Privacy policy

1. Controller and privacy contact

MiroTiper is responsible for personal data processed on the MiroTiper website and in the MiroVIP app.

For privacy questions or requests, including access, correction and deletion, email support@mirotiper.com. Please write from the email address of the account concerned.

2. Data processed on the website

• Account and identity: name, email, hashed password, email verification, profile image and Google sign-in identifiers.
• Optional profile: phone, country, language and Telegram or Instagram handle supplied by the user.
• Membership and support: products, access dates, duration, price, activation history, account status and internal administrator notes.
• Technical and security: IP address, user agent, device, session, login attempts, security events and diagnostic logs.
• Service use: pages and events, language, UTM details, content views, favourites, filters, notifications and tutorial progress.
• Communications: newsletter, support requests, discount codes, activation confirmations and details needed for push or email delivery.
• Campaign measurement: GA4, PostHog and Meta identifiers, including fbp/fbc and Telegram invitation events, where those tools are enabled.

3. Purposes

• creating accounts, authentication, session security and access management;
• verifying payments, including Google Play purchases in the MiroVIP app, and activating the purchased period;
• delivering content and saving settings, favourites and notifications;
• support, service messages and emails requested by the user;
• security, abuse prevention, incident response and legal claims;
• analytics and campaign measurement only on a valid legal basis and, where required, after consent.

4. Legal bases

Depending on the purpose, processing may rely on contract performance, pre-contract steps, legal obligations, legitimate security interests or explicit consent.

In the MiroVIP app, the account, purchases and app activity are processed to provide the service you signed up for (contract, Art. 6(1)(b) GDPR). Sign-in limits, security logs and fraud prevention rely on the legitimate interest in keeping accounts and the service secure (Art. 6(1)(f) GDPR). Push notifications are sent only after you allow them on your phone (consent, Art. 6(1)(a) GDPR); you can withdraw consent at any time in the app or in the phone settings. Where the law requires records to be kept, they are kept to meet that legal obligation (Art. 6(1)(c) GDPR).

Marketing emails are sent only with explicit consent. Optional analytics and advertising measurement tools run by default and can be turned off at any time in Cookie settings.

5. Recipients and transfers

Depending on enabled features, data may be processed by hosting and database providers, Google for website sign-in and analytics, PostHog, Meta, Resend or an SMTP email provider for emails, RevenueCat and Google Play Billing for purchases in the MiroVIP app, and Expo and Firebase Cloud Messaging for push notifications. Google Play processes the payment for Google Play purchases; MiroTiper does not receive card or bank account details from it.

Some of these providers, including RevenueCat, Expo, Resend, Google, Meta and PostHog, may process data outside the European Economic Area, for example in the USA. Such transfers rely on the EU-US Data Privacy Framework where the provider is certified under it, and otherwise on the European Commission’s Standard Contractual Clauses.

Personal data is not sold as a standalone product. Data may be disclosed to a public authority where required by law.

6. Retention and security

Data is kept while the account exists and the service is provided, and afterwards only for as long as needed for applicable legal retention periods, claims or security events.

When a MiroVIP app account is deleted, its account, sessions, devices, purchase records and app activity are deleted at once (see section 10). App sign-ins expire after 30 days without use and after 90 days at the latest; email verification links are valid for 1 hour and password reset links for 30 minutes.

Controls include access restrictions, password hashing, session management, failed-login limits and technical logging. No system can be represented as entirely risk-free.

7. User rights

• request access to and a copy of personal data;
• correct inaccurate or incomplete data;
• request erasure or restriction where legal conditions are met;
• object to processing based on legitimate interests;
• withdraw consent without affecting earlier lawful processing;
• receive portable data and complain to the competent supervisory authority.

8. Children and contact

The service is not intended for anyone under 18. If a minor’s account is discovered, access and data should be addressed without undue delay.

Privacy requests can be sent to support@mirotiper.com. Do not send passwords or unnecessary bank details by email.

9. MiroVIP mobile app

The MiroVIP app (app ID com.mirotiper.app) is provided by MiroTiper. App accounts are separate from website accounts. The app processes the following data:

• Account: email address, password (stored only as a hash), optional name, app language, email verification status and short-lived email verification and password reset links (their tokens are stored only as hashes).
• Sign-in and security: a random installation ID created by the app (the server stores only its hash), the platform (Android or iOS), session times and hashed session tokens, and IP addresses used to limit sign-in attempts (stored only as keyed hashes) and in technical logs.
• Push notifications, only if you turn them on: an Expo push token (on Android based on a Firebase Cloud Messaging token), the platform, the app language, the notification topics you chose and when the device was last seen.
• Purchases: MiroVIP access is bought as one-time purchases through Google Play Billing (on iPhone, through the App Store) and verified through RevenueCat. Your app account ID is used as the RevenueCat customer ID. We process the product, the store order number, the purchase date, the environment, the refund status and the resulting access dates. Google Play handles the payment; we do not receive card or bank account details.
• App activity: followed matches, teams and competitions, Daily Slip settings and the slips generated for you, tickets you save and whether you have viewed them, and the read state of MiroFM articles.
• On your phone only: your sign-in session and installation ID in the phone’s secure storage, notification and biometric-unlock preferences, and cached content. Fingerprint or face unlock is handled by the phone; the app does not receive biometric data.
• The app shows no advertising, contains no analytics or advertising trackers and does not access your location, contacts, photos, files or microphone. The website’s analytics tools (GA4, PostHog, Meta) and Google sign-in are not used in the app.

10. Deleting a MiroVIP account

In the app, open Account, choose Delete account and confirm with your password. If you cannot use the app, email support@mirotiper.com from the email address of your account and ask for it to be deleted. We then send a confirmation request to that address and delete the account only after you reply to it. Confirmed requests are handled without undue delay and within one month at the latest. Step-by-step instructions: www.mirotiper.com/en/legal/app/delete-account.

Deletion removes the app account (email, password hash, name and settings), all sessions and devices including push tokens, the purchase records and access dates, and all app activity (followed matches, Daily Slip settings and slips, saved tickets and read state). The account’s customer record at RevenueCat is deleted as well.

Remaining access is lost and cannot be restored or moved to another account, and deleting the account does not refund purchases. You can request a refund through Google Play or by emailing support@mirotiper.com; requests are handled under Google Play’s refund policies and applicable consumer law.

Google Play keeps its own records of your orders under Google’s terms and privacy policy. Emails already sent remain in your mailbox and in our email provider’s delivery logs for its standard log period. Technical server logs and backups that can contain the account ID are removed in their regular rotation and are never used to restore the account. If MiroVIP is still installed and signed in on another device, it can create a new, empty RevenueCat record under the old account ID the next time it opens there, before that device signs out; the record holds no purchases, email address or name.