MICIO — Privacy Policy

Effective from 9 October 2026

MICIO is a game with a virtual kitten you can chat with. This page describes exactly what leaves your phone, what stays on our servers, and for how long.

Data we process

• Device identifier: an anonymous random code (UUID) generated by the app and stored in the phone's Keychain, so it survives uninstalling the app. It is used for the daily message limit, the per-minute request limit, friend visits and reports. On the server, the counters tied to it are kept for 3 days; the other rows that contain it (visits, invites, App Attest key) are described below, each with its own retention.
• Chat messages, your cat's name, memories and country: every message is sent to our server on Microsoft Azure (West Europe) together with the last turns of the conversation, the cat's state, the short "memories" the cat has of you (lines generated from the daily summaries, stored only on your device and re-sent with each message so the cat can use them) and your country code (e.g. "IT"), used only to point to a local helpline if a message signals a crisis. The server generates the reply via a language model hosted on Microsoft Azure AI and does not retain incoming messages, memories or the full conversation: history lives only on your device, and our logs hold technical data only (token counts, timings, error codes), never content. Microsoft, as processor, may temporarily retain prompts and completions for up to 30 days for security and abuse prevention, with limited possible human review. Once a day, if you actually had a conversation, that day's transcript may be sent to the same service to generate a short summary: the summary comes back to your device and our server keeps neither the transcript nor the summary. Days containing sensitive subjects are never sent at all. In a canonical cat’s chat, only the generated reply may be retained for 30 minutes to recover a lost response without repeating actions or charges. Other carers cannot see this text. The turn’s technical proof, without text, may remain for up to 120 days; data deletion removes both.
• MICIO+ subscription: if you subscribe, the app sends Apple's signed receipt (JWS) of your subscription with each request; the server verifies its signature to apply the higher daily limit and discards it at once — it is never stored. We receive neither your Apple ID nor any payment data.
• Friend visits and reports: each cat has its own invite code: the server keeps the code, your cat's name and look, and your identifier as owner for as long as the code stays valid, that is until it is removed after reports or you delete your data (see Deletion). Before it is shown to others, your cat's name goes through an automatic check: a list of banned words and the same language model as the chat, which receives the name only; if the name fails it, others see the cat as “Micio”. The result of the check is kept for up to 30 days, tied to the name and not to your identifier. If a name is reported as inappropriate, from then on others see the cat as “Micio” until you give it another name, while the code and friendships keep working; the code's row keeps the reported names and, for 30 days after each report, the identifiers of those who reported them. If two people who really hosted the cat report it from a verified app, the code is removed and for 30 days your device cannot create codes or be hosted through a token. Rows with reports do not go away when you ask for your data to be deleted: they become rows without a code and stay for 30 days; those that remember a reported name stay for up to 6 months, so that name does not come back with the cat's next code. If you accept a friend's invite, the server creates a friendship token (a random string) linking the two identifiers, together with the published cat's name and look: it is what lets you see that cat again without swapping a new code, and it is kept for 90 days after the last visit. Every visit also leaves a notice row for the cat's owner (the visiting cat's name, the time, and an anonymous fingerprint of the device that hosted it), kept for at most 30 days. Deleting your data removes the tokens and the notices tied to your identifier.
• Invites and welcome coins: each device has a personal invite code for the link you share with friends. The server keeps the code and your identifier as its owner; for every friend who redeems it, it keeps their identifier in your code's list and, in a row of their own, the redeemed code, the redemption date, a counter from 0 to 5 of their first chat turns (it checks that they really played before the inviter is rewarded) and the state of the reward. Coins live only on the devices: these rows are the proof that each reward was paid once, have no expiry and stay until you or your friend delete your data. On deletion your own rows go, and in other codes' lists your identifier is replaced by a pseudonym (a fingerprint the identifier cannot be recovered from), so the counts stay right.
• App verification (App Attest) and technical data: to stop modified copies of the app from using the service, the phone registers with the server a public key generated by Apple's App Attest service. The server keeps, tied to your identifier, the key's id and public key, the environment, a counter and the dates of registration and last use, for 180 days after its last use. A data deletion signed with that key removes it at once; if the app cannot sign it (versions before 2.0, or a phone without a registered key) the key stays until the 180-day cleanup, as explained under “Deletion”; the single-use challenge used to register it is valid for at most 5 minutes and, if it goes unused, is deleted by the nightly cleanup. If the app reaches the server without a key, the server only notes the date of that first contact under a pseudonym of the identifier: this row does not contain the identifier and stays after deletion. The app also sends short usage events from a closed list (for example a share, or the MICIO+ screen being opened), of which our logs keep only the event name, the language and the app version, without the identifier; the chat's technical log lines also say whether kid mode was on. Your coin balance, purchases and items are synced between your devices through your iCloud key-value store: Your overall balance remains on your device and iCloud. For cats activated in a house, we privately retain imported item rights, their placements and reward receipts. After the public key is cleaned up, only a hash of the key tied to a hash of the identifier remains, to prevent another phone from taking over that identifier. This pseudonymous ownership guard remains until signed deletion; the original phone can restore verification using its Keychain key history.
• Kid mode (under 13): from version 1.7, if you answer «Under 13» to the age question, the app sends nothing to our servers: no messages, no device identifier, no usage events, no summaries. The cat answers you on the phone, in its own way, with lines already written in the app and no language model; the diary stays on the device only. Just two requests still go out, both to remove data rather than collect it: if you had shared visit codes or friendships before switching, a single request to take them down; and, if you choose it in Settings, the deletion described below. Versions up to 1.6 instead sent the chat as described above, together with a «kid» flag asking the model for simpler replies: those requests were handled like the others. Answering «13 or older» again turns the online service back on; days written in kid mode are never sent for a summary. If House alerts had been turned on and a token was registered, kid mode also sends an authenticated request solely to disable and delete that token.
