Privacy Policy — Miracle
Miracle turns photographs of your baby into keepsake portraits. That means we handle two things that deserve care: your child's photographs, and the small amount of information you tell us about your child. This notice covers Miracle: Baby Photo Editor for iOS (App Store ID 6444831036) and takes precedence over our general Privacy Policy for that app.
Effective 18 September 2026 · Last updated: 18 September 2026
01. The short version
- Your child's name, date of birth and gender stay on your phone. We do not store them on our servers, and we do not send them to any analytics or advertising company. Ever.
- Your photographs stay on your phone. When you ask for a portrait, the photo is sent to an AI service, transformed, and sent back. We do not keep a copy.
- We never use your photos to train AI models, and we never use them in advertising or marketing.
- There is no sign-up. No name, no email, no password. Your account is an anonymous identifier created when you first open the app.
- We do not sell your personal information.
The rest of this document is the detail behind those five statements. If anything below contradicts them, the statements above are what we intend, and we want to hear about it: [email protected].
02. Who we are
Miracle: Baby Photo Editor is published by ABONELİK BİLİŞİM HİZMETLERİ SANAYİ İÇ VE DIŞ TİCARET ANONİM ŞİRKETİ, registered at Meriç Mah. 5747/13 Sk. No: 7 İç Kapı No: 1, MTK Sitesi, Bornova, 35090 İzmir, Türkiye ("we", "us"). For the purposes of the EU General Data Protection Regulation (GDPR) and the Turkish Personal Data Protection Law No. 6698 (KVKK), we are the data controller.
For privacy questions, and to exercise any of the rights described in section 12:
- Email: [email protected]
- Post: ABONELİK BİLİŞİM HİZMETLERİ SANAYİ İÇ VE DIŞ TİCARET ANONİM ŞİRKETİ, Meriç Mah. 5747/13 Sk. No: 7 İç Kapı No: 1, MTK Sitesi, Bornova, 35090 İzmir, Türkiye
For everything else: [email protected].
03. Who this app is for
Miracle is for adults — parents, guardians and family members who want keepsakes of a child in their care. It is not designed for, marketed to, or intended to be used by children.
You provide information about a child. We do not collect information from children. Section 10 covers how this interacts with COPPA and equivalent laws.
04. Your child's photographs
This is the section most people are here for, so it comes first.
Photographs are stored on your device. When you add a photo to a child's profile, it is saved into Miracle's own storage area on your phone. It is not uploaded to us.
A photograph is sent to us only when you ask for something to be made from it. When you tap to generate a portrait or a themed image, that specific photograph is sent over an encrypted connection to our servers, passed to an AI image provider, transformed, and the result is returned to your device.
We do not retain the photograph. It is held in memory for the duration of the request. There is no place in our system where user photographs are stored, and no way for us to retrieve a photograph you have sent us after the request completes.
We do not use your photographs to train AI models. Not ours, and — under our agreements with them — not our providers'. See section 05.
We do not use your photographs for advertising or marketing. They are never sent to an advertising or analytics company, and they will never appear in our marketing materials unless you separately and specifically give us permission for a particular image.
Deleting. Because the photographs are on your device, deleting one in the app deletes it. Deleting a child profile deletes that child's photographs. Deleting the app removes all of them.
The trade-off you should know about. Because we do not keep copies, photographs and child profiles do not survive deleting the app, resetting your phone, or moving to a new device. This is a deliberate choice in favour of privacy, and it means the only backup is the one you keep yourself in your own photo library.
05. How AI processing works, and who does it
Miracle's portraits are produced by AI image models. We use more than one provider so the feature keeps working when one is unavailable, and which one handles a particular request may change.
We ask before the first photograph is sent. The first time you request something that needs AI processing, the app tells you what will be sent and to whom, and asks you to agree. If you decline, no photograph leaves your device and that feature stops there. You can change your answer at any time in the app's settings.
The providers who may process a photograph on our instruction are:
| Provider | Role |
|---|---|
| Google (Gemini API) | AI image generation and image understanding |
| OpenAI | AI image generation |
| fal.ai | AI image generation |
Where we use a provider, it acts as our processor under a data processing agreement. Under those terms, the image is used only to produce your result, is not used to train or improve their models, and is not retained beyond what is needed to serve the request and meet their own short-term abuse-monitoring obligations.
Alongside the image, we send only what the transformation needs — the style or theme you picked, and technical parameters. We do not send your child's name, date of birth, gender, or your account identifier to any AI provider.
