Effective date: 27 August 2026 · Last updated: 3 October 2026 Applies to: the Miyu mobile app and the website at askmiyu.com.
The rest of this policy explains each of these in full.
Miyu ("Miyu", "we", "us") is a personal care decision assistant operated by Ritika Chauhan (sole proprietor), based in Delhi, India.
Under India's Digital Personal Data Protection Act, 2023 (the "DPDP Act"), we are the Data Fiduciary for your personal data — meaning we decide what data is collected and why, and we are responsible for protecting it. You are the Data Principal — the person the data is about, with rights over it.
Contact / Grievance Officer: Ritika Chauhan, care@askmiyu.com (see Section 12).
We collect only what we need to run Miyu:
a) Account information - Your email address and profile photo, received when you sign in with Google.
b) Basic details you give us at sign-up - Your name, gender, and age band. These are used for analytics and to personalise your experience. You must be 18 or older to use Miyu.
c) What you ask Miyu - The messages you type, and — if you use voice — the audio you speak, which is turned into text so Miyu can understand you.
d) Preferences Miyu remembers - Things you tell Miyu in conversation (for example, your skin type, hair type, concerns, or budget). Miyu remembers these so it can give better recommendations across sessions.
e) Your activity in the app - Products you save, your ratings and notes on them, your thumbs up/down feedback and any comments, and which recommendations you viewed or tapped.
f) Technical and security information - A scrambled (hashed) version of your device's IP address and limited technical information, used to keep the service secure and prevent abuse. We do not store your raw IP address in your profile.
g) Photographs you take with the ingredient scanner - When you scan a product, the photograph of its ingredients panel is sent to Google Cloud Vision (United States) to turn the printed label into text. - We never save the photograph. It is not stored on our servers, not attached to your account, and not kept after the reading finishes. Only the ingredient names that were read are used, and only to produce the answer shown on your screen. - We record the fact that a scan happened, how many photographs it used and how well it read — numbers only, never the image and never the label text.
h) How the app is behaving - Anonymous usage events (which screens you open, which features you use), crash reports, and session recordings of your screen, which we use to find bugs and confusing screens. - These go to PostHog, on their European servers. - If the Android app crashes or freezes, a crash report goes to Google Firebase Crashlytics (United States): the device model, Android version, app version, and the technical record of what failed. It does not include your messages, photos or profile. - ⚠️ In the recordings, everything you type is masked, and every image is masked — including anything in the camera view. What is visible is the shape of the screen and where you tapped, not your words or your photographs.
We do not collect: your passwords (sign-in is handled by Google), payment card details (Miyu has no in-app purchases), or precise location.
We use your information only to: - Provide the service — understand your question and give you recommendations, answers, comparisons, and shade suggestions. - Personalise your recommendations using the preferences you share. - Save and show the products and history you ask us to keep. - Improve quality — we look at feedback and aggregated usage to make Miyu better. (This is data-side analysis only; we do not train AI models on your personal data.) - Fix problems in individual conversations — a small number of authorised people on Miyu's team may read individual conversations, and the record of how Miyu answered them, to find and fix problems and to keep Miyu safe. Every such access is logged. This is never used for advertising. - Keep Miyu safe — detect and prevent abuse, spam, and misuse.
We will not use your personal data for a new, unrelated purpose without telling you and asking again.
Miyu is powered by AI, and being honest about this is part of how it works:
We share only what is needed for these features to work, and we do not sell this data.
We share your data only with service providers who help us run Miyu ("Data Processors"), and only for the purposes above:
| Provider | What they do | Where |
|---|---|---|
| Supabase | Stores your account and data (our database) | India (Mumbai) |
| DigitalOcean | Runs the Miyu server | India (Bengaluru) |
| Sarvam AI | Converts your voice to text / reads replies | India |
| Google (Gemini) | Helps generate answers | United States |
| Anthropic (Claude) | Helps generate answers | United States |
| OpenAI | Helps generate answers | United States |
| Google Sign-In | Logs you in | (per Google's policy) |
| PostHog | App usage events, crash reports and masked session recordings (see §2 h) | European Union |
| Google Firebase Crashlytics | Crash reports from the Android app | United States |
| Grafana Labs | Monitoring dashboards and alerts: counts and timings only (e.g. “how many replies failed this hour”); later also server logs | India (Mumbai) |
| Better Stack | Server logs: technical records of requests (being replaced by Grafana) | Outside India (Better Stack's own servers) |
Affiliate links: when you tap a "buy" or product link, you leave Miyu and go to a retailer's site (e.g. Nykaa, Amazon, Myntra). We may earn a commission through an affiliate network (Cuelinks). We do not pass your Miyu profile to the retailer; standard web tracking on the retailer's own site is governed by their policy.
We do not sell your personal data, and we do not use it for advertising.
We may also disclose data if required by law, or to protect the safety and rights of Miyu and its users.
Your account and everything you tell Miyu are stored in India (Mumbai). Some information is processed outside India:
These transfers are permitted under the DPDP Act; we disclose them here so you know they happen.
To be clear and honest: Miyu is not "end-to-end encrypted." Because Miyu has to read your questions to answer them (and send the text to AI providers), your messages are not hidden from Miyu or those providers. We protect them with the safeguards above, but we will never claim a level of secrecy we don't actually provide.
No system is perfectly secure, but we take reasonable steps to protect your information.
Under the DPDP Act, you have the right to: - Access — ask what personal data we hold about you and how we use it. - Correct / update — fix or complete your information. - Delete (erasure) — delete your account and personal data. - Withdraw consent — stop us from processing your data going forward. - Grievance redressal — raise a concern and get a response (Section 12). - Nominate — nominate another person to exercise your rights if you are unable to.
How to use these rights: - Delete your account directly in the app: Profile → Settings → Delete my account. - Access or download your data, or withdraw your consent — email us at care@askmiyu.com and we will action your request. (Because Miyu needs your data to work, withdrawing consent will lead to deletion of your account.) - You can view this Privacy Policy any time inside the app.
We will respond within the time required by law.
Miyu is intended for users aged 18 and above. We do not knowingly collect data from anyone under 18. If you are under 18, please do not use Miyu. If we learn we have collected data from a minor, we will delete it.
If you have any question or complaint about your data, contact our Grievance Officer:
We will acknowledge and respond to your grievance within the period required under the DPDP Act and its Rules.
If you are not satisfied, you also have the right to complain to the Data Protection Board of India.
The Miyu app does not use cookies. The website (askmiyu.com) may use limited cookies for basic analytics; if so, you will see a notice there.
If we change how we handle your data (for example, if we add a new feature), we will update this policy and, where appropriate, ask for your consent again. We will show the new effective date at the top.
Questions about this policy or your data: Ritika Chauhan (sole proprietor), Delhi, India · care@askmiyu.com