mimi.io is a research library and career engineering platform. We take data minimisation seriously.
mimi.io collects only what is necessary to provide the service:
Account data — your Google email address and a Supabase user ID, obtained when you sign in with Google OAuth.
Library data — paper metadata you import (titles, authors, abstracts, DOIs, PDF URLs, tags, notes). This data is stored in a PostgreSQL database under your user ID.
CV data — resume content you create in Atelier (work experience, education, skills, bullet points). This data is encrypted at rest and stored under your user ID with Row Level Security.
Job match data — anonymized vector embeddings generated from your resume for Compass Radar matching. No raw resume text is stored in the matching index.
AI usage — a daily count of AI requests per user, used to enforce the free-tier quota of 60 requests per day. No message content is stored.
No tracking — we do not use analytics trackers, advertising pixels, or third-party session recording tools.
• The content of your AI chat messages is not stored. Messages are sent to the Groq API and the response is returned directly to you.
• PDF files you upload are opened locally in your browser and are never transmitted to our servers.
• Resume PDFs exported from Atelier are generated client-side and are not stored on our servers.
• We do not sell, share, or monetise your data with any third party.
• We do not track your behaviour across other websites.
mimi.io uses the following third-party services:
Supabase — authentication and database hosting. Your email, library data, and CV data are stored on Supabase (AWS us-east-1). Supabase’s privacy policy applies: https://supabase.com/privacy
Groq — AI inference for Veritas synthesis and Quill bullet generation. Your chat messages are sent to Groq’s API. Groq’s privacy policy applies: https://groq.com/privacy-policy
CrossRef, arXiv, PubMed, Unpaywall — metadata resolution APIs. We query these services with the paper identifiers you provide. No personal data is sent.
Paddle — payment processing for Pro ($12/mo) and Enterprise tiers. Paddle processes your payment information directly. Paddle’s privacy policy applies: https://www.paddle.com/legal/privacy
Vercel — hosting. Vercel may log IP addresses for security and abuse prevention.
All data in transit is encrypted using TLS 1.3. Database rows are protected with Supabase Row Level Security (RLS) policies — each user can only access their own documents and resumes. We do not have access to your Google password.
Zero LLM Data Retention — AI inference requests are processed in real-time and are not stored by our API provider (Groq) after response delivery. No training is performed on your data.
Enterprise tenants — Enterprise customers receive dedicated PostgreSQL schemas with AES-256 encryption at rest, SAML 2.0 SSO integration, and optional AWS PrivateLink connectivity.
You can delete individual documents and resumes from within the app at any time. To delete your account and all associated data (library, CV data, job match vectors), email us at hello.mimi@gmail.com with the subject "Delete my account" from your registered email address. We will complete the deletion within 14 days.
For privacy questions, contact us at hello.mimi@gmail.com.
Last updated: September 2026