← Back to home

Privacy Policy

Last updated: November 8, 2026

Overview

Mitmi is an independent project with no company, no advertising, and no analytics or tracking of any kind. This policy explains, plainly, exactly what data the app handles and why.

1. Information Stored on the Server

The server permanently stores the following information (kept with the third-party services described in Section 8):

• Your @handle.
• The date and time your @handle was created, visible only to the developer in the server's administration panel; never shown to other users.
• The identifier of the device registered to that @handle, so other users can find you and call you.
• Each device's own name (the one Android assigns by default or the one you assign manually), shown only in Settings > Devices, so you can identify them when deciding which one to revoke; never shown to anyone else.
• The date and time each device was last active (its “last seen”), shown in full only in Settings > Devices for the same purpose, and rounded to the day in the list of devices offered for replacement when someone adds a device to your @handle; never shown to other users.
• The device verification code described in Section 4 below, for each device that has completed that check.
• The public half of the security key generated by each verified device described in Section 4, used to approve that a profile export genuinely came from it and can be imported into a different device.
• A short-lived record used to limit how quickly new profiles can be created from the same device, as a safeguard against abuse.

All these data stays in the server until you revoke your device(s) as described in Section 10 (“Your Choice”).

It's worth clarifying that Mitmi does not ask for or store a self-chosen display name at all, when you call someone who hasn't saved your @handle as a contact, they only see your @handle on the incoming call screen.

Technical reports: only if you press “Send to Developer” in Settings, review the report, and confirm sending it, Mitmi's server receives a technical report about your device (model, Android version, security certificates or camera and audio devices, and a recent technical log) along with your @handle and, only if you choose to type it, your email address, and forwards it by email to the developer through an email provider (Resend). The server doesn't keep either of them; the report is used only to diagnose the problem, and your email only so the developer can reply to you about it.

2. Information Temporarily stored in the Server's RAM (Random Access Memory)

Separately from the permanent storage above, the following information only exists in the server's RAM while your device is connected (foreground or background). A server restart, an update to the app's backend, or simply every one of your devices going offline, erases all of it and it will reload again the next time your device reconnects:

• Your avatar image or avatar color (only effective when the app is in foreground).
• The bare list of @handles you've saved as contacts, which is needed to display each one's avatar mutually (only effective when the app is in foreground).
• Connection details while two devices are in the process of setting up a call (only effective when the app is in foreground).
• A brief notice that someone has left a group and it will be discarded automatically after 7 days (only effective when the app is in foreground).
• When the user is online, away or in a call (only effective when the app is in foreground or in background with notifications active).
• The bare list of @handles you've blocked, which is what actually makes the block take effect, silently preventing their calls from reaching you. (only effective when app is in foreground or in background with notifications active).
• When you add a device, the information described in Section 5, until the new device receives it or, if the code is never used, until the code expires after one minute.

3. Information Stored on the Device

The following information is stored in the internal storage of your device and it's never sent to the server unless otherwise specified below:

• Your contacts information (name, category and favorite status) for each @handle you've saved stays entirely on your device and is never sent to the server, except temporarily when you use Add Device, as explained in Section 5.
• Your call history stays entirely on your device and is never sent to the server.
• Your groups stay entirely on your device and are never sent to the server, except temporarily when you use Add Device, as explained in Section 5.
• Your blocked contacts information stays entirely on your device and is never sent to the server, however, the bare @handle is sent to the server, as explained in section 2.
• Your security PIN stays entirely on your device (stored in a protected form) and is never sent to the server, except its protected (hashed) form when you use Add Device, as explained in Section 5.
• The private half of the security key generated by each verified device described in Section 4 stays entirely on your device and is never sent to the server.
• Contacts you mark as favorites are shown on your TV's home screen: their name, @handle and avatar are handed to your device's home-screen launcher (a system app on the same device) so it can display them. Mitmi does not send them anywhere else.

4. Device Verification

To protect your @handle from being taken over by someone using a modified or unauthorized copy of the app, each device performs a one-time security check when it's first set up, confirming it's a genuine, unmodified device running the real Mitmi app.

As part of this check, the server stores a small piece of information, a code your device's own manufacturer assigned to it, so the server can recognize that same physical device again later (for example, after the app is reinstalled). This code is scrambled before being stored, so it can't be read by anyone without the specific key needed to unscramble it. The server also stores your device's model name alongside it, used together to help recognize the same physical device for the recovery scenario described in Section 5. The developer can also see the model name in the server's administration panel to detect abuse.

Some Android for TV devices (regardless if they are certified by Google or not) aren't able to complete this security check. Those devices can still use Mitmi normally, with one exception described in Section 5.

