do so with safeguards: the EU-US Data Privacy Framework when the provider is certified, or the European Commission's standard contractual clauses. Cloudflare, which as our processor checks the captcha (Turnstile) only on the image removal form of miwuu.com, is certified under that Framework. You can ask us for a copy at privacy@miwuu.com.
8. How long we keep it
| Data | How long |
|---|---|
| Profile, photos, messages, likes, passes, blocks and matches | While you have the account. |
| Protected data | Until you withdraw the permission or delete the account |
| Sintonía answers and chat challenge answers (challenges don't count as your game of the day nor for your streak) | 7 days |
| Anonymous usage packages | 7 days; after that only the totals remain, which identify no one |
| Messages in a chat when the match is undone, when blocking or when deleting the account | They disappear for both people at once; we keep an encrypted copy for 90 days, which Moderation only sees if a report arrives, and then it is deleted (also if the other person blocks you or deletes their account) |
| Encrypted fingerprint of a minor’s email | 1 year if Moderation detects it; if they registered as a minor, until they turn 18 |
| Data of accounts banned for breaking the rules | 6 months from closure (the appeal period); in serious cases (child abuse, violence), whatever the law requires |
| Reports and their evidence | Until they are resolved and 1 more year (appeals and claims) |
| Removal requests | The request’s data while it is being handled; the fingerprint of the removed image, to block identical copies |
| Permission record | While you have the account, including the permissions you withdrew. When you delete it, the proof of each permission (what it was for, with which text and when you gave or withdrew it) is kept for 3 years in pseudonymised form, without your name, your email or your account, and is then deleted automatically (proof of consent) |
| Unfinished sign-ups (you started registering and didn't finish) | 30 days; then they are deleted automatically, with any photos you had uploaded |
| Token to send you notifications | Deleted if it hasn't been renewed for 30 days and you have no open session, after 270 days without being renewed in any case, and when the account is closed or suspended |
| Technical data and access logs (such as the IP address) | The IP address of your session, while the session is open; the logs of our hosting providers, according to each provider's period |
9. Your rights
You can, at any time and free of charge:
- Access your data and take it with you in a file (portability).
- Correct it: almost everything can be changed from your profile.
- Delete it: delete your account in Settings, ask us, or do it without opening the app at miwuu.com/en/borrar-cuenta.
- Withdraw a permission: from Settings › Privacy and protected data › Data permissions, or from the "Who sees it?" sheet of each item on your profile, with "Withdraw my permission". Withdrawing it doesn't affect what was done before.
- Object to what we do based on legitimate interest, and restrict the use of your data while a claim is resolved.
- Not be subject to solely automated decisions with significant effects (point 11).
How: write to privacy@miwuu.com from your account's email, or from Settings › Help and contact. We may ask you to confirm it's you. We send you the copy of your data in a common file format (JSON or CSV).
10. Rights in the United States
Depending on your state (California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, Virginia and others), you have the right to:
- know what data we hold and get a copy;
- correct and delete it;
- not be subject to the sale of data, targeted advertising or profiling with significant effects: we don't do any of these things, so you don't need to ask;
- give or refuse your permission for sensitive data (we ask for it with a box);
- in California, limit the use of sensitive data: we only use it for what you asked;
- not be discriminated against for exercising your rights.
How: write to privacy@miwuu.com with the subject "Privacy Request". You can use an authorised agent.
Appeal: if we refuse your request, you can appeal by writing with the subject "Privacy Request Appeal". If you still disagree, you can contact your state's Attorney General.
Health data: Washington, Nevada and Connecticut have their own rules. See the Health data policy.
Categories (California): we handle identifiers, account data, protected characteristics (age, gender, orientation, origin, religion, if you give us permission), commercial information (purchases), in-app activity, precise location (with your permission), message content and sensitive data with permission. We don't sell or share your personal information.
11. Automated decisions
- Order of profiles: an automated system decides the order in which you see profiles (distance, filters, activity, active plan or pass). It has no legal effects on you. We explain it in "How do we order profiles?".
- Photo review: done by a person on the moderation team.
- Reports: if a profile is reported by 2 different people, it is suspended automatically (it stops being shown), because two independent reports point to a risk for other people (only independent reporters count).
- Anti-abuse limits (speed brake, daily caps): automatic, to protect the service.
12. Security
If a security breach happens, we notify the authority and, if it poses a high risk to you, we tell you too.
13. Minors
miwuu is only for people aged 18 and over. We don't allow minors, we don't knowingly handle their data and we close a minor's account when we find out. If you see someone who looks underage, report them from their profile.
14. Your phone: permissions and storage
- Location: we ask for it with an explanation first and only while you use the app. You can remove it in your phone's settings and type your location by hand.
- Notifications: to tell you about matches, messages and likes. You can choose which ones in Settings › Notifications or turn them off on your phone.
- Usage measurement: with your permission, the phone keeps the counts until it sends them (every 50 or when you leave the app). If you switch it off, they are erased.
- Photos: only the ones you choose.
- Phone storage: we keep on your phone what the app needs to work quickly (session, profiles already loaded today, preferences). We don't use cookies or advertising identifiers.
15. Changes to this policy
The current version is the one published here with its date.
16. Contact and complaints
If you're not satisfied with our answer, you can complain to the Spanish Data Protection Agency (www.aepd.es) or the authority of your EU country. In the US, to your state's Attorney General or the FTC.