Privacy Policy

In short

• Who. Miko is a product of Slow and Steady AS, a Norwegian company. We are responsible for the personal data described here. Questions go to contact@getmiko.app.
• Your work stays private. What you type, what your terminals show, your approvals, the notifications from your machine and your connections are end-to-end encrypted between your devices and your machines. Our gateway and central service pass them along, and keep your connections only in sealed form, but can't read them. Section 3 explains what our systems can and can't read, and the limits.
• What we do see is what we need to run Miko: your account e-mail, how you sign in, your devices and machines, and technical data such as when they connect and how much traffic your machine uses.
• Where. Your Miko Cloud machine, our central service and our encrypted backups of both are in Canada. A few providers process limited data elsewhere, for example e-mail delivery in the USA, and web traffic to Miko passes through Cloudflare's network on its way (section 6 and Annex A).
• Your AI providers are your own. You sign in to them inside your machine. What your agents send them goes straight from your machine to the provider, under its terms.
• No selling, no ads, no third-party tracking. We don't sell personal data, show ads or use third-party analytics or tracking. We don't use your content to train AI models.
• Payments are handled by Paddle, which sells the subscription and is responsible for the payment data it collects.
• You're in control. Download your account data or delete your account in Settings, and write to us for anything else. You can also complain to Datatilsynet, the Norwegian data protection authority.

1. Who we are and how to reach us

Miko is a product of Slow and Steady AS, a Norwegian limited company registered in the Register of Business Enterprises (Foretaksregisteret), org. no. 937 286 120, Svortlandsvegen 65, 5430 Bremnes, Norway. "We" and "us" mean Slow and Steady AS. "You" means the person using Miko or visiting our website.

We are the controller for the personal data this policy describes. For the content in your machine, section 5 applies.

• Privacy, support, security and abuse reports: contact@getmiko.app (for abuse, please use the subject line "Abuse")
• Phone: on our contact page
• Post: Slow and Steady AS, Svortlandsvegen 65, 5430 Bremnes, Norway

We have not appointed a data protection officer. One person at Slow and Steady AS is responsible for privacy, and you reach them at contact@getmiko.app about anything in this policy.

We are established in Norway. The EU General Data Protection Regulation (GDPR) applies to us through the EEA Agreement and the Norwegian Personal Data Act.

2. What this policy covers

It covers:

• our website, getmiko.app, including the waitlist;
• the Miko web app, including when you add it to your home screen;
• Miko Cloud: your machine in our cloud, on the Starter plan or a Cloud plan (Cloud 16, Cloud 32 or Cloud 64);
• Miko Connect: Miko's software (the "Host") on computers you connect yourself;
• the Miko apps for iPhone and Mac;
• our e-mails, notifications and support.

It doesn't cover the following. Others are responsible for these, under their own terms and privacy policies:

• Your AI providers. Miko doesn't sell or include AI. You bring your own subscriptions or API keys, for example for Claude or ChatGPT. What your agents send goes from your machine straight to the provider.
• Your connections and tools. Services you connect or your agents use, such as GitHub, Vercel or MCP servers, get data from your machine directly.
• Paddle. Paddle sells your subscription as merchant of record and handles payment under its own privacy notice. Section 4.6 covers what we receive from Paddle.
• Your own servers and devices. Computers you connect with Miko Connect, and your own phones and computers, are yours. This policy covers only what Miko's software on them sends to us.
• Apple's, GitHub's and Google's own services, such as your Apple ID or your GitHub or Google account, under their own privacy policies.

The content you keep in your machine is covered by section 5.

3. What stays private, and the limits

Miko is built so that your work passes through our gateway and central service without them being able to read it. Your devices and your machines (Miko Cloud machines and computers you connect) set up end-to-end encrypted connections, with keys they create themselves. Our gateway carries this traffic but can't read it. "The limits, plainly" below explains what this doesn't cover.

What our gateway and central service can't read:

• what you type and what your terminals show;
• your approvals and your answers to your agents;
• the contents of notifications from your machine (your machine encrypts them for each of your devices);
• the contents of your vault: your connections' keys and tokens are sealed so that only your machines can unlock them (and your own devices, if you recover your keys); the names and settings of your connections are sealed so that only your devices and machines can read them;
• your AI-provider sign-ins (they stay in your machine), and the AI accounts, plans and usage the app shows you;
• the names of your machines and projects, and your layouts, which are kept in a sealed directory that only your devices can read;
• your routines and notes, which are sealed so that only your devices (and, for a routine, the machine that runs it) can read them.

What we can see (details in section 4):

• your account e-mail address and how you sign in;
• your devices: their names, public keys, when they were approved or removed, and a short browser and system summary such as "Safari on iPhone";
• your machines: their ids, plan, operating system and version, and whether they're online; for Miko Cloud machines, also how much of their disk and memory they use;
• for a Starter machine: whether an agent in it is working or waiting for you, and how many of your devices are connected (counts only), so it can sleep when nothing is happening;
• the IP addresses your devices and machines connect from (stored only shortened, see section 4.3);
• which device talks to which machine, when, and the timing and size of the encrypted messages. This can show when you're typing, but not what;
• notification metadata: push addresses, timing and type, and your quiet-hour settings and time zone;
• vault metadata: how many items you have, their padded sizes and when they were written;
• the next time a routine needs your machine awake;
• traffic and CPU numbers for each machine;
• the text of our own security notices, such as "New sign-in";
• Preview traffic, which is encrypted on its way to our gateway and processed there in memory, not stored.

