Privacy policy

1Who is responsible

MileMori is run by its operator (“we”, “us”). The operator decides how the data described here is used and is the data controller under the EU General Data Protection Regulation (GDPR) and Türkiye’s Personal Data Protection Law No. 6698 (KVKK).

Write to us about anything on this page, including the rights described below. We answer within 30 days.

2What stays on your device

MileMori works without an account. What you create is stored on your device: in your browser’s own storage on the web, and in the app’s database on your phone. That includes:

• the name you want to be called, your birth date and the country you live in;
• your road: its start and end places and the route drawn between them;
• goals, steps, day records (your mood, your note, and the sleep, movement and smoke-free marks you choose to keep), memories, letters to the future, habits and programs;
• your life horizon survey answers — such as height and weight, smoking, alcohol, exercise, diet, sleep, stress, ongoing conditions and long life in the family — with the factor details and your horizon over time;
• seals, streaks, Rest Days, Marks, Finds and emblems;
• settings such as language, theme, gentle mode, grief mode and reminder time.

Voice notes for memories are recorded only when you press record. They stay on the device: they are not synced and are not in the backup file.

Apple Health and Health Connect (phone only). If you connect them, MileMori reads today’s step total when you ask for it and shows it to you. It does not keep the number, never writes to your health app, never reads in the background and never sends your steps anywhere.

Reminders and the home-screen widget are prepared on the device. They show your small step and your lamp — never your notes, mood, survey answers or life horizon.

Anyone who can open your device or browser profile can see this data. Clearing the site’s data in your browser, or removing the app, deletes it unless you have a backup.

3An account, if you want one

You need an account only for cloud backup, companions, caravans and invitations. When you create one, we keep:

• the username you choose — the people you connect with see it;
• your password, only as a salted scrypt hash, never in readable form;
• an email address, only if you add one, to verify it and to reset your password;
• when the account was created, and whether you have given cloud backup permission;
• your sign-in sessions: a random key, valid for 30 days or until you sign out.

On the web the session key is kept in a secure cookie that page scripts cannot read; in the app it is kept in the phone’s secure store. It is the only cookie MileMori sets, and it exists only to keep you signed in. We set no advertising or analytics cookies.

4Cloud backup, only with your permission

Cloud backup stays off until you turn on “Account backup permission”. Because day records and the horizon can say something about your health, we ask for this as your explicit consent.

With backup on, these are copied to our database so that your devices stay in step: your name, birth date and country; your road with its places and coordinates, and your horizon’s representative range; goals, steps, day records (with mood, note and the sleep, movement and smoke-free marks), memories, letters, habits and programs; your rewards and streak record; and your settings.

Never copied: your survey answers and factor details, your route history, voice notes, step counts from your health app, and your choice about usage counts.

Each change carries a version number, so two devices never silently overwrite each other. The history of changes stays with your account until you withdraw permission or delete the account.

Turning the permission off erases the cloud copy at once, change history included. The copy on your device stays.

The backup travels over encrypted connections and is stored by our database provider, named below, which encrypts its storage. We do not add a separate layer of encryption of our own, so the backup is not end-to-end encrypted.

Cloud backup is for people aged 18 and over: the server refuses a profile under 18, and a profile without a birth date is not sent.

5Companions, caravans and invitations

These need an account and work only between people who chose each other through an invitation. There is no public profile, feed or follower list, and no live location.

What another member can see: your username; whether your lamp is lit on a given day; the cheers and waves you send; and — only if you turn on “Share my milestones with this caravan” — a streak band such as “7+” and your metal tier. Your time zone offset tells the server when your day has ended and is shown to no one. Your notes, moods, survey answers, health details and life horizon have no field to travel in.

In a caravan’s plans, the titles, notes, date and place options, votes, replies and shared memories you add are visible to that caravan’s members.

Invitation links: companion invitations expire after 7 days; caravan links after 7, 14 or 30 days, as the member who makes them chooses; your personal link works until you replace it. Anyone who opens one of your links sees your username — for a caravan, also its name and real member count — and so does the preview image a messaging app shows. The caravan’s streak appears there only if the caravan turned it on and every member agreed.

When someone joins through your personal link, we record which link and which channel it came through (such as WhatsApp or a QR code) and count their first three sealed days, so that you receive what an invitation earns: card finishes, a mark in Me and, once three friends are on the road, the right to found one more caravan. You see counts, never their records. These rewards have no cash value.

A worldwide count of lit lamps is shown only when at least 50 people are behind it.

Blocking hides a person from you, and you from them, until you unblock them. A report goes to MileMori’s moderators with the reason you give. If you delete your account, your reports stay for moderation but no longer name you or keep your reason.

6Notifications

Reminders are scheduled on your device, and only after you allow them. On the web they arrive only while MileMori is open.

