Privacy Policy
Effective: October 21, 2026
MIA Toolkit is built so that we can't see your data — not "we promise not to look," but "there is nothing for us to look at." This page explains exactly what that means.
The app
- Runs completely offline. The internet is only needed once, to download it.
- No account, no sign-up, no cloud.
- No telemetry, no analytics — the app sends nothing, ever, to anyone. One exception you control: clicking "Check for Updates" fetches a single version file from our website; it carries no personal data or identifiers.
- Your medical images never leave your computer (or the USB drive you copy them to). We operate no servers and never see, receive, or store them.
- The app saves only a small settings file on your own computer (for example, your language choice).
This website
- A static site with no cookies, no trackers, and no ads. We use GoatCounter, an open-source, cookieless counter, for aggregate page and button-click counts — it stores no personal data, builds no profiles, and does no cross-site tracking.
- It stores one value in your browser's local storage — your language preference — which never leaves your browser.
- Hosting is provided by GitHub Pages, and downloads by GitHub Releases; GitHub may process standard technical request data (such as IP addresses) as described in GitHub's privacy statement.
- Optional support payments are processed by Lemon Squeezy as merchant of record, under their own privacy policy. We never see your card details.
If you write to us, we use your email address only to reply. No mailing lists, no sharing.
Clinics and hospitals: forms and outreach links
- If you use a request form on our institutional pages (pilot, pricing, procurement kit, MIA Bridge pilot program), we collect only what you type: your name, work email, organisation, role and your answers. We use it only to reply and to run your pilot or request.
- Form submissions are stored in a database on Cloudflare (United States region) that only we can access. We keep them for 24 months after our last contact, then delete them; write to us any time to have them deleted sooner. We store no IP address, no cookie and no device identifier with them. Each submission also triggers an email to our support inbox, delivered by Resend (our email-delivery provider), containing the details you entered.
- Links in emails we send to organisations may carry a short code that identifies the organisation (never the person), so we can see in aggregate that our note arrived. Ask us and we'll send a link without a code.
- Our emails contain no tracking pixels or read receipts.
What we never do
We never sell data, build profiles, track you across sites, or collect your medical information — we couldn't even if we wanted to; it stays on your machine.
Changes
If this policy changes, the new version will be posted here with an updated effective date.