The limits, plainly:

• Your Miko Cloud machine runs on servers we operate. On Cloud plans, your machine's memory is encrypted by the processor (AMD SEV-SNP). Miko's own software also runs inside your machine, with access to what's in it (see "Our software" below). On Starter, the server your machine runs on holds a key that unlocks its disk, and it can read the machine's memory while it runs. So our administrator could technically access the machine and everything in it, including your AI sign-ins. We give access to our servers only to our own administrator. To run and support our service, the administrator uses AI tools from Anthropic under business terms. They can see account data, such as e-mail addresses and names, when we need to look into something (Annex A). We never use them to look at the contents of your machine, and Anthropic may not use this data to train its models. Our server providers' staff can physically reach the servers in their data centres, under their contracts with us. We never look at the contents of your machine, except when you ask us to (for example for support) or the law requires it.
• Backups. Backups of your machine are encrypted inside your machine before they are stored with our backup provider, which can't read them.
• Your AI sign-ins. You sign in to each AI provider through the provider's own login, inside your machine. Your sign-in stays in your machine. It leaves your machine only inside its encrypted backups, when we move your machine between servers, or in a file export to your device if you choose to include it. Miko never asks for it, and it never reaches our central service or our gateway in readable form.
• Preview is private to you, but unlike your terminals it isn't end-to-end encrypted. Its traffic is encrypted to our gateway, which relays it in memory.
• Metadata. The timing and size of encrypted traffic, and the other items listed above, are visible to us.
• Our network provider. Traffic to our website, web app, API and gateway passes through Cloudflare's network, which protects it against attacks and overload. Cloudflare decrypts this web traffic at its data centre nearest to you, which is often outside Canada, before passing it on to our servers. That includes sign-in, account and billing data, such as your e-mail address, sign-in codes, your session cookie and the order details Paddle sends us. Cloudflare doesn't keep the contents of this traffic. It keeps records of the requests (such as your IP address, the address requested and your browser) for a limited time, and uses traffic data to protect its network. It can't read what's end-to-end encrypted inside, such as your terminals, approvals and notifications from your machine.
• Our software. The web app and Miko's software on your machines come from us, and the encryption depends on that software doing what it should. We serve the web app each time you open it, through Cloudflare's network (above), so it also depends on Cloudflare delivering it unchanged. Miko's software on your machines checks the signature of each update before it installs it. When you first connect to a new Miko Cloud machine, your devices trust the machine key that our service gives them.

4. What we collect and why

For each situation below we say what we collect, why, and our legal basis under GDPR Article 6(1):

• Contract (b): to provide what you signed up for, or to take steps you asked for before signing up.
• Legal obligation (c): where a law requires it, such as bookkeeping law.
• Legitimate interests (f): where we have a good reason that doesn't override your rights. We name the interest each time, and you can object (section 10).
• Consent (a): only where we ask for it. You can withdraw it at any time.

How long we keep each kind of data is in Annex B.

4.1 Website and waitlist

• Visiting getmiko.app. Our website runs on Cloudflare, which processes your IP address and browser details to deliver the pages and protect the site, and keeps them in its logs for a limited time. The website doesn't set cookies of its own, doesn't store anything in your browser, and doesn't use analytics or tracking. Paddle's code, which will run on one of our pages once paid plans open, is described in section 11.
  • Legal basis: legitimate interests (running and protecting our website).
• Joining the waitlist. We keep your e-mail address, the pricing card or page you came from, the referral code in the link you used (if any, section 4.8) and when you signed up. If you answer the optional questions (what you use today, the computer you code on, what you would pay and how many agents you run), we keep your answers too. Sign-ups are stored with Upstash.
  • Why: to send your invitation, and to use the answers to decide what to build first.
  • Legal basis: steps you asked for before a contract (your e-mail address, for the invitation); legitimate interests (knowing which plan interests you, where you came from and when you joined); consent (your optional answers, which you can withdraw at any time by asking us to delete them).
• Your invitation. When we invite you, we copy your waitlist entry to our central service to create the invitation.

We don't use your waitlist e-mail address for news or offers unless you agree (section 12).

4.2 Account and sign-in

• Account: your e-mail address, an account id, when the account was created, and your account settings (for example "Only allow passkeys").
• Passkeys: the public key and the technical details your passkey provides (an id, a counter and the type of authenticator), a name such as your browser and system, and when it was created and last used. The private key stays on your device or in your password manager.
• One-time codes by e-mail: we e-mail you a code and a link. We store only a scrambled (hashed) version of them, for at most 24 hours. For a sign-in, we don't store your e-mail address with it. Our e-mail delivery provider keeps a copy of each e-mail, including the code and the link, for up to 45 days (Annex B).
• Sign in with Apple (if you choose it): Apple's identifier for you, the e-mail address Apple gives us (which may be a private relay address), and an Apple token. We keep the token encrypted and use it only to disconnect Apple when you delete your account, or if you ask us to unlink it. We don't store your name.
• Sign in with GitHub or Google (if you choose it): the provider's identifier for your account and your e-mail address, which the provider has verified. We ask only for your identity, use the provider's token once to confirm who you are, and never store it. We don't keep your name, username or picture from either provider. If the verified e-mail address matches an existing Miko account, the sign-in method is added to that account, usually after you enter a code we e-mail to that address, and we tell your devices and e-mail you. This isn't possible if the account only allows passkeys or is in account recovery; then you sign in with your usual method first. Signing in this way doesn't connect GitHub to your agents; that's a separate connection you choose in Connections.
• Terms you accepted: when you sign up, which versions of our Terms and other published policies you were shown and accepted, how you signed up and when. Legal basis: legitimate interests (being able to show what was agreed).
• Sessions: a hashed session id, how and when you signed in, the device, and a short browser and system summary.
• Recovery key: we never store your recovery key, or your account key, in readable form. We keep only encrypted copies that your recovery key or your passkeys unlock.
• Account recovery: if you lose all your passkeys and start a recovery, we keep the request with a short browser and system summary. During the 72-hour hold we e-mail you and notify your devices and machines.
• Bot check: at sign-up, at account recovery, and at sign-in after repeated attempts from one network, Cloudflare Turnstile checks that you're a person. Cloudflare receives your IP address and signals from your browser. It runs the check for us, and also uses these signals for its own purpose of improving its bot detection, under its own privacy terms.
• Abuse limits: we limit how many sign-ups, codes and recoveries can come from one e-mail address or network, using shortened network addresses held in memory. We refuse disposable e-mail domains at sign-up.
• Why: to create your account, let you sign in safely, and keep accounts and Miko secure.
• Legal basis: contract (your account and sign-in); legitimate interests (security, and preventing fraud and abuse, including the bot check).

