Privacy policy

Last updated: 25 October 2026

This policy explains what personal data the Mitlo app collects, why, who else receives it, how long it is kept and what rights you have. Mitlo is a household app for shared expenses, shopping lists, chores and receipts. It shows no ads, uses no tracking or analytics tools and never sells data.

1. Who is responsible

The controller under the GDPR is:
[Your full name]
[Street and number]
[Postcode and city], Germany
Email: nestmate.support@gmail.com

No data protection officer is appointed, as none is required.

2. What data we process

Your account

• Email address, name and app language.
• Your password is handled by Google Firebase Authentication (see section 4). Mitlo itself never sees or stores it. If you sign in with Google or Apple, we receive your name and email from them. If you use Apple's "Hide my email", we only receive a relay address.
• Optional payment details you enter: PayPal.me name and IBAN. Only members of your households can see them, so they can pay you back.
• The date you accepted these terms and this policy.

What you and your housemates enter

• Households, their members and roles, and invite codes.
• Expenses (title, amount, category, date, notes, who paid and how it is split), payments between members, recurring bills, chores and who did them, and shopping list items.
• Receipt photos you take, including everything visible on them, and the text and amounts read from them.

Everything in a household is visible to all of its members. Your housemates may also enter data that concerns you, for example an expense they paid for you.

The AI assistant and receipt scanning

• When you ask the assistant something, your question, your last few messages and a summary of your household's current data are sent to the AI provider, Mistral AI in France (section 4). The summary contains member names, shopping items, balances, chores and recent expenses. It never contains email addresses, or other members' personal expenses.
• The conversation is not stored on our server. It stays on your phone until you clear it or close the app.
• The assistant only suggests changes. Nothing is saved until you confirm it.
• When you scan a receipt, the photo is sent to Mistral AI for text recognition, and the recognised text is then sorted into items and amounts by Mistral's language model.

Voice input

• If you tap the microphone (in the assistant or the shopping list), what you say is turned into text by your phone's own speech recognition: Apple's on an iPhone, Google's on Android. Depending on your phone and language, the recording may be processed on Apple's or Google's servers (section 4).
• Only the resulting text reaches Mitlo, in the same field you could have typed it into. We never receive or store the recording.

Technical data

• Server logs: for each request, the IP address, time, requested address and response status. Used for security and error analysis, and deleted after 7 days.
• Sign-in sessions: when a session started, was last used and expires. Deleted at the latest 90 days after sign-in or when you sign out.
• Push notifications: a device token, so notifications reach your phone.
• Usage counters: how often you used AI features per day, to enforce the daily limits. Deleted after 30 days.
• AI cost records: for each AI request, the feature, the number of tokens or pages and the resulting cost, to keep within our budget. Deleted after 62 days.
• Abuse protection: request counts per IP address, held only in memory and gone after 15 minutes.

The app asks for access to your camera and photos only to attach receipts, to the microphone and speech recognition only for voice input when you tap the microphone, and to notifications only to send reminders. You can refuse or withdraw each of these in your phone's settings. The app does not use your location or contacts.

3. Purposes and legal bases

• Providing the app (account, households, expenses, assistant, scanning, notifications): Art. 6(1)(b) GDPR, performance of our contract with you.
• Data about housemates entered by others, so a household can keep shared records: Art. 6(1)(f) GDPR, the legitimate interest of the household's members.
• Security, abuse prevention, usage limits, logs and backups: Art. 6(1)(f) GDPR, our legitimate interest in a secure, working and affordable service.
• Answering your support emails: Art. 6(1)(b) or (f) GDPR.

4. Service providers and recipients

We use these providers as processors under data processing agreements. They may use the data only on our instructions.

• Hetzner Online GmbH, Gunzenhausen, Germany: the server, database, receipt photos and backups. Everything is stored in Germany.
• Google Ireland Ltd. / Google LLC (USA), Firebase Authentication and Google Sign-In: sign-in, email, name and password (stored hashed by Google), sign-in times and IP address. Google also delivers notifications to Android phones (Firebase Cloud Messaging), and its email service receives your support emails. On Android, Google's speech recognition turns voice input into text.
• Apple Distribution International Ltd. / Apple Inc. (USA): Sign in with Apple, if you choose it, delivery of notifications to iPhones, and on an iPhone, Apple's speech recognition for voice input.
• Mistral AI SAS, Paris, France: the AI that answers the assistant, reads typed expenses, recognises the text on receipt photos and sorts it into items. Processing takes place in the EU.
• 650 Industries, Inc. (Expo, USA): forwards push notifications to Google and Apple. A notification's text can contain names and amounts, for example "Sara added Groceries, your share €12.50".

Within a household, the data described in section 2 is shared with its members. We do not pass data to anyone else, unless we are legally required to.

5. Transfers outside the EU

Google, Apple and Expo may process data in the USA. Transfers are based on the EU–US Data Privacy Framework where the provider is certified, and otherwise on the EU Standard Contractual Clauses (Art. 46 GDPR). [Check and name the basis for each provider before publishing.]

6. How long we keep data

• Account and household data: until you delete your account, or until a household is deleted.
• When you delete your account (Settings → Delete account):
  • your name, email, payment details, sessions, device tokens and the receipt photos you uploaded are deleted, and so is your Firebase login. If you signed in with Apple, Mitlo's access to your Apple ID is revoked too;
  • so your housemates' balances stay correct, expenses you took part in remain in the household, shown as "Former member".
• Server logs: 7 days. AI usage counters: 30 days. AI cost records: 62 days. Sessions: at most 90 days.
• Backups: database backups are kept for 14 days, so deleted data disappears from them within that time.

7. Your rights

You have the right to:

• access your data (Art. 15) and receive it in a portable format (Art. 20). In the app: Settings → Download my data;
• have it corrected (Art. 16) or deleted (Art. 17). In the app: Settings → Delete account;
• restrict processing (Art. 18);
• object to processing based on legitimate interests (Art. 21).

To use these rights, write to the email above. You also have the right to complain to a data protection supervisory authority, for example the one responsible for us: [name of the authority of your federal state, e.g. Bayerisches Landesamt für Datenschutzaufsicht].

8. Age

Mitlo is meant for people aged 16 and over.

9. Changes

If the app or the law changes, we update this policy. The date at the top shows the current version.