Privacy, in plain type.

Overview

The short version: misu stores your cards and your study history so it can schedule your reviews, and measures how the app and this site get used so we can make them better. We don't run ads, we don't track you across other apps or sites, and we don't sell data, there's nothing to sell it for. This policy covers the misu app, Misu for Chrome (our browser extension) and misu.io, operated by A3 Studio L.L.C-FZ ("misu", "we").

What we collect

Account. When you first open misu we create an anonymous account, just a random ID, so misu works before you've told us anything. If you add a sign-in, we also keep an email address, or the identifier your sign-in provider (Apple or Google) shares with us. Sign in with Apple lets you hide your real email; that works fine with misu. When you sign in on misu.io, your session is kept in your browser's storage on that device so you stay signed in; signing out of misu.io removes it. A deck you add there with Add to Misu waits on your account until the app downloads it.

Your content. The cards, decks, and templates you make, and anything you attach to them, photos, images, audio. This is the whole point of the app, and it's yours (see the Terms). That includes text you send to misu from other apps with Save to Misu, which lands in your Saved tab.

Study activity. Which cards you reviewed and how they went. The FSRS scheduler needs this history to time your next reviews; it's also what grows your garden and prints your monthly receipt.

Purchase state. Whether you have misu Plus and when it renews, from RevenueCat, which tracks subscriptions bought through your app store (Apple or Google) and on misu.io. We never see your full card number: on misu.io, Stripe takes the payment and keeps the card details, and we receive only what we need to run the subscription, like your email, country, the plan, and when it renews.

Crash reports. If the app crashes, a technical report (device model, OS version, what the code was doing) goes to Sentry so we can fix it. Crash reports don't include your cards.

Usage analytics. In the app, which screens you open and what you do there, like finishing a review session, making a card or tapping a reminder, plus subscription events like a trial starting or renewing. It's linked to your account so we can see what helps people keep studying, and it never includes what's on your cards. On misu.io, which pages are visited, where visitors arrived from, what they click and how far down each page they scroll (shown to us as heatmaps); the analytics use no cookies and store nothing on your device. If you make an account or sign in on misu.io, what you then do there (the plan questions, the paywall, checkout, adding a deck, signing in Misu for Chrome) is linked to your account too, as it is in the app. Both go to PostHog, which also estimates a rough location (country and city) from the connection.

Onboarding answers. Your languages, level, pace, why you're learning, and where you heard about misu, used to set up your plan and to know which of our efforts actually work. You give them in the app or on misu.io/start. The answers you give on misu.io/start stay in that page, apart from your languages, which go to Misu for Chrome when you sign it in there so it starts on them.

Misu for Chrome

Misu for Chrome shows what words mean on the pages and videos you open. To do that it reads the text you point at and, on video sites, the subtitles of the video you're watching. That happens in your browser: it doesn't send us the pages you visit, your browsing history or the subtitles themselves. Once you're signed in, it sends us two things. When you look a word up, the word, with its language and yours, goes to Misu's dictionary to get its meanings and example sentences. When you save something, the word or line and the sentence it came from go to your account so they become flashcards, and a word saved from a video keeps a still from that moment, stored in your account as its flashcard's picture. It also uses your account's flashcards to mark which words on a page you already know; that comparison happens in the extension.

Signing in opens misu.io in a tab, and misu.io hands the extension a one-time code that it swaps for your session. No password ever goes through the extension.

The use of information received from Misu for Chrome adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements: we use it only to provide and improve the extension's features you use, we don't sell it, we don't use or transfer it for advertising, and we don't use it to determine creditworthiness or for lending.

What we don't collect

No advertising identifiers and no cross-app tracking (our App Store privacy manifest declares none, and iOS would hold us to it). No precise location, no contacts, no background microphone. We don't send promotional email. We don't sell or rent personal information to anyone, and we don't share it for advertising.

How we use it

To run misu: syncing your deck between devices, scheduling reviews, generating card content you ask for, processing your subscription, sending the reminders you turn on, fixing crashes, and seeing which parts of misu get used so we can improve them. That's the list. Notifications are optional and controlled in your device's settings.

Card generation

When a card autofills or artwork is generated, the input you provided, the word, sentence, or photo, is sent through our gateway to the generation services we use, used to make your card, and returned. We use it for nothing else: we don't build training datasets from your content, and your cards aren't used to train anyone's models. Generated content is stored as part of your card like anything else you'd attach.

Camera, microphone & photos

Camera and photo access exist to turn what you see into cards; microphone access exists for audio you record onto cards. Capture and photo-subject extraction happen on your device, only what you actually attach to a card is uploaded, as your content. Permissions are requested when first needed and controlled in your device's settings.

Who touches your data

We use a small set of service providers to run misu, each processing data only to provide their service to us: Apple and Google (distribution, payments, sign-in), Stripe (card payments on misu.io), RevenueCat (subscription state), Cloudflare (API and media storage), Turso (encrypted database sync), Amazon Web Services (account emails, like verification codes), Sentry (crash reports), PostHog (usage analytics), and the generation services behind card autofill and artwork (which receive only the inputs described above). We share personal information with no one else, except where the law genuinely requires it.

Security & storage

misu is local-first: your deck lives on your device and works offline, syncing over encrypted connections when you're signed in. Data at our providers is protected by industry-standard measures. Honesty requires the standard caveat: no method of electronic storage is 100% secure, and nobody can promise absolute security, we protect your data within commercially reasonable means.

Retention & deletion

We keep your data for as long as you have an account, because it is your account. Delete your account and we delete your personal information from our systems within 30 days, except minimal records we're legally required to keep (like transaction history). You can also just delete the app, anything that never synced dies with it.

Your rights

You can access, export, correct, and delete your information, object to or restrict our processing of it, and complain to your local data-protection authority. You can delete your account in the app's Settings; for everything else, including a copy of your data, email support@misu.io, we'll respond within 30 days and won't treat you differently for asking.

Regional laws

EU & UK (GDPR). Our legal bases are performing our contract with you (running the app you signed up for), your consent (optional things like notifications), and legitimate interests (fixing crashes, preventing abuse, understanding how misu is used). All the rights above apply, plus data portability. We're based in the UAE and our service providers process data in the United States and elsewhere; where data leaves the EU or UK, it's protected by the providers' Standard Contractual Clauses or an equivalent safeguard.

US states (California, Colorado, Virginia and similar laws). You have the rights above; we don't "sell" or "share" personal information as those laws define it, and we've collected none of the "sensitive" categories they enumerate beyond what you put on your own cards.

Australia (Privacy Act), Canada (PIPEDA). We handle personal information consistently with these frameworks; contact us to exercise access or correction rights.

Children

misu isn't directed at children under 13 (or the higher minimum age in your country), and we don't knowingly collect their data. If you believe a child has an account, email us and we'll delete it.

Business transfers

If misu is ever acquired or its assets transferred, your information may be part of the transferred assets, but this policy would still bind its use, and we'd notify you before anything changed materially.

Changes & contact

If this policy changes materially, we'll say so in the app and update the date at the top of this page before the changes apply. Questions, requests, complaints: support@misu.io. Operated by A3 Studio L.L.C-FZ.