You need an e-mail address and a way to sign in to have an account. Without them we can't provide Miko.

4.3 Devices and security

• Devices: the type (web, iPhone or Mac), the name you give it (and the name it was first added with), its public keys, how and when it was approved, when it was last seen, and when it was removed. A signed log of these changes lets your devices and machines check each other. A device that hasn't been seen for 90 days stops being trusted.
• Connections: the IP address your devices and machines connect from; which device connects to which machine, when and for how long; and the timing and size of the encrypted messages.
• IP addresses: we use the full address while you're connected, to route traffic and limit abuse. In our app logs and security events we store it only shortened: the network part of an IPv4 address (/24) or an IPv6 address (/48). Two exceptions: the logs that protect administrator access to our servers keep full IP addresses for 14 days, and Cloudflare, which carries web traffic to Miko and runs the bot check, receives your full address and keeps it in its logs for a limited time (section 3).
• Security events: sign-ins, added and removed devices, recoveries, exports and similar events, with the time, the shortened IP address, the device and a browser summary. You can see them in Settings.
• Server logs: technical records such as ids, the type of request, status, response time, error codes and the shortened IP address. They never contain what you type, your files, tokens or keys.
• Why: end-to-end encryption, approving and removing devices, showing you your account activity, and keeping Miko secure.
• Legal basis: contract; legitimate interests (security and preventing abuse).

4.4 Your machines and Miko Connect

• Every machine: its id, type (Miko Cloud or a computer you connect), plan, operating system and version, processor architecture, the version of Miko's software, when it was added and last seen, and whether it's online or asleep. The name you give a machine is sealed (section 3).
• Miko Cloud machines. We run your machine, and our server provider stores its encrypted disk. We also record:
  • the traffic your machine sends and receives, counted in bytes per month;
  • its CPU use, measured from the server without looking inside your machine;
  • how much of its disk and memory it uses, for example to check that a smaller plan fits;
  • for a Starter: whether an agent in it is working or waiting for you, and how many of your devices are connected (yes or no, and counts only, never what they are), so it can sleep when nothing is happening;
  • fair-use events, such as a slowed connection or a CPU limit, including a limit we keep after a review (section 9 of our Terms), and the notices we send you about them.

  Our network can technically see which internet addresses your machine connects to. What we record is the amount of traffic, and how often your machine hits our network limits (for example, outgoing e-mail on port 25 is blocked for every machine). When we handle an abuse report, a person may also look at the connections machines have open at that moment (section 4.7).

• Backups. Your Miko Cloud machine is backed up daily, encrypted inside the machine before it leaves (section 3).
• Sleeping and routines. A Starter machine sleeps when nothing is happening. To wake it in time for a routine, we store the next time it needs to be awake.
• Your vault (connections). We store your connections, keys and tokens as sealed items we can't read. We see how many there are, their padded sizes, when and by which device or machine they were written, and which machines may use each one.
• Miko Connect. When you connect a computer, Miko's software (the Host) is installed on it. It creates its own system users, adds a background service and updates itself automatically.
  • Pairing details such as the computer's name, processor, memory and free disk go to your browser encrypted, not to us. We receive the details listed under "Every machine" and the IP address the computer connects from.
  • To check for updates, the Host downloads our signed list of releases. That request shows your computer's IP address to the service that hosts our downloads. It sends no account or machine id.
  • The installer also downloads the AI provider's official command-line tool (for example Claude Code) from the public npm package registry, directly from your computer.
  • We don't back up computers you connect, and we never delete your files on them. Uninstalling Miko's software is up to you; a plain uninstall keeps your files and AI sign-ins (see our docs).
  • If you send us diagnostic output, for example from miko-host doctor, we use it only for support (section 4.7).
• Why: to run your machines and connect them to your devices, apply your plan's allowances and fair-use rules, and keep Miko secure and fair for everyone.
• Legal basis: contract; legitimate interests (fair use, security and preventing abuse).

