Privacy Policy

This policy explains what data Migas no Mundo collects, why we collect it, who we share it with and how long we keep it. It covers both the app and this website.

We write plainly on purpose. If anything is unclear, write to suporte@migasnomundo.com — an unclear policy is ours to fix, not yours to decode.

1. Who is responsible for your data

The data controller is [LEGAL ENTITY], registered under CNPJ [CNPJ], with offices at [ADDRESS], in Brazil.

Data Protection Officer: [DPO NAME] — rabivale@migasnomundo.com.

The DPO is who you contact to exercise any right in this policy, and who answers to Brazil’s data protection authority (ANPD) on our behalf.

2. What we collect

Data you give us

What	When
Name, email, date of birth, city and nationality	At sign-up
Password	For email sign-up (stored as a hash, never as text)
Your declaration that you are a woman	At sign-up
Profile photos	When you upload them
Bio, housing type, routine, tidiness, habits, interests, travel pace and languages	In the questionnaire and when editing your profile
Food allergies and pet allergies	Only if you authorise it — see section 3
Planned trips (destination and dates)	When you add them
Messages, audio, images and video you send in chats	When you chat
Reviews you write	After a connection
Reports and blocks you make	When you report or block
Name, phone number and relationship of your emergency contact	When you add one — see section 8
Your location at the moment of a safety check-in or alert	Only when you tap the button

Data your device and usage generate

Push notification token and device platform (iOS or Android).
App language, so we speak to you in your own.
IP address, date, time and route accessed, in server logs.
Who visited your profile and when.
Connections, acceptances and rejections between you and other members.

Identity verification data

When you verify your identity, your document, selfie and liveness video go directly to Didit, the company that performs the check. They never pass through our servers and we never store them.

What we keep is the outcome (approved, declined, under review) and that session’s identifier.

Food allergies and pet allergies are sensitive personal data under Brazil’s data protection law (LGPD, art. 5, II). They are therefore not covered by your general acceptance of these documents: the app asks for a separate authorisation, on the question’s own screen, stating what it is for.

It is for one thing: suggesting compatible hosting. It never appears on your public profile and never goes to advertisers.

You can withdraw this authorisation at any time. When you do, we delete the questionnaire answer and the matching profile fields along with it — withdrawing consent while keeping the data would mean keeping exactly what you just refused.

4. Why we use each piece of data

The LGPD requires a legal basis for every use. These are ours:

Purpose	Data	Legal basis
Creating and maintaining your account	Sign-up data, password, declaration	Performance of a contract (art. 7, V)
Suggesting compatible connections	Profile, questionnaire, languages, trips, city	Performance of a contract
Suggesting hosting compatible with allergies	Food and pet allergies	Specific consent (art. 11, I)
Enabling chats	Messages and media	Performance of a contract
Alerting your emergency contact	Event location, your name, contact’s phone number	Protection of life and physical safety (art. 7, VII)
Verifying identity and screening accounts	Verification outcome, sign-up data	Legitimate interest — safety in an app for women (art. 7, IX)
Moderating reports, applying blocks and bans	Reports, reported messages, moderation history	Legitimate interest — member safety
Sending app notifications	Push token, preferences	Performance of a contract
Billing and validating the Miga+ subscription	Store purchase identifier	Performance of a contract
Showing ads on the free plan	Device advertising identifier	Consent (collected through Google’s form)
Keeping the service running and investigating faults and abuse	IP, date, time, route, errors	Legitimate interest — security and continuity

Where the basis is legitimate interest, you may object: write to the DPO explaining your situation. We assess case by case and reply.

5. What we never do

We do not sell your data. To anyone, ever.
We do not move money between members. No payment for hosting or tours goes through Migas — the app does not broker, guarantee or charge for it.
We do not show your live location to other members. Location is used only at the moment you trigger a check-in or an alert, and it goes only to your emergency contact.
We do not give your questionnaire answers to advertisers.
We do not read your conversations outside a report. When there is a report, only the moderation team accesses what is needed to investigate, and every access is logged.

We use companies that provide services to us. Each one receives only what it needs.