5. Adding, Exporting, and Importing a Profile

A profile can be actively registered on up to two devices at the same time.

Adding an additional device (Settings > Devices > Add Device) gives you a short alphanumeric code, valid for one minute. Entering that code on the new device (while both devices are online) adds it to your @handle right away, carrying over your profile, contacts, and groups. To do this, your profile, avatar, contacts, groups and the protected (hashed) form of your PIN are sent to Mitmi's server and held in its temporary memory (RAM) only until the new device receives them, and are then deleted; if the code is never used, the data is deleted when it expires, after one minute. The server does not keep them. If you already have two devices registered and want to add a third, the app first asks you to choose which of your two current devices to revoke, freeing up a slot before it shows you the code.

Exporting a profile (Settings > Devices > Export Profile) creates an encrypted backup file containing your @handle and the information described in Section 3, protected by a password you choose. This file always works to recover your @handle back onto the exact same physical device it was exported from, whether after clearing the cache and data of the app, reinstalling the app or resetting the device to factory settings. Take into account that the Export Profile button remains unavailable when two devices are currently registered, this is just a security restriction.

The same file can also be imported onto a different device, useful when pairing two devices online at the same time isn't possible, but only once, and only if the source device had completed the security check described in Section 4. A device that can't complete that check can still export a backup but only for use on the same device and not onto a different one.

A backup or a pairing code is required in every case to recover your @handle.

6. Permissions the app Requests

• Camera and Microphone: Used only while you're actively previewing your own video/audio or on a call. While you are muted during a call no audio is sent, but the microphone stays active (your TV's microphone indicator may remain on) until the call ends.
• Notifications, a Background Service and Start at Boot: Used to alert you to an incoming call even when the app isn't in the foreground, and to start listening for calls again after your device is turned on or the app is updated. Incoming calls can also use a full-screen alert.
• Display Over Other Apps (optional): If granted, lets Mitmi show a small incoming-call alert on top of whatever's on screen when the app is backgrounded, on TV platforms where a normal notification isn't always shown reliably.
• Home-Screen Row (Favorites): Lets Mitmi publish the contacts you mark as favorites to your TV's home screen, as described in Section 3.

None of these permissions are used to collect data beyond what's described in this policy.

7. Call Audio and Video

Calls are transmitted directly between devices using WebRTC, encrypted end-to-end (SRTP/DTLS). Mitmi's server only helps two devices find each other and exchange the initial connection details—it never sees, stores, or has access to your call's audio or video. Calls are never recorded.

8. Third-Party Services (Hosting, Email, STUN and TURN)

Mitmi relies on third-party services, and it is only fair to tell you what each of them can see:

• Hosting: Mitmi's server runs on a third-party hosting provider. Like any web host, that provider (and the server itself, to limit abuse) processes the IP address of every device that connects.
• Database: The permanent information described in Section 1 is stored with a third-party database service.
• Email: The technical reports described in Section 1, which you can choose to send to the developer, are delivered by a third-party email service (Resend), which sees the report, your @handle and, if you included it, your email address, only to deliver it.
• STUN Servers: To find out its own public network address, each device contacts public STUN servers when a call is being set up. By default Mitmi uses STUN servers operated by Turnix, ExpressTURN and Metered.ca. A STUN server sees the device's public IP address and that a connection was requested, but never your @handle, audio or video.
• TURN Relay Servers: When a direct connection between two devices isn't possible, your call needs to be relayed—still encrypted—through a third-party TURN server to complete. Mitmi does not have a TURN server configured by default: in Settings, you must set up your own account with one of three supported providers (ExpressTURN, Metered.ca, or Turnix.io) or point the app at your own self-hosted TURN server. Whichever relay you configure can see both participants' IP addresses and that a connection is taking place, but cannot decrypt or view the actual audio or video content.

None of these services can decrypt or view the audio or video of your calls, and Mitmi does not use any of them for advertising or analytics.

9. Children's Privacy

Mitmi is not intended for children under 13, and knowingly does not collect information from anyone under that age.

10. Your Choice

If you don't agree to this Privacy Policy, you can always revoke your device(s) at any moment from Settings > Devices, which erases this device's local data and removes it from the server. If you revoke your last device, nothing about you is kept on the server except your @handle, which stays reserved for 6 months to prevent abuse and impersonation and is then deleted. During that time it can't be freed up from within the app or recovered with a backup. If you decide to use the app again, you will need to create a new @handle.

11. Changes to This Policy

This policy may be updated as the app changes. Continued use of the app after an update means you accept the revised policy.

12. Contact

Questions about this policy can be sent to mitmi-app@outlook.com.