4.5 Preview, Routines and notifications

• Preview. When you open a preview of something running on your machine, the traffic between your browser and your machine passes through our gateway, encrypted on the way. While relaying, the gateway handles the pages and data in memory only. We store and log only a preview id, the machine, the port number, an address for the preview that reveals nothing about you, the times, the status and byte counts. Previews open only on devices you've approved and can't be shared with others. For a Miko Cloud machine, the bytes count toward your plan's monthly traffic allowance. For computers you connect, previews count toward a separate preview allowance of 250 GB per month for your account, shared by all the computers you connect. We tell you at 80 %, and above it previews from those computers are slowed to 100 Mbit/s until the 1st of the next month.
• Routines and notes. What a routine does and the notes you keep are sealed. We store them encrypted and padded in fixed-size steps, so their size reveals little. We learn only the next time a machine with routines needs to be awake. Each machine keeps its own history of runs (the outcome, the times and a short preview of the result) on the machine.
• Notifications (if you turn them on). We send them through your browser's push service (Apple, Google, Mozilla or Microsoft, depending on your browser) or, in the iPhone app, through Apple's push service.
  • Notifications from your machine are encrypted on the machine for each of your devices.
  • We and the push service see your device's push address, the type of notification, when it was sent and its size.
  • We keep a delivery log (the event, device, machine, type, status, and when it was delivered, shown and tapped; never the contents) and your notification settings (which types, quiet hours, days and your time zone).
  • When you answer from a notification, we see which device answered and when, but not the answer.
  • Signing out on a device deletes its push address.
• Our own notices, such as "New sign-in", "A device wants to join your Miko" or "Machine offline", are written by our servers from data we already hold, so we know their text. Browser notifications carry them encrypted. Apple's push service carries only general text for them.
• Why: to provide these features and to warn you about security events.
• Legal basis: contract. Security notices are part of keeping your account safe, so you can't switch them off.

4.6 Billing through Paddle

Paddle sells the subscription and is the merchant of record. Paddle collects your payment details, billing address and tax details as an independent controller, under its own privacy notice. We never see your full card number. To subscribe you must give Paddle your payment and billing details; without them we can't start a paid plan.

• What we receive from Paddle, not from you directly: your name, e-mail address, billing address and country; Paddle's customer, subscription and transaction ids; what you bought and paid; the type of payment method and, for a card, its brand, last four digits, expiry date and the cardholder's name; and the status of payments, refunds and payment disputes. We use these card details only to make a keyed hash (see "Offers and bans" below). Apart from Paddle's own messages to us, which we keep encrypted for 90 days, we don't store them.
• What we send to Paddle: your e-mail address (to fill in the checkout) and references that link the order to your Miko account: account and checkout ids, the plan and any offer, the id of your consent record, and the referral code if you came through one (section 4.8).
• What we keep ourselves:
  • your plan and its status, Paddle's ids and the amounts, and the dates of your subscription and withdrawal period;
  • a record of what you agreed to at checkout (the versions of the terms and policies you accepted, automatic renewal and starting before the withdrawal period ends), and of any agreement to a new price we ask you for (section 5 of our Terms), with the time and your shortened IP address;
  • a record of each withdrawal you send us: what you entered (your name, the contract and the e-mail address for our confirmation), when you sent it, and the confirmation we sent you;
  • Paddle's messages to us about your orders, stored encrypted.
• Sanctions. We check your billing country against the places we're allowed to serve. At checkout we also look up which country your IP address belongs to. If it's a place under full sanctions, we refuse the order; any other mismatch is only flagged for a person to review. If there's reason to suspect a sanctions match, we pause your account and a person checks your name against public sanctions lists before deciding.
• Offers and bans. When you use the launch offer, when an account is deleted or banned, or when a payment dispute is decided in your favour, we keep keyed hashes of the e-mail address and, where we have them, of the card details above, not the address or the card details themselves. That way a launch offer can't be used twice and a ban can't be avoided by signing up again. Section 13 says what happens automatically and what a person checks.
• Why: to provide your plan, apply offers, handle cancellations, withdrawals, refunds, failed payments and disputes, and keep our accounts.
• Legal basis: contract; legal obligation (bookkeeping, sanctions rules and consumer-law duties); legitimate interests (being able to prove what you agreed to, preventing offer abuse and fraud, and handling disputes and claims).

4.7 Support and abuse reports

• Support. When you write to contact@getmiko.app or call us, we process your contact details, what you tell us, any files or diagnostic output you send, and our replies. Our e-mail runs on Microsoft 365. If you ask us to look at something in your machine, we look only at what's needed to help you.
• Feedback in the app. If you send feedback in the app (in Settings or the command menu), we keep what you write, the category you choose (bug, idea, question or other), the app and its version, and your account id. We keep it for 90 days, or until you delete your account if that's sooner. Your text never goes into our logs. Our administrator reads it, sometimes with help from AI tools (section 3).
• Abuse reports. Abuse reports go to the same address, contact@getmiko.app, with the subject line "Abuse". For each report, we keep who reported it (if they tell us), what they reported, and what we decided and why. We don't tell the account owner who reported them, unless the reporter agrees or the law requires it.
  • If a report concerns your account, we look only at technical data: traffic, CPU and resource use and, to find which machine a report is about, the network connections machines have open at that moment (addresses, ports and times, never content). We keep what we find only in the case record (Annex B). We never open the files in your machine.
  • A person decides what to do. When our Terms allow it, that person can act at once, without warning you first: limit, suspend or stop your machine, or end your subscription. A suspension stops your machine and deletes nothing.
  • We tell you in writing what we did and why, unless the law or an authority doesn't allow it, and you can object within 14 days (section 17 of our Terms).
• Legal basis: contract (support); legitimate interests (improving Miko from your feedback, handling abuse, protecting other customers and our systems, and handling legal claims); legal obligation where the law requires us to act or report.

