Mio Mobile Application
Version of February 26, 2026
This Privacy Policy describes how TTT — Thomas Poumarède (hereinafter "the Publisher", "we" or "our") collects, uses, stores and protects the personal data of users (hereinafter "you" or "the User") of the Mio mobile application (hereinafter "the Application"), available on the Apple App Store and Google Play Store.
We are committed to protecting your privacy and processing your personal data in accordance with Regulation (EU) 2016/679 of April 27, 2016 on the protection of natural persons with regard to the processing of personal data (GDPR) and French Law No. 78-17 of January 6, 1978, as amended, relating to information technology, data files and civil liberties.
By using the Application, you acknowledge that you have read this Privacy Policy and consent to the data processing described herein.
The data controller for your personal data is: TTT — Thomas Poumarède Sole proprietor SIRET: 525 331 153 00045 — APE Code: 6201Z Address: 15 Route de Gard-sign, 29840 Porspoder, France Email: contact@getmio.app
For any questions regarding the protection of your personal data, you may contact us at the email address above.
The Application operates without user account creation. You are identified anonymously by a unique technical identifier (UUID) randomly generated when the Application is first launched and securely stored on your device.
We collect different categories of personal data depending on your use of the Application:
We do not collect:
The Application uses your device's camera exclusively to scan product barcodes. This requires your explicit permission when the Application is first launched.
Technical operation:
If you revoke camera access permission in your device settings, the scanning feature will no longer be available, but other Application features (history, contributions, profile) will remain accessible.
Your personal data is processed for the following purposes:
| Purpose | Data involved | Legal basis |
|---|---|---|
| Service provision (barcode scanning, display of product origin information) | Technical identifier, scanned barcode, technical data | Performance of contract (Terms of Use) |
| Scan history and monthly quota tracking | Technical identifier, scanned barcodes, timestamps | Performance of contract (Terms of Use) |
| AI-powered product data enrichment | Product data (barcode, name, brand) — no personal data | Legitimate interest (database improvement) |
| Community contribution management (corrections, reports) | Technical identifier, correction type, proposed country, evidence (text, URL, photo) | Legitimate interest (collaborative Service improvement) |
| Contribution gamification (points, badges) | Technical identifier, contribution statistics | Performance of contract (Terms of Use) |
| Usage statistics and Service improvement | Anonymized interaction events, technical data | Legitimate interest |
| Security, abuse prevention and rate limiting | IP address, technical identifier | Legitimate interest / Legal obligation |
| Beta waitlist management | Email address, platform | Consent |
Your personal data may be shared with the following categories of recipients:
We use technical service providers to ensure the Application's operation. These processors act solely on our instructions and are contractually required to maintain the confidentiality and security of your data:
| Provider | Function | Data location | Safeguards |
|---|---|---|---|
| Render.com (Render Services, Inc.) | Application server and database hosting | European Union (Oregon region for compute, data in the EU) | GDPR-compliant DPA |
| PostHog, Inc. | Usage analytics and statistics (PostHog EU Cloud) | European Union (Frankfurt, Germany) | EU hosting, GDPR-compliant DPA |
| Cloudflare, Inc. | Contribution photo storage (Cloudflare R2) | European Union | GDPR-compliant DPA, Standard Contractual Clauses |
| Brevo (Sendinblue SAS) | Beta waitlist management (email sending) | France | GDPR |
| Google LLC (Gemini API) | AI processing for product data enrichment | United States | Data Privacy Framework, Standard Contractual Clauses |
| Langfuse GmbH | AI processing traceability and quality | European Union (Germany) | GDPR |
| Apple Inc. | Application distribution (App Store) | United States | Data Privacy Framework |
| Google LLC (Play Store) | Application distribution (Google Play) | United States | Data Privacy Framework |
To provide product origin information, we query public data sources and third-party services:
We may be required to share your data with administrative or judicial authorities when required by law (legal requisitions, court orders).
We never sell your personal data to third parties. We do not share your data for third-party commercial prospecting purposes. We do not display any advertising in the Application.
We retain your personal data for the following periods:
| Data type | Retention period |
|---|---|
| Technical identifier (UUID) | As long as the Application is installed on your device |
| Scan history | 2-year rolling window (scans older than 2 years are automatically deleted) |
| Community contributions | Lifetime of the Service (approved contributions permanently enrich the database) |
| Contribution photos | Lifetime of the Service (associated with contributions) |
| Contribution statistics (points, badges) | As long as the technical identifier is active |
| Technical logs (IP address, connections) | 12 months |
| Beta waitlist email | Until the Application's public launch or upon deletion request |
| Analytics data (PostHog) | Per PostHog's retention policy (maximum 12 months for raw data) |
Upon expiration of these periods, your data is deleted or irreversibly anonymized.
