Milie Privacy Policy

Effective date: October 13, 2026 · Last updated: October 14, 2026 · See also our Terms of Service

1. Who we are

Milie is operated by Stanislav Martin Babak, an individual doing business as Milie (“Milie,” “we,” “us”), 1490 Market Street Apt 218, San Jose, CA. This Privacy Policy explains how we collect, use, disclose, and keep personal information when you use the Milie mobile app and related services (the “Service”), and the choices and rights you have. Terms not defined here have the meaning given in our Terms of Service.

The Service is offered only to adults (18+) in the United States. Questions: support@milieai.com.

2. At a glance

3. Information we collect

3.1 Information you give us

• Account: email address, display name (older accounts may have a username), and password. We store only a salted hash of your password (created with scrypt), never the password itself. Accounts created with Apple or Google have no password.
• Goals and check-ins: each goal’s title, description, how you will prove it, and status, plus the dates you checked in.
• Coach conversations: the full text of your messages and the coach’s replies.
• Proof photos: photos you choose to attach. They are resized and re-encoded as JPEG on your phone before upload, which removes embedded metadata such as location.
• Stake settings: your stake amount and the history of changes to it.
• Messages to support: whatever you include when you email us.

Goals and messages are free-form text. If you choose to write about your health or other sensitive topics, that information will be stored and processed like the rest of your content. Please only share what you are comfortable with.

3.2 Information from third parties

• Apple and Google: if you use Sign in with Apple or Google Sign-In, we receive an account identifier and the email address (and possibly name) that service provides. With Apple, this may be a private-relay email address.
• Stripe: when you save a card through Stripe’s payment form, we receive a Stripe customer ID, a payment-method ID, and the card brand and last 4 digits, and for each charge, a payment ID, its status, and any failure code. You enter your full card details directly with Stripe.
• Your friends: when a friend adds you with your friend code or checks you in, we record that friendship and check-in.

3.3 Information created as you use the Service

• Your time zone (read from your device when you sign up or log in), an email-verified flag, the version of the Terms you accepted and when, your friend code, and your account creation date.
• Records of each missed-day charge: date, amount, status, Stripe payment ID, and any failure code.
• One-time email codes for verification and password resets (stored only as hashes; they expire after 10 minutes).
• A login token stored in your phone’s secure storage, valid for 30 days.
• Server logs kept by our hosting provider, Railway. Like any internet service, our servers receive technical information such as your IP address when the app connects, and logs may record it. Error logs may include limited personal information, such as an email address when an email fails to send.

4. Categories of personal information (CCPA)

California law asks us to describe our practices using specific categories. In the past 12 months we have collected the following. For each, we disclose it for business purposes only to the recipients listed, and we have not sold it or shared it for cross-context behavioral advertising.

We use sensitive personal information only to provide the Service you request, keep it secure, prevent fraud, and comply with law, and not to infer characteristics about you. We do not collect precise geolocation, biometric information, contacts, or government ID numbers, and we do not use photos to create facial-recognition templates or other biometric identifiers.

Retention by category: all of the categories above are kept while your account exists and erased when you delete your account, except as described in Section 13.

5. Device permissions and what we don’t collect

• Camera and photo library: used only when you choose to attach a proof photo.
• We do not access your location, contacts, or microphone, collect push-notification tokens or your advertising ID, or fingerprint your device.
• The app contains no analytics, crash-reporting, or advertising software development kits (SDKs).

6. How we use information

• To provide the Service: create and run your account, store your goals and check-ins, show your friends what is described in Section 10, and verify your email.
• To charge stakes: determine missed days and charge your saved card through Stripe, as described in the Terms.
• AI coaching: generate the coach’s replies and let it create goals and record check-ins (Section 7).
• Support and disputes: answer your requests, review charges you question, and respond to chargebacks with records such as your check-ins, stake settings, Terms acceptance, and relevant conversation excerpts.
• Safety, security, and fraud prevention: protect accounts, detect abuse (for example, fake accounts used to check yourself in), and enforce our Terms.
• Legal compliance: meet tax, accounting, and legal obligations and respond to lawful requests.
• Product improvement: using de-identified or aggregated information. We maintain de-identified information in de-identified form and do not attempt to re-identify it, except as the law allows.

We do not use your information for advertising, and we will not use it for materially different purposes without notifying you and, where required, getting your consent.

7. AI processing

Mil, the coach, is powered by a third-party large language model. The provider we use today is Anthropic (Claude). Our system can be switched to OpenAI or xAI, so any of these three may process your data. We use these providers’ business (API) services, not their consumer apps.