4.8 Closed-beta referral links

• Some people who test Miko in our closed beta share a personal link, such as getmiko.app/?ref=name. If you arrive through one, the code is carried through the website's links (no cookie and no browser storage) and stored with your waitlist entry, with the time. If you join the waitlist again through another person's link, the newer code replaces the old one; joining again without a code doesn't change it. Once the code is stored with your account, it isn't changed. We also pass it to Paddle with your order.
• If you're a tester, we know which code is yours. We also keep how we contact you (for example your handle on X). Once a month we look at your public posts about Miko and how many people your link brought in, to check that your posts are labelled as ads and to decide whether your free access continues.
• Why: to count how many people each link brings in, and to run our beta programme.
• Legal basis: legitimate interests (measuring and running our beta programme, and following advertising law). You can object.

4.9 Setup measurements, without content

• We record when your account first reaches each step in a fixed list of setup steps, such as signing up, adding a machine, signing in to an AI provider, starting your first agent, connecting GitHub or getting a notification on your phone. The app reports each step when you reach it, and we record only the step and the time, never anything you type or name. This shows us where people get stuck.
• These records are deleted with your account.
• Error counts. If something goes wrong in the web app, for example part of a page fails to load or the connection drops, the app adds one to a daily count for that kind of error. We keep only the day, the kind of error and the count, never your account or any details, for 90 days. If you object to setup measurements, the app doesn't count your errors either.
• Legal basis: legitimate interests (improving setup). You can object (section 10). We then delete these records and stop recording them for your account.

4.10 The iPhone and Mac apps

• iPhone app. It works like the web app (sections 4.2 to 4.5). On your iPhone it also keeps:
  • the keys for your notifications and a token for answering them, in the iOS Keychain, on this iPhone only (they don't move to a new phone);
  • the names of your machines, agents and accounts, in the app's own storage, so notifications can show them.

  Face ID or your passcode is checked by iOS. The app only learns whether the check succeeded, and we receive no biometric data. The Lock Screen activity (counts and, unless you turn on "Hide details", the name of an agent) is produced on the phone and doesn't go through us or Apple. The app has no tracking and no third-party analytics.

• Mac app. When it connects to your machines, it works like the web app. When it runs agents on your Mac itself, it keeps projects, terminals and app state in a local database on your Mac and sends none of it to us. In that mode:
  • each AI tool talks directly to its own provider;
  • AI tools keep their own sign-ins on your Mac. To show which account is signed in and how much of its limits is left, and to keep some tools signed in, the app reads parts of those sign-ins on your Mac. It uses them only on your Mac and with the provider they belong to;
  • keys you enter in the app (for example for extensions or the optional research assistant) are encrypted by macOS on your Mac;
  • if you turn on the optional DeepSeek research assistant, it sends your project's source code to DeepSeek, using your own DeepSeek key. DeepSeek processes data in China, under its own terms. The app leaves out files that look like secrets, such as .env files and keys, but it can't promise to catch every secret;
  • SSH connections to your own servers go directly from your Mac to them.
• Legal basis: contract.

4.11 Where the data comes from

Most of the data comes from you, or from your devices and machines. We also receive:

• billing data from Paddle (section 4.6);
• your Apple identifier and e-mail address from Apple, if you use Sign in with Apple, and your account identifier and verified e-mail address from GitHub or Google, if you sign in with them (section 4.2);
• the result of the bot check from Cloudflare (section 4.2);
• the country your IP address belongs to, from a geolocation database, at checkout (section 4.6);
• reports about an account from people who report abuse (section 4.7).

5. Your content in your machine

Your machine holds what you and your agents create: code, files, terminal history, your AI tools' sign-ins, and any personal data you put there, for example your own customers' data.

• You decide what goes into your machine and what happens to it, and you're responsible for that content.
• If you're a business, or use Miko for your work, you are the controller for personal data in your machine and we are your processor. We store and process it only to run Miko for you, as you instruct through your use of the service. If you need a data processing agreement (GDPR Article 28), write to contact@getmiko.app and we'll agree one with you. The subprocessors that may handle that content are in Annex A: for Miko Cloud, our server provider hosts the servers your machine runs on and our backup provider stores its encrypted backups, while our central service and Cloudflare only pass on encrypted traffic, and our central service relays previews.
• If you use Miko privately, we handle your content the same way: only to provide the service, under our contract with you.
• We don't look at it, sell it or use it to train AI models. We access it only as section 3 describes: when you ask us to, or the law requires it.
• Questions from others. If someone asks us about personal data in your machine, we refer them to you.
• Computers you connect are yours. We don't store or back up their contents.

6. Where your data is stored

In Canada: your Miko Cloud machine and its disk; our central service (the account database, the API, the gateway that relays your encrypted connections and previews, and the notification relay), which runs on servers we rent from OVHcloud's Canadian company, OVH Hosting Inc. (Hébergement OVH Inc.); and our encrypted backups of your machine and of our central database.

Elsewhere (details in Annex A). Your data doesn't all stay in Canada. A few providers process limited data in other places:

• Sign-in and service e-mails are sent through Postmark, in the USA.
• The bot check runs on Cloudflare's global network.
• Notifications are carried by Apple's push service (iPhone app) or your browser's push service (Apple, Google, Mozilla or Microsoft). The contents from your machine are encrypted.
• Payment data is processed by Paddle (Paddle.com Market Ltd in the UK and Paddle.com Inc. in the USA) as an independent controller.
• The website runs on Cloudflare's global network, and the waitlist is stored with Upstash, in the USA.
• Web traffic to Miko (the website, web app, API and gateway) passes through Cloudflare's network on its way to our servers in Canada (section 3).
• E-mails you send us are kept in Microsoft 365. Microsoft may store and process them in the EEA and the USA.
• Backblaze, our backup provider, is a US company and keeps its own records about our account in the USA. Your backups stay in Canada.
• Administration. Our administrator manages our servers remotely, sometimes from outside Canada and the EEA. In an emergency, such as a long outage at our backup provider, the administrator may keep an encrypted copy of our central database on their own computer until our normal backups work again.
• Running our service. Our administrator uses AI tools from Anthropic to help run and support our service. Account data they work with, such as e-mail addresses and names, may be processed in the USA (Annex A).
• Your AI providers and connections process data wherever they are, under their own terms.
• Computers you connect, and your own devices, are wherever you keep them.