Company	Purpose	What it receives	Where it is processed
Didit	Identity verification	Document, selfie, liveness video, your email and name	European Union
Google (Firebase)	Social login and notifications	Account identifier, push token	United States
Google (AdMob)	Ads on the free plan	Device advertising identifier	United States
Apple and Google	Subscription billing	Purchase identifier	United States
Twilio	SMS to your emergency contact	Contact’s phone number and the alert text	United States
Amazon Web Services	Photo and media storage	Your photos and chat media	United States
Sentry and Pydantic Logfire	Error logging and monitoring	Technical logs, including IP	United States and European Union

International transfers. Some of these companies process data outside Brazil. The LGPD permits this (art. 33), and we contractually require each of them to apply the same level of protection we do.

We may also share data with authorities under a court order or legal obligation — and when that happens we tell you, unless the order itself forbids it.

7. How long we keep it

What	Period
Your account and profile	As long as the account exists
A message you delete	30 days, so a report about what was said and then deleted can be investigated; after that the content is gone
A chat with no new messages	24 months
Safety check-ins and alerts (with location)	12 months
Who visited your profile	6 months
Notifications	6 months
Identity verification at Didit	90 days after completion; we then ask Didit to delete the document, selfie and biometrics
Server technical logs	12 months
Moderation history (reports, bans and their reasons)	As long as needed for member safety

When you delete your account, we delete your profile, photos, the media you sent in chats, your answers, connections and reviews, and we ask Didit to delete your document and biometrics. What remains — and only this — is the minimum required by law and what prevents an account banned for endangering others from returning under a new name.

8. Your emergency contact: someone else’s data

When you add an emergency contact, you give us the name and phone number of another person, who does not use the app and has agreed to none of this.

Tell them. Let them know their number is registered here, what it is for, and that they can ask for removal at any time by writing to suporte@migasnomundo.com. By adding a contact, you confirm you have done so.

We use that number for one thing: sending the SMS when you trigger a check-in or an alert. Never for anything else, never for marketing.

9. Your rights

The LGPD (art. 18) guarantees you the right to:

Know whether we process your data and access what we hold.
Correct anything wrong or incomplete.
Request deletion of data processed on the basis of your consent.
Receive your data in an open format (portability).
Know who we share it with.
Withdraw consent given for health data or for ads.
Object to processing based on legitimate interest.
Have automated decisions reviewed. Connection suggestions are calculated by an algorithm from your answers; account screening and moderation, by contrast, are done by people.

Three of these you can exercise yourself, immediately, inside the app:

Access and portability: Profile → My data → Export, which returns a file with everything.
Account deletion: Profile → Settings → Delete account.
Withdrawing health-data consent: unticking the authorisation on the food question.

For everything else, write to the DPO. We reply within 15 days.

If you believe we have not resolved it, you may complain to the ANPD: gov.br/anpd.

10. Security

Passwords stored as hashes, never as text. Encrypted connection between the app and our servers. Sessions that expire and are dropped when you change your password. Database off the public internet; photos and media in private storage behind temporary links. Logged access whenever the moderation team reaches sensitive data — who accessed what, and when. Two-factor authentication required for our team.

No system is impenetrable. If an incident occurs that could put you at risk, we notify you and the ANPD, as article 48 requires.

11. Under 18

Migas no Mundo is for adults aged 18 and over. We check the date of birth at sign-up and refuse anyone younger. If we find an account belonging to a minor, we delete it.

12. Cookies

This website uses no cookies and no trackers. There is no analytics, no pixel — nothing to consent to here.

In the app, your device’s advertising identifier is used for ads on the free plan, and only after you authorise it through Google’s form shown in the app. You can revisit that choice at any time under Profile → Ad privacy, or remove ads entirely by subscribing to Miga+.

13. Changes to this policy

When we change something material, we tell you in the app before it takes effect, and the date at the top of this page changes. If a change requires fresh consent, we will ask — we never infer acceptance from silence.

14. Governing version

This policy is available in several languages. The Portuguese version prevails in case of any discrepancy between translations.

15. Contact us

Support: suporte@migasnomundo.com
Data Protection Officer: rabivale@migasnomundo.com