7.1 What is sent with each message

• The last 30 messages of the current conversation: your messages, the coach’s replies, and internal records of actions the coach took (for example, that a check-in was recorded).
• Photos you attached, through a private link that expires after 1 hour, which the provider uses to retrieve the photo.
• Your display name, time zone, and current local date and time.
• In check-in conversations, your goals: titles, descriptions, agreed proof, and whether each is done today.

Not sent: your email address, stake amount, or card or payment details.

7.2 Model training and provider retention

Under these providers’ published commercial terms and documentation as of the effective date of this policy, they do not use data sent through their business API services to train their models by default:

• Anthropic’s commercial terms state it may not train models on customer content from its services. Anthropic states that it generally deletes API inputs and outputs within 30 days, but may keep content flagged for usage-policy violations longer (up to 2 years).
• OpenAI states that data sent to its API is not used to train its models unless the business opts in, and that abuse-monitoring logs are kept for up to 30 days by default, or longer where legally required.
• xAI states that it does not train on API inputs or outputs without the customer’s explicit permission, and that API requests and responses are stored for 30 days by default for auditing suspected abuse or misuse.

These are the providers’ own policies, which they may change. Each provider may retain data for abuse monitoring, safety, or legal reasons under its own terms and privacy policy; please see their policies for details. We will not agree to let an AI provider train its models on your data without first updating this policy.

7.3 What the AI can do

The coach can create goals and record check-ins based on your conversation, and it judges whether photo proof looks plausible. These actions affect whether you are charged (Section 8). The AI can make mistakes, so please check your goals and check-ins in the app.

7.4 Human review

No one monitors conversations in real time. Authorized staff may review your conversations, photos, goals, and check-ins when needed for support, charge disputes and chargebacks, safety, investigating abuse, or legal reasons.

8. Automated charging decisions

Whether you are charged for a day is decided automatically, without human review, by an automated job that runs about once an hour. For each account, it checks the previous day normally within hours after midnight in your time zone, and no later than about 24 hours after that day ends, using the records in our system at the time of the check: whether each active goal (created before that day began) has a check-in for that day, recorded by the coach or by a friend. A goal deleted before the day is checked does not count for that day. A day you admit failing to the coach is treated as missed. If a day is missed, the job charges your saved card the stake in effect for that day.

To contest a charge, email support@milieai.com within 30 days of the charge. A person will review your records and respond. Refunds are at our discretion as described in the Terms.

9. How we share information

9.1 Service providers

We disclose personal information to service providers that process it on our behalf to run the Service, under contracts or terms that limit their use of it:

9.2 Other disclosures

• Your friends: as described in Section 10.
• Payment disputes: to Stripe, card networks, and banks when needed to respond to a dispute or chargeback.
• Legal reasons: when we believe in good faith it is required by law, subpoena, court order, or other legal process, or necessary to protect the rights, property, or safety of you, us, or others, including to prevent fraud.
• Business transfers: to a buyer, successor, or their advisors in connection with a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, subject to this policy’s protections.
• With your direction or consent.

We do not sell personal information, share it for cross-context behavioral advertising, or provide it to data brokers. We do not have actual knowledge of selling or sharing the personal information of anyone under 16.

10. What your friends can see

Anyone who enters your 8-character friend code becomes your friend immediately. Friends can see your display name, your overall streak, and your active goals’ titles with whether each is done today. Friends cannot see your email, stake, charges, photos, chats, or goal descriptions or proof. Friends can mark your goals done for the day (see the Terms). You can remove a friend at any time, but anyone with your code can add you again, so share it carefully.

11. Cookies, tracking, and advertising

The app does not use cookies, and these legal web pages set none. We do not use analytics, advertising, or crash-reporting tools, do not show ads, and do not engage in “tracking” as Apple defines it (linking your data with third-party data for targeted advertising or advertising measurement, or sharing it with data brokers).

12. Emails we send

We send only service emails: email verification codes, password-reset codes, and a notice if a password reset is requested for an account that signs in only with Apple or Google. We do not send marketing emails. If we ever do, we will ask for your permission or give you an easy way to opt out first, as the law requires.

13. How long we keep information

We may keep specific information longer when needed to resolve an open dispute or chargeback, comply with a legal obligation, or establish or defend legal claims, and only for as long as that need lasts.