How transfers are protected:

• Canada: the European Commission has decided that Canada protects personal data adequately for commercial organisations covered by Canada's federal privacy law (PIPEDA) (Decision 2002/2/EC, confirmed in the Commission's January 2024 review). The decision applies in Norway through the EEA Agreement. The UK recognises it too.
• USA: where a provider is certified under the EU-US Data Privacy Framework and its terms use it, we rely on that. Otherwise, and as a fallback, we use the EU Standard Contractual Clauses. Annex A says which applies to each provider.
• UK: the European Commission's adequacy decision for the UK.
• People in the UK and Switzerland: we rely on the UK and Swiss versions of these safeguards where they apply.
• Push services: your browser (or, for the iPhone app, your phone) chooses the service, and we have no contract with it. Google and Microsoft are certified under the EU-US Data Privacy Framework. We have no transfer agreement with Apple or Mozilla for this. We send them only what's needed to deliver the notifications you turned on: a push address, general text, and the contents encrypted so they can't read them.

Companies based in the USA can be required by US law to hand over data they hold, even data stored in Canada. The encryption in sections 3 and 9 means they can't read what you type or your files. It doesn't cover data that providers handle in readable form, such as web traffic passing through Cloudflare (section 3).

You can ask us for a copy of the safeguards that apply.

7. Who we share with

• Our subprocessors (Annex A, part 1) process personal data for us, only as needed for their task and under data processing terms.
• Independent controllers (Annex A, part 2): Paddle, for checkout and payment; Apple, if you use Sign in with Apple or the iPhone app's notifications; and GitHub or Google, if you sign in with them. Cloudflare is one too when it uses traffic data, including bot-check signals, to protect its network and improve its security services (sections 3 and 4.2). They are responsible for their own processing.
• Push services (Annex A, part 3) are chosen by your browser and carry your notifications encrypted.
• Your own choices. Your AI providers, your connections and the tools your agents use get data from your machine because you set them up. They are not our subprocessors (Annex A, part 4).
• Authorities. We give personal data to authorities only when Norwegian law, or another law we must follow under the GDPR, requires it, for example under a court order, and to report child sexual abuse material. We check requests from outside the EEA against the GDPR before we answer. We give only what is required. Where the law allows, we tell you.
• Advisers. Professional advisers, such as a lawyer, when we need their advice, under a duty of confidentiality.
• If the business changes hands. If Slow and Steady AS or Miko is sold or merged, your data may pass to the new owner, who must keep to this policy. We'll tell you before that happens.

We never sell personal data. We don't show ads, and we don't share personal data for advertising.

8. How long we keep it

We keep personal data only as long as we need it for the purposes in section 4, or as long as the law requires. Annex B gives the period for each kind of data.

• When you delete your account, we hold it for 7 days so you can restore it, then remove it from our live systems. In its place we keep a deletion record (the account id and the date, nothing else) until our backups no longer contain the account, so a deleted account isn't brought back by mistake, for example from a backup. Legal basis: legitimate interests; you can object (section 10). What else we keep after deletion, and why, is in Annex B.
• Our central database is backed up, encrypted, on a rolling schedule. These backups, including the records that let us restore the database to an earlier point in time, are kept for at most 30 days. We also keep the last 7 daily copies of the database on the central server itself, unencrypted, for quick restores; none is older than 8 days. Our hosting provider keeps a copy of the running server's disk, including those copies, for 24 hours (section 9), so deleted data can remain there for up to 9 days. When we replace a server, we wipe it first; if that's impossible, the provider keeps its data for up to 30 days after we cancel it. We never use any of these copies to bring back a deleted account. In the rare case that we restore our database from a backup, accounts deleted since that backup are deleted again at once, before the service runs; traces of them can then remain in our encrypted backups for up to 30 days after the restore.
• So your account is fully gone within 37 days of your request, or a few hours more when more machines on the same server are waiting to be deleted: from our live systems after the 7-day hold (or normally within 60 minutes, if you choose to delete it right away), and from our backups within a further 30 days. The only exceptions are the records in Annex B that we keep after deletion (such as payment and consent records, keyed hashes that stop a launch offer or a ban being reused, and copies of recent e-mails that our e-mail delivery provider keeps for up to 45 days), the two rare cases above (a restore of our database, or a server that can't be wiped before we cancel it), and what we must keep while a case is open (next point).
• While a payment dispute, or your objection to one of our decisions, is open, or while your machine is suspended, we delete nothing in your account or your machine (for payment disputes, see sections 8 and 11 of our Terms). While a legal claim is open, or when the police or another authority require it, we keep what's needed for as long as it's needed. Once the case is closed, deletion goes ahead as described above.