If we add or change a provider, we will update this table and the "last updated" date at the top of this page.
06. Your child's name, date of birth and gender
You may enter a child's first name, date of birth and gender to personalise what the app shows you — a greeting, an age-appropriate set of themes, a milestone reminder.
This information is stored on your device only. It is written to your phone's own app storage. It is not sent to our servers, and it is not sent to any analytics, advertising or attribution company.
One thing we want to be precise about rather than glossing over:
Milestone reminders are worked out on your phone. When you turn on notifications, your device calculates your child's upcoming monthly birthdays and milestones from the date of birth it holds locally, and schedules the reminders itself. Nothing about your child is sent anywhere to make this work, and the reminder text — which includes your child's name — is composed on the device and never leaves it.
The only push messages we send from our servers are ones that go to everyone: a seasonal greeting, or a note that a new template is available. They are not addressed to your child and contain nothing about them.
07. Face grouping in your photo library
To help you find photos of the right child quickly, Miracle can read the "People" groupings that your iPhone has already created in your photo library. This uses face recognition that Apple performs on your device, as part of iOS.
No face data leaves your device. We do not compute, transmit, receive or store any facial recognition data, face template, faceprint or biometric identifier. We read the groupings iOS has already made, on your phone, in order to show you a list of photos. Nothing about that leaves the phone.
Miracle asks for photo library access when you first use this. You can decline, and use the app by choosing photos one at a time instead. You can change the permission at any time in iOS Settings → Privacy & Security → Photos.
08. Everything else we collect
| What | Why | Where it lives |
|---|---|---|
| Anonymous account identifier — created on first launch. No name, email or password is attached to it. | So your purchases and settings persist between launches | Our database |
| Subscription and purchase status — which plan, when it renews, transaction identifiers | To unlock what you paid for, and to handle restores and refunds | Our database, RevenueCat, Apple |
| App usage events — screens viewed, features used, whether onboarding completed, whether a purchase was made | To understand which parts of the app work and which do not | Firebase Analytics, and the marketing partners in section 09 |
| Number of child profiles — how many, never who | To tell whether people set up one child or several | Firebase Analytics |
| Feedback you choose to send — whatever you type into the in-app feedback form, plus your account identifier, app version and whether you subscribe | To answer you, and to know which version a report came from | Tally |
| Device and diagnostic information — device model, OS version, app version, language, region, crash reports and performance traces | To fix crashes and support the devices people actually use | Firebase Crashlytics, Firebase Analytics |
| Advertising identifier (IDFA) — only if you allow tracking when iOS asks | Measuring which advertisements lead to installs | The marketing partners in section 09 |
We do not record your screen. Miracle contains no session-replay or screen-recording software. What we learn about how the app is used comes from the event counts described above — which screen was opened, which button was tapped — not from a recording of your screen.
We never receive payment details. Subscriptions are sold through Apple's In-App Purchase. Card numbers and billing information go to Apple and are never visible to us.
Miracle contains no advertising SDK. The app displays no advertising of any kind, so section 07 of our general Privacy Policy does not apply to it. The identifier above is used to measure our own campaigns, not to show you ads inside Miracle.
10. Children's privacy
Miracle is intended for adults. We do not knowingly collect personal information from children under 13 (or under the equivalent age where you live). Accounts are not offered to children, and nothing in the app invites a child to enter information about themselves.
Information about a child in the app is entered by you, the parent or guardian:
- It is stored on your device, not on our servers (section 06).
- It is never sent to an analytics, advertising or attribution provider (section 09).
- The child's photographs are stored on your device and are not retained by us (section 04).
If you believe a child has provided information to us directly, contact us at [email protected] and we will delete it.
We do not knowingly sell or share the personal information of anyone under 16.
Miracle is not listed in the App Store Kids Category — it is an app for parents — so the Kids Category regime in section 13 of our general Privacy Policy does not apply to it. The protections that do apply to your child's data are the ones listed above, and they are enforced in code rather than only in this document.
