Back to Miru

Miru Privacy Policy

Last updated: April 16, 2026

This privacy policy describes which data the iOS app Miru processes, for what purpose and on what legal basis. It complements the general privacy policy for davedinapoli.de.

1. Controller

Dave Di Napoli
(Address: see imprint)
Email: info@davedinapoli.de

2. What Miru is

Miru is an iOS app that records spoken language, transcribes it locally on the device and automatically separates speakers based on their voice characteristics (voice embeddings). After every recording you assign the detected clusters to real people, give them names or discard them. You can then share the finished transcript as TXT, Markdown or PDF.

Miru is explicitly designed to collect as little data as possible and to generate no traffic to third parties. There are no advertising trackers, no analytics, no crash reporters, no third-party SDKs.

3. Categories of processed data

a) Microphone audio

During an active recording Miru captures audio via the iPhone microphone. The recording is processed locally only — speech recognition runs offline via WhisperKit (OpenAI Whisper via CoreML). On first launch, while the offline speech model is downloading and compiling, Miru temporarily uses Apple’s built-in speech recognition (SFSpeechRecognizer) as a bridge. This runs with requiresOnDeviceRecognition enabled — no audio leaves the device in this mode either. Once the offline model is ready, Miru automatically switches to WhisperKit. The raw audio file is held in a temporary location only as long as the speaker assignment sheet for the just-finished recording is open. Once you confirm or cancel the assignment, the raw audio is deleted. The raw audio file is never uploaded.

b) Voice embeddings (biometric data)

For every committed speech segment Miru computes a 256-dimensional embedding using the WeSpeaker model (via FluidAudio, CoreML). These embeddings are biometric data for the unique identification of a natural person within the meaning of Art. 9 GDPR. They are stored alongside the assigned speaker (locally and, if synced, on the backend) and serve solely to recognize the speaker in future recordings.

Important: Embeddings are not audio recordings and cannot be reverted into intelligible speech. They are nevertheless biometric data and are protected accordingly.

c) Transcripts and speaker metadata

The transcribed text, speaker names (assigned by you), timestamps, cluster IDs and an automatically generated title are stored in the local SwiftData database and — if signed in — synced to a Supabase instance (see section 5).

d) Account data

Miru uses Sign in with Apple for authentication. Apple provides an anonymized subject identifier token. A real email address or name is only passed if you explicitly consent on first login. By default Miru only sees the anonymized ID.

e) Debug data (optional)

If you enable debug mode in Settings, you can rate per cluster in the speaker assignment sheet whether the automatic recognition was correct or wrong. This stores a SpeakerEvaluation record with the cluster score, verdict and the relevant segment text. These records serve solely the internal improvement of speaker recognition. You can delete them at any time via the “Delete debug data” button.

4. Purposes and legal bases

  • Provision of app functionality (recording, transcribing, separating speakers, exporting) — Art. 6(1)(b) GDPR (contract); for the processing of biometric data additionally Art. 9(2)(a) GDPR (explicit consent). Consent for the processing of voice embeddings is given by explicit confirmation in the speaker assignment sheet after each recording. You can withdraw consent at any time by deleting the relevant speaker in the app.
  • Sync between device and backend — Art. 6(1)(b) GDPR. Sync can be effectively disabled by signing out; local data stays.
  • Improving recognition quality (debug data) — Art. 6(1)(a) GDPR (consent through explicit activation of debug mode).

5. Third parties and data transfer

Hugging Face (model download)

On first launch Miru downloads a Whisper speech model from Hugging Face once (~470 MB to ~1.5 GB depending on the selected quality tier). Speaker separation uses a WeSpeaker model (via FluidAudio, bundled with the app). After that, all speech recognition and speaker separation runs entirely offline. There is no ongoing transmission of audio to Hugging Face, OpenAI or any other third party.

Apple

For authentication, Sign in with Apple is used — Apple is an independent controller for that. Additionally, on first launch Miru temporarily uses Apple’s on-device speech recognition (SFSpeechRecognizer) as a bridge until the offline speech model is ready. This processing happens entirely on device (requiresOnDeviceRecognition = true) — no audio data is transmitted to Apple.

Supabase (backend)

Conversations, segments and speaker data are synced to a Supabase instance operated by me. Supabase Inc. is a processor within the meaning of Art. 28 GDPR. Data is stored in an EU data center. The contractual basis is Supabase’s standard DPA.

No transfer to other third parties takes place. In particular no ad networks, no analytics providers, no LLM providers.

6. Retention

  • Raw audio: only during a recording + until the assignment sheet is confirmed or cancelled, then immediate deletion of the temp file.
  • Embeddings, transcripts, speaker data: until you actively delete them or remove your account. There is no automatic deletion.
  • Tombstoned data (something you deleted): hard-removed from the backend after successful sync.

7. Your rights

You have the following rights under GDPR:

  • Access (Art. 15) — all your data is directly viewable in the app. On request you also receive it in machine-readable form by email.
  • Rectification (Art. 16) — speaker names can be renamed in the app at any time.
  • Erasure (Art. 17) — individual conversations, speakers and debug data can be deleted in the app. On request I will also delete your entire account including backend data.
  • Data portability (Art. 20) — the export feature delivers TXT, Markdown and PDF of your conversations.
  • Withdrawal of consent (Art. 7(3)) — withdraw consent for processing voice embeddings by deleting the relevant speaker.
  • Complaint to a supervisory authority (Art. 77).

Requests please to info@davedinapoli.de.

8. Recording other people

Important: if you use Miru to record conversations involving other people, you as the user are responsible for obtaining the consent of those people. Recording conversations without the knowledge of those involved may be a criminal offense depending on jurisdiction. Miru cannot verify this technically — the responsibility is yours.

9. Changes to this policy

This policy may be updated when app functionality changes or the legal situation evolves. The current version is always available at this URL; the date above shows its state.