14. Deleting your account

1. In the app, go to Settings → Delete account.
2. Deletion is immediate and permanent. We erase your account, profile, goals, check-ins, chats, photos, friendships, stake history, and charge records right away. It cannot be undone, and no stake is charged afterward (see the Terms).
3. If you signed in with Apple, we revoke the app’s Sign in with Apple authorization.
4. We delete your saved customer and card at Stripe. Stripe keeps its own records of past transactions as required by law.
5. Copies may remain in backups or with providers as described in Section 13.

You can also ask us to delete your data by emailing support@milieai.com.

15. Your privacy rights

Depending on where you live, laws such as the California Consumer Privacy Act (as amended by the CPRA) and similar state laws give you rights over your personal information. We honor the following requests from all users in the United States, subject to legal exceptions:

• Know and access: the categories and specific pieces of personal information we hold about you, its sources, purposes, and the categories of recipients.
• Delete: your personal information, subject to legal exceptions.
• Correct: inaccurate information. Some details can be changed in the app’s Settings; for anything else, email us.
• Portability: a copy of your information in a commonly used, machine-readable format.
• Opt out of sale, sharing, targeted advertising, or profiling: we do none of these, but you may still submit an opt-out and we will honor it.
• Limit use of sensitive personal information: we use it only for the purposes the law permits without this right, but you may contact us with any concerns.
• Non-discrimination: we will not deny you service, charge you differently, or otherwise treat you worse for exercising your rights.

15.1 How to submit a request

Use the in-app deletion feature, or email support@milieai.com with your request. We will confirm receipt within 10 business days and respond within 45 calendar days. If we need more time (up to 45 more days), we will tell you why.

15.2 Verification

To protect your account, we verify requests by matching them to your account, for example by asking you to send the request from the email address on your account or to confirm a code we send to it. Requests made from within the app while you are logged in are verified by your login. We will use the information you provide for verification only for that purpose.

15.3 Authorized agents

You may use an authorized agent to submit a request. We will ask the agent for proof of your signed permission, and we may ask you to verify your identity with us directly, unless the agent holds a valid power of attorney.

15.4 Appeals

If we decline your request, you may appeal by replying to our decision or emailing support@milieai.com with “Privacy appeal” in the subject line. We will respond in writing within 60 days, or sooner if your state’s law requires, and explain our reasons. If the appeal is denied, you may contact your state attorney general.

16. State-specific notices

California

• Notice at collection: this policy is our notice at collection. The categories we collect and why are in Sections 4 and 6, and how long we keep them is in Section 13. We do not sell or share personal information.
• Disclosures in the past 12 months: see Section 4. We disclosed the categories listed there for business purposes to the recipients listed, and sold or shared none.
• “Shine the Light” (Cal. Civ. Code § 1798.83): we do not disclose personal information to third parties for their own direct-marketing purposes.

Nevada

We do not sell covered information as defined under Nevada law. You may still send an opt-out request to support@milieai.com.

Other states

Residents of states with comprehensive privacy laws (such as Virginia, Colorado, and Connecticut) may exercise the rights in Section 15, including the right to appeal.

17. Children

The Service is only for people 18 and older. We do not knowingly collect personal information from anyone under 18, including children under 13 as covered by the Children’s Online Privacy Protection Act (COPPA). If we learn we have collected information from someone under 18, we will delete it and close the account. If you believe a minor is using Milie, contact support@milieai.com.

18. Security

We use reasonable administrative, technical, and physical safeguards designed to protect your information. These include encryption in transit (HTTPS) between the app and our servers, salted scrypt password hashing, private photo storage accessible only through links that expire after 1 hour, storing your login token in your phone’s secure storage, and leaving card numbers to Stripe. Password reset codes expire after 10 minutes. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Please use a strong, unique password and keep your device secure.

If a data breach affects your personal information, we will notify you and the appropriate authorities as required by applicable law.

19. Where your data is processed

We store and process your information in the United States. The Service is intended only for users in the United States and is not directed to people in the European Union, the United Kingdom, or elsewhere. If you access it from outside the United States, your information will be transferred to and processed in the United States, where privacy laws may differ from those in your country.

20. Do Not Track and Global Privacy Control

Because we do not sell or share personal information or track you across sites or apps, there is nothing for a Do Not Track or Global Privacy Control (GPC) signal to opt you out of. If we ever begin selling or sharing personal information, we will treat a GPC signal as a valid opt-out request and update this policy first.

21. Changes to this policy

We may update this policy. We will post the new version with a new “last updated” date, and if a change is material, we will notify you in the app or by email before it takes effect. If a change would use your information in a materially different way than described when we collected it, we will ask for your consent where the law requires.

22. Contact us

Stanislav Martin Babak
1490 Market Street Apt 218
San Jose, CA
Email: support@milieai.com