Your personal data is primarily hosted on servers located within the European Union.
However, some of our processors are based in the United States. Data transfers to these providers are governed by:
Transfer details:
| Provider | Country | Transfer mechanism |
|---|---|---|
| Google LLC (Gemini API) | United States | Data Privacy Framework + Standard Contractual Clauses |
| Apple Inc. (App Store) | United States | Data Privacy Framework |
| Google LLC (Play Store) | United States | Data Privacy Framework |
| Cloudflare, Inc. (R2) | Data in the EU | No transfer outside the EU |
| PostHog, Inc. (EU Cloud) | Data in the EU (Frankfurt) | No transfer outside the EU |
You may obtain a copy of the appropriate safeguards by contacting us at the address indicated in Article 1.
We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, loss, destruction, or alteration, including:
In the event of a data breach likely to pose a risk to your rights and freedoms, we will notify you as soon as possible in accordance with our legal obligations.
In accordance with the GDPR, you have the following rights regarding your personal data:
You have the right to obtain confirmation as to whether or not your data is being processed and, where it is, to access that data and obtain a copy.
You have the right to obtain the rectification of inaccurate data concerning you and to have incomplete data completed.
You have the right to obtain the erasure of your personal data in certain cases provided for by the GDPR (data no longer necessary, withdrawal of consent, objection, unlawful processing).
Deleting your data: Since the Application operates without a user account, you can delete your data in three ways:
You have the right to obtain the restriction of processing of your data in certain cases (accuracy contested, unlawful processing, data needed for legal claims).
You have the right to receive the data you have provided to us in a structured, commonly used and machine-readable format, and to transmit it to another data controller.
You have the right to object at any time to the processing of your data based on our legitimate interest, on grounds relating to your particular situation.
In accordance with French data protection law, you have the right to define directives regarding the retention, erasure and communication of your data after your death.
To exercise your rights, you may:
We will respond to your request within one (1) month of receipt. This period may be extended by two (2) months depending on the complexity or number of requests.
We may ask you to provide your technical identifier to process your request.
The mobile Application does not use cookies in the strict sense (a technology specific to web browsers).
However, we use local storage technologies for the proper functioning of the Service:
For usage statistics, we use PostHog EU Cloud, configured to host data in the European Union (Frankfurt, Germany). PostHog collects interaction events (pages viewed, features used) associated with your technical identifier, without placing third-party cookies.
The Application does not participate in advertising tracking. We do not use your device's advertising identifier (IDFA on iOS, GAID on Android) and do not participate in any advertising network.
The Application is reserved for persons aged sixteen (16) years and over, in accordance with Article 8 of the GDPR and its transposition into French law.
We do not knowingly collect personal data from minors under 16 years of age. If we discover that data concerning a minor under 16 has been collected, we will delete it as soon as possible.
If you are a parent or guardian and believe that your child has provided us with personal data, please contact us.
We may modify this Privacy Policy at any time to adapt it to legal, regulatory, or technical developments, or to reflect changes in our practices.
In the event of a substantial modification, we will notify you by in-app notification at least fifteen (15) days before the changes take effect.
The date of the last update is indicated at the top of this document. We encourage you to review this Policy regularly.
If you believe that the processing of your personal data constitutes a violation of the GDPR, you have the right to lodge a complaint with the French Data Protection Authority (CNIL):
CNIL
3 Place de Fontenoy – TSA 80715
75334 Paris Cedex 07
We encourage you, however, to contact us first so that we can attempt to resolve your issue.
For any questions regarding this Privacy Policy or the processing of your personal data, you may contact us:
| Data type | Collected | Shared with third parties | Linked to identity | Purpose |
|---|---|---|---|---|
| Device identifier (anonymous UUID) | Yes | No | No | Service operation |
| Scan history (barcodes) | Yes | No | No | Service operation |
| Usage data (analytics) | Yes | Yes (PostHog) | No | Analysis and improvement |
| Photos (contributions) | Yes (voluntary) | No | No | User content |
| IP address | Yes (automatic) | No | No | Security |
| Technical data (OS, app version) | Yes (automatic) | Yes (PostHog) | No | Analysis and diagnostics |
| Email (beta signup only) | Yes (voluntary) | Yes (Brevo) | Yes | Communication |
This Privacy Policy takes effect on February 26, 2026.
---
By using the Mio Application, you acknowledge that you have read and understood this Privacy Policy.