• Rewarded videos (Google AdMob): some moments in the game (up to three more chat messages per video when you run out of the day’s: with version 2.0 the video can be repeated each time, within a daily limit, with earlier versions once a day; a second chance in a challenge; hatching the egg straight away) offer a short, optional advertising video provided by Google AdMob. The video only starts if you tap the button: without that tap the app shows no ads. In kid mode (under 13), and until you have answered the age question, the app does not start or use Google's component (SDK) and has it send no request. In the European Union (European Economic Area) and the United Kingdom, before starting it the app shows Google's consent form, and you can change your choice in Settings. When the SDK is active, Google collects from the phone data such as device identifiers (for example the identifier for vendor, IDFV), the IP address, from which an approximate location can be estimated, interactions with ads (for example videos watched and taps) and diagnostic and performance data, to serve and measure ads and prevent fraud, as described in How Google uses information from sites or apps that use its services. The app does not use the advertising identifier (IDFA), does not ask you for tracking permission, and ads are limited to content rated at most “PG”. To link the reward to your game, the app gives Google, with each video, a pseudonym of your device identifier (a fingerprint from which the identifier cannot be derived: the identifier itself never reaches Google) and a random single-use code; for every video watched to the end, Google sends our server a signed confirmation with the transaction ID, that pseudonym and the reward category. The server checks its signature and keeps only the transaction ID for 24 hours, to discard duplicates, and the receipt for 1 hour, under a fingerprint of the pseudonym and the code; the nightly cleanup deletes them once expired. For extra chat messages, the verified receipt is kept for up to 7 days to recover an earned video after an interruption; a receipt already used on one day cannot grant messages on a later day. From version 2.2, verified multiowner reward receipts and shared daily video counters are kept for up to 120 days to recover rewards after an interruption and prevent duplicate credits. Benefits included in MICIO+ are obtained without videos or requests to Google to receive them. Creative Cat studio editions earned from build88 remain on the server without expiry, with house, cat, owner and a device pseudonym, to restore the permanent cosmetic entitlement. Data deletion also removes these editions.
• Shared houses and house alerts (from version 2.0; optional notifications): if you create or join a house, the server receives random house and member identifiers, your device identifier and chosen alias, and the shared cat's name, appearance, seed, adoption time and initial traits and needs. The house also records its time zone (for the days of the weekly contest). Before others see it, your alias passes the same automatic name check as cat names in visits (a word list, then the language model on Microsoft Azure AI, which receives only the alias); a refused alias is not saved. It then stores the evolving shared game state (needs, room, routines, litter and their effects), accepted care actions with source and time, statistics and each member's bond. The credential is stored as a hash, not in readable form. Active members can see house and shared-cat information and care. Each member decides for themselves with the “Cat stories” switch (off until you answer yes to the question the app asks when you enter a house; you can change it on the house screen): the choice is sent to our server and also applies when other members chat. Only for members who keep it on, to write the cat’s chat replies the server adds to the text sent to the language model on Microsoft Azure AI their alias and today’s counts of their care and visits for that cat, yesterday’s, whether they lead the week’s contest and how many hours ago they came by, even when another member is chatting, and the cat’s lines in the other members’ app may name them. Members who switch it off, or whose app has not yet told the server, are left out of the cat’s stories and of what goes to the model, not even anonymously; the house’s weekly ranking (“who cared most”) still shows all members their alias and care. Until the server receives a change (for example while the phone is offline: the app retries when the network is back) it uses the last value it knows. No identifiers, credentials or other members’ conversations are sent, and never in child mode. Any member can report another member’s alias or a shared cat’s name, or block a member, from the house screen: a reported alias is hidden from the whole house (lists, ranking, stories and the model), a reported cat name is no longer given to the model, and our server keeps only the fact that it was reported (no identifier of who reported); a block is kept only on your phone. House, profile and current-state records have no automatic application expiry; event, count, daily/session, action-receipt and bond-award records normally expire within 120 days. If you delete your data, your membership and attributed records are removed, while the shared cat and state remain for other active members. Some duplicate-prevention markers may remain without expiry and are linked to house, cat and pile identifiers. For the one-time launch gift the server also keeps, without expiry, a pseudonym of the device identifier with the house and cat identifiers of the gifts given (at most five) and a marker per cat. If you leave a house or are removed, your alias and points are also taken out of its closed weekly awards. The first member to validly collect a shared golden poop receives 200 in-game coins; they are not money. Full chat history and private diary entries are not shared with the house; temporary retention of the generated reply alone is described above. House alerts (push notifications): they are off by default. Only if you turn on “House alerts” on the house screen does the app ask iOS for permission and send our server this phone’s unique app/device token for Apple Push Notification service (APNs), with the app’s language and build. In this version they announce, in a shared house, a golden poop that has just appeared and, if another carer collects it first, that it has already been collected; the lock-screen text contains no alias (with several cats the title carries the cat’s name). Also, once a day between 18:00 and 20:00 in the house’s time zone, the shared cat may write to you about a care action another member did in the last 24 hours that you have not seen yet (for example “Luca cleaned my litter box this morning. Will you feed me?”): a text composed by our server with no language model, with the cat’s name and that member’s alias only if they keep “Cat stories” on and were not reported; tapping it opens that cat’s chat. From version 2.1 the app tells our server which of the home’s cats you follow from this phone (their identifiers only): both alerts come only for those and for the cats you brought. The server also records which member brought each cat into the home. It is not sent if you opened the app in the previous two hours. You turn them off with the same switch, which deletes the token from our server (leaving the house, deleting your data or kid mode delete it too); turning notifications off in iOS Settings stops them on the phone. The token is kept for up to 180 days from renewal; disabling it removes the raw token and the disabled record expires within 120 days. Imported inventory and physical-copy rights are stored privately on the server to prevent double placement; other carers see only objects placed in the room. Subscription gifts use an expiry verified by Apple. Inventory migration and purchase fingerprints may remain without expiry to prevent reuse, without chat text or credentials. After deletion, purchase markers retain only opaque source fingerprints (installation, receipt and purchase/spend counters); house, member and device links, the request digest and attributed timestamps are removed. From version 2.2 you can separately enable weekly race alerts: overtakes and the end of the race, for cats you follow or brought into the house. The server keeps this preference and the timezone chosen by the phone to respect alert hours; aliases appear only when “Cat stories” is enabled and they are not hidden. Seasonal items acquired during the sale retain a permanent proof unattributed to any device, member or house, with the technical purchase-source data needed to prevent duplication: it preserves the right after the sale or subscription ends. Erasure removes links to the actor; opaque barriers may remain without expiry to prevent requests already in flight from recreating erased data or rewards.
• Minigames and leaderboards: free play stays on your device. Online challenges use a hash of your device identifier; boards display a MICIO alias, never kitten names or chats. First-life moves are kept for up to 24 hours to verify results. Records, daily and weekly progress, prize receipts and deduplication proofs are kept for up to 120 days. Friends and house members see scores only through a valid connection. Kid mode sends no games or scores, shows no online boards and withdraws previously published scores. Data erasure removes private data and immediately hides records; technical withdrawal markers expire within 120 days. Equipped accessories are not sent for score verification.