Notifications about friends are sent by our server. They are off by default on every device. If you turn one on, the device sends exactly this: the push address of that device (from your browser’s push service, Firebase Cloud Messaging on Android or the Apple Push Notification service on iPhone), the kinds you turned on, your time zone, your reminder time, your language, and two yes-or-no values worked out on the device — whether you are under 18 or have not given your age, and whether gentle mode, grief mode or friends are off. Nothing else. If nothing could ever be sent to you, the server does not keep the registration.

The words of such a notification — for example that a friend sealed their day, with their username — pass through that push service (Apple, Google, Mozilla or Microsoft) to reach you. The registration ends when you turn it off, sign out or delete your account. A record of which kind was sent on which day is kept for 60 days, so that no one is notified twice.

Under 18, or with no age given: no notifications about friends at all, and reminders no later than 20:00.

7Usage counts, only if you say yes

“Share anonymous usage counts” is off until you turn it on, separately on each device. If you do, the device sends once a day counts of what happened in the app, from a fixed list — for example that a day was sealed, a reward played or a share card was made — with ranges instead of exact numbers (a streak as “7–13”, a reminder as a part of the day).

Each daily packet carries a random identifier used only to count it once. It is not linked to your account, it is replaced every 30 days, and the server keeps it only as a one-way fingerprint for 60 days. What the server keeps are totals per day, platform and install-age range — nothing per person.

The list has no field for notes, titles, moods, survey answers, health, age, life horizon, places, names or email addresses, and the server rejects any packet that tries to carry one. Turning counts off deletes the counts still waiting on the device.

MileMori has no advertising, no third-party analytics or tracking tools and no fingerprinting. We never sell or rent personal data.

8The thinking space

In the thinking space, “Talk to my companion” is written by an AI service, and only when that service is switched on for MileMori; the planning guide beside it works without it. Asking needs an account, and nothing is sent until you press the button.

When it is on, what you write (up to 1,000 characters) is sent from our server to the AI provider named in the list below — together with, only if you tick them, the goal and next step you are working on and your last seven days’ step results. Your survey answers, health details, horizon and day notes are not sent. We count requests per day to keep a limit of 10; we do not store the conversation.

MileMori does not save your conversation. OpenAI may retain messages and replies for abuse monitoring for up to 30 days under its standard settings. Longer retention may apply when required by law or to protect OpenAI’s services or others from harm.

Goal ideas are researched only after you allow a send. OpenAI receives the age range derived from the age you type, your typed city or broad region, your interests, and the app language, and may use them to search public web sources. Your birth date, road, health, and other profile records are not sent; your device location is not read. MileMori does not store research requests or replies; it keeps only the shared daily request count. An idea is saved as a goal only when you choose it and save the editable draft.

If you choose to report a reply, MileMori keeps only that reply and your optional note for moderation for up to 30 days. Reports are included in your account data export and are deleted when you delete your account.

9Maps and places

The map is drawn from MileMori’s own map files. The detailed map, when it is switched on, comes from our own storage at Cloudflare and is delivered through Cloudflare’s network; the simpler world atlas comes from our web server. Like any web request, loading an area of the map shows the server that answers your IP address and which area you are looking at. It never receives your searches or your account.

When place search is switched on, finding a place goes through our server to Geoapify, named in the list below: the suggestions that appear as you type, a search, and the place under a point you pick on the map. Drawing a road along real roads goes the same way, and only when you press the button for it.

When you open your road, we may look up the area around its calculated marker. This is a point on your life road, not your device location. Only its rounded coordinates and the app language are sent through our server to the place service; your birth date, survey answers and account details are not included.

Geoapify receives the text you typed, the language of the app and, where one is needed, a coordinate rounded to about 100 metres or coarser. The request comes from our server, not from your device, so Geoapify never sees your IP address, your account, your records or anything that identifies your device.

What you type can be precise — a street, or even your home address. You choose how much detail to keep: after picking a result you can keep its street, or step up to its neighbourhood, district, town, region or country. Less detail means more privacy. A house number is never kept: a result that has one is kept as its street.

What is kept is the place you chose: its name, the depth you chose, the larger places around it, its country and which service found it, with coordinates rounded to at most three decimal places (about 110 metres). The exact point you picked on the map is not kept.

Geoapify keeps its request records, including the text of a search, for 24 hours, and for up to two months when it looks into suspected fraud. Our server keeps answers for everyone to reuse, for up to 30 days and without any link to you. A search that contains a digit, the place under a point finer than a town, and a road whose two ends are both finer than a town are never written to our database.

MileMori never reads your device’s location. The map shows the places you choose and nearby places around the calculated point on your road.

10Email

If you add an email address, and email is switched on for MileMori, we send exactly two kinds of message through Resend: a link to verify the address (valid for 24 hours) and a password reset link (valid for 30 minutes). No newsletters and no marketing.

