Privacy Policy
This is a reference translation; the Korean version governs.
Effective 2026-10-04 · v2 · Previous version v1 (2026-09-02) in effect until then
Change notice (2026-09-27): TypeSafe AI, Inc. has been added as a processor (§2 — genre and format classification, and interpreting commands for the editing assistant).
Change notice (2026-09-27): v1 said your videos were kept "until you delete them", but in practice files are removed after a retention period. §1-1 now states that period and the notice we send before removal.
Change notice (2026-09-29): Added Paddle (payment reseller) and Cloudflare (request delivery and maintenance notice) to our processors, and described how payment records are kept in §1-1.
1. Information we collect and why
| Item | Purpose | Retention |
|---|---|---|
| Email, display name (optional), and your Google account identifier — received from Google when you sign in (we never receive or store a password) | Identifying and authenticating your account | Email anonymized immediately when you delete your account |
| IP address and browser information (User-Agent) | Login security (rate limits) and audit records | Kept in the audit log |
| Credit transaction history | Billing and handling disputes | Kept in the ledger (legal retention obligation) |
| Source video files you add | Providing the editing service | For 7 days from upload (or until you delete it, if sooner) |
| Finished short files | Downloading your results | For 14 days from rendering (or until you delete it, if sooner) |
| Derived data such as captions, clips and edits | Re-editing and re-rendering | Until you delete it (kept even after the files are removed) |
| Payment records (order number, amount, status — no email or card details) | Reconciling payments and refunds, handling disputes | 5 years (legal record-keeping) · on account deletion, any active subscription is canceled immediately and the payment provider's customer ID is removed |
We never receive or store a password — you sign in only with your Google account. Sign-in sessions and API keys are stored only as non-reversible hashes; the original is never kept anywhere.
1-1. How long files are kept, and removal
- Source files are removed 7 days after upload, and finished short files are removed 14 days after rendering. Anything still being analyzed or rendered is never removed.
- We'll notify you 2 days before a file is removed. Download anything you need before then.
- Only the files are removed; clips, captions, edits and credit history remain. However, clips whose source has been removed can no longer be rendered.
- Removed files cannot be recovered. Database backups (kept for 7 days) do not include video files.
2. Processors and international transfers
- Anthropic (USA) — To select highlights and generate titles, your videos' caption text and some frame images are sent via API. Account information (such as your email) is not sent.
- TypeSafe AI, Inc. (USA) — To classify your videos' genre and format and to interpret short commands for the editing assistant, video titles, caption excerpts and what you type into the assistant are sent via API. Account information (such as your email) is not sent, and the company states that it does not use inputs to train models.
- Google YouTube Data API — Used to look up public video metadata for finding footage and collecting comment signals. None of your personal information is sent.
- Paddle.com Market Ltd. (UK) — processes subscription and credit payments as Merchant of Record. Paddle collects your email, country and payment details directly at checkout; miro never receives or stores your card number. miro keeps only the order number, amount and status.
- Cloudflare, Inc. (USA) — requests to the service address pass through Cloudflare's network (IP address and request details). It is also used to show a maintenance notice when our servers can't be reached.
- ElevenLabs, Inc. (USA) — When you create narration or voice tracks, the script text is sent via API (only when the feature is enabled). Account information is not sent.
- Google YouTube Data · YouTube Analytics API (OAuth) — If you connect your YouTube channel, we read that channel's audience retention, and if you choose direct publishing we upload the short and its title and description. Access is limited to the scopes you approve and is removed when you disconnect or delete your account.
- Freesound (MTG-UPF) · Pexels — When you search for sound effects or B-roll in the editor, your search terms are sent and the file you pick is downloaded. Account information is not sent.
3. Sharing with third parties
We do not share personal information with third parties, except when required by a request based on law.
4. Deletion and your rights
- You can delete your account yourself at any time from the account page. Your email is immediately replaced with an unidentifiable value, and all login sessions and API keys are revoked.
- The credit ledger and audit logs are kept in anonymized form to handle billing disputes and meet legal retention obligations.
- You can delete your own videos and shorts yourself; even if you don't, files are removed once the retention period above has passed.
- Requests to access, correct or stop processing your data can be sent to the operator and will be handled without delay.
5. Security measures
- No passwords (Google sign-in only); sign-in sessions and API keys stored only as hashes; YouTube connection tokens stored encrypted
- Restricted access to database files (owner only); rate limits on sign-in requests
- All account, permission and credit changes recorded in the audit log
6. Cookies
We use a single session cookie to keep you logged in (HttpOnly, SameSite=Strict). We don't use advertising or tracking cookies.
7. Changes to this policy
We'll post a notice on screen 7 days before changes to this policy take effect. Questions: contact the operator.