Privacy policy for Miria, the wishlist and gift-coordination service.
Last updated: 21 September 2026
Miria is a wishlist and gift-coordination service. This policy explains what information Miria uses, why it is needed, and who can see it.
Miria is made and operated by FOP Chernukhin Ivan Serhiiovych (ФОП Чернухін Іван Сергійович), trading as Alacrity, Kyiv, Ukraine.
Contact: ialacritydev@gmail.com
Miria has no advertising, analytics or tracking pixels, and does not sell personal information. List owners need an account; people opening a shared list do not. Friends can coordinate reservations or pooled gifts, but the list owner sees only how many gifts are taken — never which gifts, names, pledges or amounts. Miria coordinates a pooled gift but never receives or processes money.
Miria stores:
If you sign in with Google, Google provides your email address, name, profile image, provider account identifier and the authentication tokens needed to keep that connection working. Miria does not receive access to your Gmail, contacts, Drive or other Google account information. Google sign-in is optional; email magic links are available instead.
Why: to provide the service you ask for and keep your account secure. The legal basis is performance of our contract with you (Article 6(1)(b) GDPR) and our legitimate interest in protecting the service (Article 6(1)(f) GDPR).
You can read a shared list without an account. To reserve a gift, organise a pooled gift or pledge an amount, you first provide a display name. Miria stores:
The random secret lets Miria recognise you again without asking you to make an account. Only its SHA-256 hash is stored on the server; the original secret stays on your device.
People in the same group can see who reserved a gift and the names and amounts within that group’s pooled gifts. People in other groups only see that the gift is unavailable.
The owner of the list never receives reservation identities, gift identities, pool organisers, pledge names or pledge amounts. The owner receives only an aggregate count of gifts that are taken. This separation is enforced in the application’s access layer and covered by automated tests.
A pledge is only a statement of intent between the people in the group. Miria does not collect money, connect payment accounts, or learn whether anyone paid.
Why: to provide the coordination requested by the group while preserving the surprise for the list owner. The legal basis is performance of the service requested by you (Article 6(1)(b) GDPR).
When an owner adds a product URL, Miria’s server visits that page to read public product details such as its title, image and price. The shop sees a request from Miria’s server, not from each friend who later views the list.
Miria stores its own processed copy of the product image. Shared-list pages load that copy from Miria, so opening a list does not tell the shop who viewed it.
For signed-in owners, Miria stores a session with an expiry time and may retain the IP address and browser user agent associated with it. A normal session lasts 30 days. A magic sign-in link lasts 15 minutes, works once, and is stored in a hashed form. A short-lived token used to hand a session to the mobile app lasts three minutes.
Miria uses first-party cookies or equivalent app storage for:
There are no advertising or analytics cookies.
Short-lived rate-limit counters protect sign-in, joining and reservation endpoints from abuse. They are keyed by a SHA-256 hash of an email address or IP address rather than the address itself and expire within minutes.
Why: authentication, fraud prevention and service security. The legal basis is our legitimate interest in operating a safe and dependable service (Article 6(1)(f) GDPR).
Miria uses a small number of providers acting on our instructions:
These providers may process limited technical request information needed to deliver and protect their services. Miria’s own error reports use route patterns rather than real shared-list URLs and do not include email addresses, session headers or guest secrets.
Links to another website — for example, a shop — are governed by that site’s own privacy policy after you choose to open them.
Depending on where you live, you may have the right to access, correct, export or delete personal information about you, restrict or object to processing, and complain to your local data protection authority.
Signed-in owners can permanently remove their account and associated data immediately from Miria’s account-deletion page. The page asks for the account email and requires a recent sign-in before deletion.
Email ialacritydev@gmail.com to request a copy or correction, or when you cannot sign in. Manual requests are answered within 30 days. We may need to verify that the account or guest identity belongs to you before acting.
You can also release your own reservations, withdraw your pledges, leave by clearing the guest data stored on your device, or delete gifts and lists you own. Clearing a guest secret means Miria can no longer recognise you as that guest; it does not by itself erase the server record, so email us if you want it removed.
Miria uses encrypted HTTPS connections, hashed sign-in and guest tokens, restricted access rules and rate limits. No internet service can promise absolute security, but personal information is limited to what the service needs and is not used for advertising or profiling.
Miria is not directed to children under 13, and we do not knowingly collect personal information from them. Contact us if you believe a child has provided information to Miria.
If this policy changes, the new version will be published on this page with a new date. Material changes will be communicated in the service where practical.
Alacrity / FOP Chernukhin Ivan Serhiiovych
Kyiv, Ukraine
ialacritydev@gmail.com