11. How long we keep things
| Category | Retention |
|---|---|
| Photographs | Not retained. Held only for the duration of a transformation request |
| Child name, date of birth, gender | Not retained on our servers. Kept on your device until you delete the profile or the app |
| Anonymous account identifier and subscription status | While your account is active. A deletion request erases the record immediately and irreversibly |
| App usage and analytics events | Up to 14 months, then deleted or aggregated |
| Crash and performance data | Up to 90 days |
| Feedback you submit | Until the issue is resolved and no longer needed, at most 24 months |
| Purchase and tax records | As long as Turkish tax and accounting law requires, generally 10 years. These contain a transaction identifier, not your photographs or your child's information |
12. Your rights and how to use them
Wherever you live, you can:
- Delete everything. In the app, delete a child profile, or use the delete-account option to erase your account and every server-side record attached to it. This takes effect at once and cannot be undone — we keep no archive copy to restore from. Or email [email protected] and we will do it for you within 30 days. The general procedure is on our account deletion page.
- Ask what we hold. Email [email protected] and we will provide it in a portable format.
- Correct it, though in practice almost everything about your child is on your device and editable in the app.
- Turn off tracking — iOS Settings → Privacy & Security → Tracking.
- Turn off notifications — in the app's settings or in iOS Settings.
Because accounts are anonymous, we may need you to make a request from the device itself, or to supply your account identifier from the app's settings screen, so we can identify the right records. We will not ask you for more information than that.
One limit worth stating in advance rather than in a reply: photographs cannot be produced or deleted on request, because they were never stored. There is nothing to retrieve and nothing to erase.
If you are in Türkiye
Under Article 11 of the KVKK you have the rights of access, correction, erasure, notification of third parties, objection to decisions produced solely by automated processing, and compensation for damage caused by unlawful processing. Requests go to the address in section 02, and we respond within 30 days. If our answer does not satisfy you, you may complain to the Personal Data Protection Authority.
Some of our providers are outside Türkiye. Those transfers are made in accordance with Article 9 of the KVKK, relying on explicit consent or on a commitment approved by the Personal Data Protection Board, as applicable.
If you are in the EU, EEA, UK or Switzerland
Our legal bases are: performance of a contract for the processing needed to run the app and your subscription; consent for AI processing of a photograph and for advertising measurement and tracking, which you give or refuse at the in-app consent sheet and the App Tracking Transparency prompt and can withdraw at any time; and legitimate interests for security, fraud prevention, crash diagnostics and understanding how the app is used, balanced against your interests.
You have the rights of access, rectification, erasure, restriction, portability and objection, the right to withdraw consent at any time without affecting processing already carried out, and the right to complain to your local supervisory authority.
Some of our infrastructure and AI providers operate outside the EEA, including in the United States. Those transfers rely on the European Commission's Standard Contractual Clauses, with the UK Addendum where relevant, together with any additional measures the transfer requires.
If you are in California
Categories collected in the last 12 months: identifiers (anonymous account and device identifiers), commercial information (purchase history), internet activity (app usage), and — only during a transformation request, and not retained — visual information.
We do not sell personal information, and we do not share it for cross-context behavioural advertising as those terms are defined by the CCPA/CPRA. We do not use or disclose sensitive personal information beyond the purposes permitted under the CPRA.
You may request to know, delete or correct, and to opt out of sale or sharing — email [email protected]. We will not discriminate against you for exercising any of these rights. You can use an authorised agent; we will ask for proof of authorisation.
Other jurisdictions
If you are in Brazil (LGPD), Canada (PIPEDA), Australia, or a US state with its own privacy statute, equivalent rights apply and the same address handles them.
13. Security
- There is no password to steal, because there is no password. Accounts are anonymous.
- Photographs are not stored on our servers, so there is no photo store to breach.
- Traffic between the app and our servers is encrypted in transit (TLS); data at rest is encrypted by our cloud provider.
- Database rules restrict every record to the account that owns it. Administrative access is limited to named staff and requires separate credentials.
- Error responses returned by our API are stripped of internal detail, so a fault does not reveal anything about how our systems are built.
- We accept vulnerability reports at [email protected] and will acknowledge within 7 days.
No system is perfectly secure, and we will not claim otherwise. If a breach affects your information we will notify you and the relevant authorities as the law requires.
14. Changes to this policy
If we change this policy we will update the "last updated" date and post the new version at abonelikas.com/miracle-privacy.html. For material changes — a new category of data, a new purpose, a new kind of recipient — we will tell you in the app before the change takes effect.
15. Contact
Questions, requests, or a correction to anything above:
ABONELİK BİLİŞİM HİZMETLERİ SANAYİ İÇ VE DIŞ TİCARET ANONİM ŞİRKETİ
Meriç Mah. 5747/13 Sk. No: 7 İç Kapı No: 1, MTK Sitesi, Bornova, 35090 İzmir,
Türkiye
Privacy: [email protected]
Support: [email protected]