Email you write to our address passes through Cloudflare Email Routing, which forwards it to the operator’s mailbox; we use it only to answer you.

11Purchases

When MileMori Plus is offered in the App Store or Google Play, the store takes the payment; we never see your card. To confirm a purchase, our server receives the store’s signed transaction or purchase token and keeps what it needs to know that Plus is active: the product, its status and its renewal date.

Deleting your MileMori account does not cancel a store subscription. Cancel it in your App Store or Google Play subscription settings.

12The backup file you download

“Download my backup” saves a complete copy of your profile as a file — including your survey answers, so that your horizon comes back whole when you restore it. The file is in your hands: keep it somewhere safe and think before sharing it. Voice notes are not in it.

13The life horizon

The life horizon is calculated on your device from public life tables (the UN World Population Prospects 2024; TÜİK for Türkiye) and published hazard ratios. It is a representative range for people who answer as you did — not a medical assessment and not a prediction about you.

Its survey answers stay on your device. The horizon never appears in rewards, share cards, notifications, widgets or anything another person sees.

14Who handles data for us

These companies process data on our behalf, only for the purposes described on this page:

Apple Health and Health Connect run on your phone; MileMori sends them nothing and receives from them only today’s step total, which stays on the device.

15Where your data is

Our server and our database are in Frankfurt, Germany, and place search, when switched on, uses Geoapify’s service in the European Union. Web pages and map files are delivered through global networks, so a request may be answered from a location near you. Notifications pass through Apple’s, Google’s or your browser maker’s services; email we send passes through Resend in the United States, and email you send us through Cloudflare’s network. Where this takes data outside Türkiye or the European Economic Area, it goes only to the providers above and only for the purposes described here.

16Why we may use it

• Your account, companions, caravans, invitations, purchases, and the place searches and roads you ask for: to provide the service you asked for (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)).
• Cloud backup of records that can reveal something about your health: your explicit consent (GDPR Art. 9(2)(a); KVKK Art. 6), which you can withdraw in Me at any time.
• Usage counts and notifications about friends: your consent (GDPR Art. 6(1)(a); KVKK Art. 5(1)), which you can withdraw in Me at any time.
• Security — rate limits, sign-in protection and error records without personal content: our legitimate interest in keeping the service safe (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)).
• Answering your requests and keeping the records the law requires: our legal obligations (GDPR Art. 6(1)(c); KVKK Art. 5(2)(ç)).

17How long we keep it

Deleted data can remain in our database provider’s restore copies until they expire, and is not used in the meantime. Server error records contain no personal content: no message text, email address or web address.

18Your rights

Under the GDPR and Article 11 of KVKK you can ask whether we process your data and for what purpose; get a copy; have it corrected or deleted; restrict or object to its use; take it with you; withdraw your consent; learn who we transfer it to; and object to a result reached solely by automated processing. You can also complain to a supervisory authority — in Türkiye the Personal Data Protection Authority (KVKK), in the EU the authority where you live.

Most of this you can do yourself, at once:

• See and correct: everything you wrote can be edited where you wrote it.
• Take a copy: “Download my backup” in Me → Account and data on the web, or My data and backup in the app.
• Take a copy of what the server keeps: “Download what the server keeps” in Me → Account and data, on the web and in the app — your account, memberships, lamps, invitations, notification devices and cloud backup, as one file.
• Withdraw cloud backup: turn off “Account backup permission” — the cloud copy is erased at once.
• Stop usage counts or notifications: switch them off in Me.
• Delete: see “Delete your account”.

For anything else — a request you cannot make in the app — write to the contact address above.

Delete your account

19Children and teenagers

MileMori is meant for adults. The life horizon survey accepts ages 18 to 100, and cloud backup refuses a profile under 18.

Making an account asks you to confirm that you are 18 or older. We do not ask for proof of age, so the app on your device protects anyone who gives a birth date under 18, or has not given one yet: reminders come no later than 20:00, there are no notifications about friends, and sharing is never suggested after a reward.

If you are a parent or guardian and believe a child has given us data through an account, write to us and we will delete it.

20Security

Connections are encrypted: HTTPS to our server, and verified TLS from our server to the database. Passwords are stored only as hashes, sign-in attempts are limited, and session cookies cannot be read by page scripts. No system is perfectly secure; if a breach affects your data, we will tell you and the authorities as the law requires.

21The earlier MileMori

The earlier MileMori’s server accounts were closed on 29 September 2026; their data is scheduled for deletion.

Data the earlier site kept in your browser is removed by “Delete my profile on this device” in Me → Account and data.

To ask what an earlier account held, or to ask for its deletion sooner, write to the contact address on this page.

22Changes to this policy

When this policy changes, the date at the top changes. If a change affects what we collect or why, we will say so in the app before it takes effect.

Terms of useDelete your account