9. Security

We protect personal data with measures that fit how Miko works:

• End-to-end encryption between your devices and your machines, using the Noise Protocol Framework, with keys your devices and machines create themselves.
• Passkeys for sign-in. A new device needs approval from a device you already trust, from a passkey that can unlock your account, or from your recovery key. An e-mail code, or a sign-in through Apple, GitHub or Google, can never add a device on its own. When you remove a device, it is cut off from your machines within seconds.
• Isolated machines. Each Miko Cloud machine is its own virtual machine with no open ports. Machines can't reach each other.
• Encrypted disks and backups. Each Miko Cloud machine encrypts its disk inside the machine, and its backups are encrypted inside the machine before they leave it.
• Memory encryption (AMD SEV-SNP) on Cloud plans, as section 3 explains.
• Our central service runs on hardened servers that only our administrator can log in to manage, helped by AI tools under business terms (section 3), and our accounts with our providers use two-factor sign-in. The database accepts no connections from the network. Our own backups of it are encrypted on the server before upload, in a way the server itself can't reverse. The server also keeps its last 7 daily copies of the database for quick restores, and our hosting provider keeps a copy of the whole server disk for 24 hours. These are protected by the server's and the provider's security and our two-factor account with the provider, not by that encryption.
• Minimal logs. Our logs never contain content, tokens or keys, and they keep IP addresses shortened, except as section 4.3 says.
• Signed updates. Miko's software checks the signature of each update before it installs it.
• Monitoring of our servers sends out only check names, numbers and our servers' own IP addresses. It receives no personal data.

No system is perfectly secure. Section 3 explains the limits. If a personal data breach puts your rights at risk, we notify Datatilsynet as the law requires, and we tell you without undue delay when the risk to you is high. If a breach affects personal data in a business customer's machine, we tell that customer without undue delay, so it can meet its own duties.

You can help: keep your devices, passkeys, recovery key and e-mail account safe.

10. Your rights

Under the GDPR you have the right to:

• access your personal data and get a copy;
• correct data that's wrong;
• delete your data;
• restrict how we use it;
• receive the data you gave us in a machine-readable format, and have it sent to another provider (portability);
• object to processing based on our legitimate interests, for example the setup measurements (section 4.9) or the referral code (section 4.8). We then stop, unless we have compelling reasons or need the data for a legal claim;
• object to direct marketing at any time. We then stop, always;
• withdraw consent at any time, without affecting what we did before;
• not be subject to a decision made only by a computer that has legal or similarly significant effects on you, unless it's needed for our contract with you or the law allows it. Then you can ask a person to look at it, tell us your view and challenge it (section 13).

Do it yourself in Settings:

• Export your data: Settings → Account → Export your data. You get one JSON file with your account, devices, machines (with their names, decrypted on your device), your connections (names and where they apply, never keys), the routines and notes your device holds, and your recent security events. It doesn't contain your files, terminal history or keys.
• Your files: your files are in your machine. You can copy them out whenever it's running, for example with git or rsync. For 30 days after your subscription ends, you can start it for export as our Terms describe. While your machine is suspended, or a payment dispute is open, it's stopped and you can't copy files out of it, but we delete nothing (section 8). If we end your subscription because you broke our terms, our Terms say whether you can still export (section 17 of our Terms); your rights in this section, such as getting a copy of your personal data, apply in every case. If you delete your account, your machine can't be started for export and is deleted after 7 days, or normally within 60 minutes if you choose to delete it right away, so copy your files out first. See our Terms of Service.
• Delete your account: Settings → Account → Delete account. This ends your subscription, and your machines stop at once. We hold the account for 7 days so you can restore it, or you can choose to delete it right away. Your machines are deleted with the account: after the 7 days, or normally within 60 minutes if you delete it right away; it can take a few hours when more machines on the same server are waiting to be deleted (Annex B). It's gone from our backups within a further 30 days (section 8). Deleting your account doesn't delete anything on computers you connected.
• Change your e-mail address, devices and notification settings in Settings.

Ask us: write to contact@getmiko.app, or reply to any e-mail from us.

• To protect your account, we may ask you to confirm the request from your account's e-mail address or in the app.
• We answer within one month. If a request is complex, or you send many, we can take up to two more months; if so, we tell you within the first month.
• There's no charge, unless a request is clearly unfounded or excessive.
• For payment data, you can also ask Paddle. For personal data inside a business customer's machine, ask that customer (section 5).

Complain. You can complain to Datatilsynet, the Norwegian data protection authority (how to complain), or to the data protection authority where you live or work. We'd like the chance to help first, so please write to us too.

11. Cookies and local storage

The web app uses only what it needs to work. Everything below is needed for the service you asked for, so we don't ask for consent to it. We don't use cookies or browser storage for advertising or tracking.

The bot check. On the sign-up and recovery screens, and sometimes at sign-in, Cloudflare's script runs to check you're a person (section 4.2).

Paddle. Paddle's code (Paddle.js) runs at checkout and when you update your card. Once paid plans open, it will also run on one page of our website that Paddle needs in order to send payment reminders. It may set Paddle's own cookies. Paddle's privacy notice covers them.

The website doesn't set cookies of its own and doesn't store anything in your browser.

Cloudflare. If Cloudflare asks your browser to pass a security check, it sets its own short-lived cookie (cf_clearance) on our domain to remember that you passed. It's needed for security.

The apps keep the data described in section 4.10 on your phone or Mac.

12. E-mails and notifications

Service e-mails. We send e-mails you need to use Miko: sign-in codes and links, "New sign-in" notices, account recovery and e-mail changes, the confirmation of your subscription (with our terms and the withdrawal form), our confirmation when you withdraw, notices about your machine and plan (for example at 80 % of your traffic, before your machine stops for a failed payment, when we limit or suspend it, and before we delete data), account closing and deletion, and reminders the law requires (for example that your subscription is running and how to cancel it). You can't turn these off while you have an account. Paddle sends receipts, invoices and payment e-mails itself.

