Privacy policy

Last updated: 31 October 2026

Mirlumi has no accounts and no analytics, and the developer doesn't receive or store what a family does in the app.

The short version

  • The PIN and settings stay in a file on the phone.
  • What you do in Instagram, Snapchat and YouTube goes to those services, not to the developer.
  • The app downloads its rules from mirlumi.com, so Cloudflare, which hosts that site, sees the phone's IP address.
  • If you write to support, the developer receives your address and message.
  • Deleting the app removes its data from the phone.

Who is responsible

Erik Poljšak, an individual in Slovenia, publishes Mirlumi and is the data controller under the General Data Protection Regulation (GDPR). This page calls the controller “the developer”. You can write to the developer at support@mirlumi.com.

What Mirlumi doesn't collect

  • accounts: there's no sign-up and no Mirlumi password
  • names, ages or contact details
  • analytics, advertising or crash reports of its own
  • advertising IDs or tracking across apps

The developer doesn't sell data.

What stays on the phone

Mirlumi keeps one settings file in its private storage on the phone. It holds:

  • the PIN as a salted hash, never the PIN itself
  • the number of wrong tries and any waiting time
  • which services may show short videos
  • whether setup has finished

This file is excluded from the phone's backups and stays on the device. Deleting the app deletes it. The developer can't see it or restore it.

The app also keeps a copy of the latest rules file, which contains no personal data.

Instagram, Snapchat and YouTube

Mirlumi opens each service's own website inside the app. Everything done there, such as messages, posts, calls and what is watched, goes to that service and doesn't reach the developer.

Sign-ins happen on the services' own pages. Mirlumi doesn't see or store passwords.

Cookies and site data for each service stay on the device, separated per service. Only on an Android phone whose system WebView can't keep services apart do they share them.

Sign out of all apps in Parent settings clears this data for every service, and Sign out inside a service clears it for that service. Deleting the app removes it too. Your accounts with the services stay as they are.

The PIN file is the only file Mirlumi excludes from backups, so an iPhone backup may include cookies and site data. On Android, Mirlumi has backups turned off, but some manufacturers' phone-to-phone transfers may still copy them. Either way they go only where your own backup or transfer sends them, never to the developer.

A service can ask to use the camera, microphone or files, for example for a video call. The phone asks for your permission first, and what you share goes to that service. Files you save from a service stay on the phone after the app is deleted.

The services and their sign-in pages process data under their own privacy policies:

The rules update

So that blocking short videos keeps working when the services change, the app downloads a signed rules file from mirlumi.com. It does this each time it's opened or comes back to the screen.

The request carries no account, no advertising ID and no other identifier from Mirlumi. Like any web request, it does show Cloudflare, the host of mirlumi.com, the phone's IP address and the time, plus basic details the phone adds by itself, such as the system version, phone model, app version and language.

Cloudflare is a US company with a worldwide network, and mirlumi.com doesn't use its paid option for keeping data in the EU, so these details can leave the EU, including to the United States. For transfers to the US, Cloudflare relies on the EU-U.S. Data Privacy Framework, and on standard contractual clauses if that lapses. Cloudflare's privacy policy explains this.

The host needs these details to deliver the file. Cloudflare doesn't publish a fixed period for how long it keeps request logs, so the developer can't give one here. The developer doesn't use these details to find out who anyone is. The legal basis is the legitimate interest in keeping the blocking up to date (GDPR Article 6(1)(f)).

This website

mirlumi.com and mirlumi.si set no cookies, store nothing in your browser and add no analytics. Your language follows the domain: mirlumi.si is in Slovenian and mirlumi.com is in English. Fonts, images and text all come from the same site, so opening a page sends nothing to third parties. Links to other sites, such as the policies above, take you there only if you click them.

Cloudflare handles website visits the same way as the rules request, including the logging above. Its dashboard shows the developer traffic figures, such as the number of requests and visits.

If you write to support

If you write to support@mirlumi.com, the developer receives your address and your message, and they stay with the email provider. They're used only to answer you and kept only as long as that takes. The legal basis is the legitimate interest in answering your message.

Apple and Google

Mirlumi is downloaded from the App Store and Google Play, which work under Apple's and Google's own terms. They can show the developer overall figures, such as the number of installs and crashes, but not who installed the app.

Pages open in the phone's own web engine, which comes from Apple or Google and can have safety and diagnostic features of its own.

Children

Mirlumi is for families with teens aged 13 and up. It doesn't ask for a child's name, age or any other details, and the developer doesn't collect children's data. The rules request described above comes from the child's phone like any other web request. If a child has written to support, or you think the developer holds a child's data, write to support@mirlumi.com to have it deleted. Instagram, Snapchat and YouTube have their own minimum ages, set in their own terms.

Your rights

Under the GDPR you can ask for access to your personal data, and ask for it to be corrected, deleted, restricted or transferred. You can also object to its use. Write to support@mirlumi.com. If you haven't written to support, the developer usually holds nothing that can be linked to you, so there's nothing to export, correct or delete. To remove the data on the phone, delete the app. For data held by a service, contact that service.

You can also complain to the Slovenian supervisory authority: Informacijski pooblaščenec (Information Commissioner), Dunajska cesta 22, 1000 Ljubljana, gp.ip@ip-rs.si.

Changes

If this policy changes, the new version will appear on this page with a new date.