What we do NOT collect

No Apple Account sign-in, email or precise location, and no advertising tracking. If you use a shared house, membership uses the house and member identifiers described above.

Deletion

In Settings → "Reset identifier and delete data" the app asks the server to delete the counters, visit codes, invite code and redemption, App Attest key, friendship tokens and notices tied to your identifier (where it appears in other people's rows, such as the list of who redeemed an invite, it is replaced by a pseudonym) and generates a new one: from then on nothing on our servers can be linked to your phone. Uninstalling the app erases local history but not the identifier, which stays in the Keychain: use that button before uninstalling if you want it gone. If iCloud Backup is on, an encrypted copy of the diary stays in your backup until you delete or overwrite it. Questions: mattiamellone@gmail.com. Deletion also covers Houses: it removes your membership and records attributed to you. If other members remain, the shared cat and state remain for them; duplicate-prevention markers linked to the house, cat and pile, without a member identifier, may remain without expiry. If you had registered notifications, the raw token is deleted and the disabled record expires within 120 days. While a deletion is in progress the server keeps a request row with the old identifier; once it is done, it keeps for up to 120 days only a digest and an encrypted receipt that only your phone can read, so that an interrupted deletion can be completed. If the request comes from an app that cannot sign it with its App Attest key (versions before 2.0, or a phone without a registered key), that key is not deleted at once: it stops being used and the nightly cleanup removes it after 180 days of inactivity, so that knowing an identifier is not enough to cut someone else's phone off.