Marketing. We send news or offers by e-mail only if you've agreed to receive them. Every such e-mail has a one-click unsubscribe, and you can also withdraw your consent by writing to us.

Our e-mails don't use tracking pixels or tracked links.

Push notifications are optional. In Settings you choose which types you get, and you can set quiet hours. Security notices can't be turned off; in quiet hours they arrive silently. If you turn on "Hide details", your lock screen shows only that something happened, without names, previews or buttons.

13. Automated decisions

Some decisions are made automatically by our systems:

• fair-use limits: a slowed connection above your traffic allowance, CPU limits after sustained full load, and slower previews from computers you connect above the preview allowance (section 4.5). They never stop your machine or cost you extra;
• the bot check, limits on sign-ups and codes, refusing disposable e-mail addresses, and refusing a new sign-up with an e-mail address that was banned in the last 12 months;
• at checkout, refusing an order when your IP address belongs to a place under full sanctions (section 4.6), and pausing an account when there's reason to suspect a sanctions match, until a person has checked it;
• the launch offer isn't applied again to an e-mail address that has already used it. Other signs of repeat use, such as the same card on a new account, are only flagged for a person to review;
• the payment steps in our Terms (sections 8 and 17): if a monthly payment fails, your machine stops on day 7 and the subscription ends on day 14 unless the payment goes through; while a payment dispute is open, your machine is stopped; if a dispute is decided in your favour, or Paddle refunds your current payment on its own decision, the subscription ends. In addition, for 12 months after a dispute decided in your favour, an order for a new subscription with the same e-mail address or card is refused once a person has checked the match (section 4.6);
• after a payment, if it comes from a place we're not allowed to serve, is charged twice, doesn't match the order we created, or is made with a card that was blocked after fraud or a ban, or if the last place was taken while you paid or we couldn't set up your machine, the order is ended and refunded in full.

We use these steps because they're needed to enter into or carry out our contract with you, or because the law requires them (sanctions). A CPU limit that is triggered three times within 7 days stays until a person has looked at it. Every other limit on your machine, such as a limit we keep after a review (section 9 of our Terms), is decided by a person. So is any suspension or ending of your machine, subscription or account, apart from the payment and sanctions steps above. That person can decide at once, without warning you first, when our Terms allow it, and we tell you in writing what we did and why, as section 4.7 describes.

When one of the automatic steps above refuses, limits or stops something, our message tells you that it was automatic, the main reason, and how to ask a person to look at it. If an automatic decision affects you, write to contact@getmiko.app. A person will look at it, hear your side and tell you the outcome.

14. Children

Miko is for people aged 18 and over. We don't knowingly collect personal data from children. If we learn that an account belongs to someone under 18, we close it and delete the data we're not required to keep.

15. People outside the EEA

You have the rights in section 10 wherever you live. In addition:

• United Kingdom: the UK GDPR gives you the same rights. You can complain to us first at contact@getmiko.app; we acknowledge a complaint within 30 days and tell you the outcome without undue delay. You can also complain to the Information Commissioner's Office (ico.org.uk).
• Switzerland: the Federal Act on Data Protection gives you similar rights. You can complain to the Federal Data Protection and Information Commissioner (edoeb.admin.ch).
• Canada: our systems store your data in Canada (section 6). You can contact the Office of the Privacy Commissioner of Canada (priv.gc.ca). If you live in the province of Québec, you can also contact the Commission d'accès à l'information du Québec (cai.gouv.qc.ca).
• United States: some US state privacy laws, for example in California, give you the right to know, delete and correct personal information, and to opt out of its "sale" or "sharing" for targeted advertising. We don't sell personal information and don't share it for targeted advertising, so there is nothing to opt out of. We won't treat you differently for using your rights. If we turn down a request, you can ask us to reconsider by replying to our answer.

16. Changes to this policy

We update this policy when Miko or the law changes. For important changes, we tell you by e-mail or in the app at least 30 days before they apply, unless the law requires a change sooner. We add a new provider to Annex A before it starts processing personal data. If you're a business customer, we e-mail you at least 30 days before a new subprocessor starts handling content in your machine. If you object and we can't resolve it, you can end your subscription with a refund for unused prepaid time. The date at the top shows when this version took effect, and earlier versions are available on request.

This policy is written in English.

Annex A – Subprocessors and other recipients

"Transfer basis" is explained in section 6. "DPF" means the EU-US Data Privacy Framework, and "SCCs" means the EU Standard Contractual Clauses.

Part 1: Our subprocessors

Part 2: Independent controllers

Part 3: Push services chosen by your browser

Part 4: Not our subprocessors

These receive data because you choose them. They act under their own terms:

• your AI providers, such as Anthropic (Claude) or OpenAI (ChatGPT);
• your connections and tools, such as GitHub, Vercel (as your connection) or MCP servers;
• package registries your machine downloads software from, such as npm;
• your own servers under Miko Connect;
• DeepSeek, if you turn on the optional research assistant in the Mac app. DeepSeek processes data in China.

Not listed: the services that monitor our servers receive only check names, numbers and our servers' own IP addresses, never personal data. Our domain name and DNS service, and our bank, receive no customer personal data. Our bookkeeping records are described in Annex B.

Annex B – How long we keep data

The periods below are for our live systems. Data in our central database also stays in the daily copies we keep on the server itself for up to 8 days, in our hosting provider's copy of the server's disk (which includes those copies) for up to 9 days, and in our encrypted backups of the database for up to 30 days after we delete it there (section 8).