Privacy Policy

App: MIBU Life Developer: MIBU Lab Last updated: 30 May 2026

This Privacy Policy explains how MIBU Lab ("we", "us", or "our") collects, uses, stores, and discloses information when you use the MIBU Life mobile application (the "App") on iOS, Android, Apple Watch, and Wear OS. It also explains your rights regarding your personal information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

By using the App you agree to the practices described in this policy. If you do not agree, please stop using the App and contact us to have your data deleted.

1. Who this policy applies to

MIBU Life is intended for users aged 13 and over. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information, please contact us immediately and we will delete it.

2. Information we collect

Account information

You can play MIBU Life without creating an account. We automatically create an anonymous account that is not linked to any name or email address.

If you choose to link your account to Google ("Sign in with Google"), we receive from Google:

  • Your Google email address

  • Your display name

  • Your Google profile picture URL

This information is used only to identify your account and is not shared with third parties for marketing purposes.

Pet and gameplay data

To run the game, we store on our servers:

  • Your pet's name, stats, and lifecycle state

  • Your in-game inventory and equipped outfits

  • Your Bun Coin balance and daily activity counters

  • Your friend code and friendship connections

  • Your device timezone (used to calculate stat decay and daily resets correctly)

  • Timestamps of game actions (feeding, cleaning, playing, etc.)

Step count (fitness data)

If you use the Village feature, we ask permission to read your daily step count from Apple HealthKit (iOS) or Health Connect (Android). We use this number solely to award in-game Bun Coins (100 steps = 1 coin, capped at 50 coins per day). The raw step count is sent to our servers only as part of this conversion process and is not used for any other purpose. We do not read any other health or fitness data.

Push notification token

If you grant permission for push notifications, we store a push notification token on our servers. This token is used exclusively to send you in-game notifications (e.g. your MIBU is hungry, a friend sent you a heart). We do not use it for advertising.

Technical and device information

We collect limited technical information needed to operate the App:

  • Device platform (iOS or Android) to serve platform-appropriate features

  • App version, for update checks

We do not collect precise location, advertising identifiers, or device hardware identifiers.

3. How we use your information

  • To run the game and synchronise your pet's state across your devices

  • To convert your step count into in-game rewards

  • To send push notifications about your pet and friend activity

  • To provide the friend-code and heart-sending social features

  • To enforce fair-play rules and daily reward caps on our servers

  • To deliver app update information

  • To respond to your support or privacy requests

We do not use your information for advertising, profiling, or sale to third parties.

4. Third-party services

We use the following third-party services to operate the App. Each has its own privacy policy.

  • Supabase: our backend database and authentication provider. Your pet data, account tokens, and push notification tokens are stored on Supabase infrastructure. Supabase may process data in the United States and other countries. See supabase.com/privacy.

  • Google OAuth: used only if you choose "Sign in with Google". See policies.google.com/privacy.

  • Expo (by Expo Inc.): delivers push notifications to your device. See expo.dev/privacy.

  • Apple HealthKit (iOS) / Health Connect (Android): used to read your daily step count when you grant permission. We do not share this data with Apple or Google beyond what is required by those platform APIs.

5. Cross-border data disclosure

MIBU Lab is based in Australia. Our backend infrastructure (Supabase) may store and process your data in the United States or other countries. When your data is transferred outside Australia, we take reasonable steps to ensure it is protected to a standard comparable to the Australian Privacy Principles. By using the App, you consent to this transfer.

6. Data retention

We retain your account and associated personal information for as long as your account is active. When you delete your account, your authentication record and any linked personal identifiers (such as your Google email and push notification token) are permanently removed, along with your gameplay data. We may retain a fully anonymised copy of gameplay data (pet stats, inventory, achievements) with all personal identifiers stripped (including any name you gave your pet) for backup and analytical purposes. This anonymised data cannot be linked back to you. Deletion is also available by request to mibulab@pm.me, in which case we will action it within 30 days.

7. Security

We protect your data using industry-standard measures, including:

  • Row-level security policies in our database so users can only access their own data

  • All pet mutations processed through server-side security-definer functions

  • Authentication tokens stored securely (Keychain on iOS, EncryptedSharedPreferences on Android)

  • HTTPS for all network communication

No method of transmission or storage is 100% secure. If you become aware of any security concern, please contact us immediately.

8. Your rights and how to exercise them

Under the Australian Privacy Act 1988, you have the right to:

  • Access the personal information we hold about you

  • Correct inaccurate or out-of-date information

  • Delete your account and associated personal data

  • Withdraw consent for health data access at any time through your device's Health app (iOS) or Health Connect settings (Android)

  • Opt out of push notifications at any time through your device's notification settings

To delete your account, go to the Profile tab in the app and tap Delete Account. Your authentication record and any linked personal identifiers (Google account link, push notification token) are permanently removed immediately. This action cannot be undone.

To request access or correction of your personal information, email us at mibulab@pm.me. We will respond within 30 days.

9. Complaints

If you believe we have mishandled your personal information and are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC):

10. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date at the top of this page. Continued use of the App after changes are posted constitutes acceptance of the updated policy. We encourage you to review this page periodically.

11. Contact us

If you have any questions or requests regarding this Privacy Policy, please contact us:

Home | Privacy Policy