Privacy Policy

This Privacy Policy explains how Sosa Projects, LLC (“Sosa Projects,” “we,” “us,” or “our”), a California limited liability company, collects, uses, shares, and protects information in connection with the Mik mobile application (the “App”), the website at tipmik.com (the “Site”), and related services (together, the “Services”). It also explains the choices and rights you have.

By using the Services, you acknowledge this Privacy Policy. If you do not agree with it, please do not use the Services. Our Terms of Service also apply.

The short version

• Mik keeps a record of your shifts: your jobs, hours, tips, tip outs, wages, and goals. That record exists so the App can show it to you.
• We do not sell your personal information, share it for cross-context behavioral advertising, or use it for advertising. The App contains no advertising or third-party tracking SDKs and does not track you across other companies’ apps or websites.
• When you scan a checkout slip, the photo is read by an AI model to fill in your shift. We instruct our AI routing provider to use only providers that do not store or train on it.
• You can export your shift history at any time, and you can delete your account and data from inside the App.

Information we collect

Information you provide

• Account information. You sign in with Apple or Google. We receive a unique account identifier and, if your Apple or Google account provides it, your email address. If you use Sign in with Apple and choose to hide your email, we receive Apple’s private relay address instead. If you share your name with Apple, the App stores your given name in your sign-in profile with our authentication provider. We do not collect passwords.
• Profile information. The first name you enter during setup.
• Work records. The jobs you add (for example, an employer or venue name, your role, your hourly wage, and your tip-out rule) and the shifts you log (date, start and end times, sales, tips, tip ins, tip outs, wages, and any note you write about a shift, which may mention other people, such as a guest or coworker who tipped you), your scheduled shifts, your earnings goals, and your settings (such as pay period, week start, appearance, and reminder schedule).
• Checkout photos. If you scan a checkout slip, the photo you take or choose. A checkout slip may show information beyond your earnings, such as your employer’s name, your name or employee number, or register details. The App does not attach the photo’s location or other embedded camera metadata.
• Imported records. If you import shift history from a file (for example, a CSV exported from another app), the App reads the file on your phone and sends us the shift records it contains. We do not receive the file itself.
• Tax tools information (optional). If you turn on Mik’s optional tax tools, you may also provide your filing status, an income range, your name and mailing address (used only to print on documents you choose to export), your occupation and employment type for a job, cash and card tips separately, service charges, the recipients of your tip outs (which may be coworkers’ names), whether you declared tips to your employer and any undeclared amounts, and whether figures on your Form W-2 match your records. We never store the amounts from your W-2. We also keep a history of changes you make to verified shift records, which you can export as a record of your tips.
• Communications. If you contact us, the content of your message and your contact details. If you use “Report a bug” in the App, the email it drafts also includes the App’s version and build number, your device model, and its operating system version. You see this information in the draft and can edit or remove it before sending.

Information collected automatically

• Technical and log information. When the App or your browser connects to our servers, we and our infrastructure providers receive technical information necessary to deliver the connection, such as your IP address, device and browser type, and the time and path of the request. Our server logs record request paths, which can include dates or record identifiers, and error details that may include your internal account identifier. We do not log the contents of the shift records you save.
• Website analytics. On the Site (not in the App), we may use PostHog to measure aggregate visits, such as which section of the page was viewed, whether an App Store button was clicked, the referring website or campaign, and your device category. This analytics does not use cookies or persistent identifiers: each page view gets a random identifier that is never stored on your device, and events are not tied to a profile. PostHog receives your IP address and browser information as part of each request.

We do not collect your precise location, contacts, health data, biometric data, or advertising identifiers, and we do not request App Tracking Transparency permission because we do not track you.

Permissions on your device

The App asks for permission to use your camera and photo library only to scan checkout slips, and for notifications only to deliver the reminders you set up. Reminders are scheduled on your device; we do not use push notification services or collect push tokens. You can change these permissions at any time in your device settings.

Information stored on your device

The App stores some information on your phone so it works offline: a cache of your records (kept up to 7 days), changes you made offline that have not yet synced, your in-progress setup answers, and your sign-in session. This information is removed when you sign out.

How we use information

We use information to:

• provide, operate, and maintain the Services, including syncing your records across sessions and devices;
• read checkout slips you scan and fill in your shift for you to review;
• calculate the totals, averages, goals, estimates, and exports you ask for;
• schedule the reminders you choose;
• respond to your requests and provide support;
• secure the Services, prevent fraud and abuse, and troubleshoot problems;
• understand, in aggregate, how visitors use the Site;
• comply with legal obligations and enforce our Terms; and
• carry out any other purpose we describe to you when we collect the information, with your consent where required.

We do not use your information to make decisions that produce legal or similarly significant effects about you, and we do not sell it or use it for advertising.

Scanning and AI

When you scan a checkout slip, the App uploads the photo directly to our private cloud storage. Our server then sends the image, together with the date of the shift, to OpenRouter, a service that routes the request to an AI model provider, currently Anthropic (Claude) and, as a fallback, Google (Gemini). The request does not include your name, email address, or account identifier. The model reads the numbers on the slip and returns them to the App, where you review and correct them before saving; nothing is saved to your records until you confirm.

We instruct OpenRouter to route these requests only to providers that do not retain or use request data for training (OpenRouter’s “deny data collection” setting). The AI providers process the image to return a result and handle it under their own terms and privacy policies. AI can misread a slip, which is why the App always asks you to check the result.

Photo retention. A photo you scan but do not save with a shift is automatically deleted from our storage, generally within one day. A photo you save with a shift is kept with that shift so you can view it later, until you delete the shift or your account.

How we share information

We share information only as described here:

• Service providers. We use service providers (sometimes called processors or subprocessors) that process information on our behalf, under contracts or terms that limit their use of it to providing their services to us. They are listed in the table below.
• Legal and safety. We may disclose information if we believe in good faith that it is required by law, subpoena, court order, or other legal process, or necessary to protect the rights, property, or safety of Sosa Projects, our users, or others, or to investigate fraud or security issues. Where the law allows, we will try to notify you before disclosing your information in response to a legal demand.
• Business transfers. If we are involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or part of our assets, information may be transferred as part of that transaction, subject to this Privacy Policy or a notice we provide you.
• At your direction. When you export your records or share a file from the App, you choose where it goes. Information you send to others is governed by their practices, not ours.

We do not share your records with your employer, the IRS, or any other government agency, except as required by law as described above.

We may change our service providers from time to time. We will update this table when we do.

Payments

Subscriptions are purchased and billed through Apple’s App Store. Apple processes your payment information under its own privacy policy; we do not receive your full payment card details. We may receive information from Apple about the status of your subscription, such as whether it is active or in a trial.

Retention

We keep information for as long as your account is active and as needed to provide the Services, unless a shorter period is described here:

When you delete your account, we delete your account and records from our production systems, delete your checkout photos and exports from storage, and delete your sign-in account with our authentication provider. Information you exported or shared before deletion is outside our control. We may keep information where the law requires it, or where it is reasonably necessary to resolve disputes, enforce our agreements, or protect against fraud and abuse, and only for as long as that need lasts.

Your choices and controls

• Review and correct. You can view and edit your records in the App at any time.
• Export. You can export your shift history as a CSV file from the App (More → Export history).
• Delete. You can delete individual shifts, and you can delete your account and all associated data from the App (More → Delete account). If you signed in with Apple, deleting your account also revokes Mik’s access to your Apple ID.
• Permissions and reminders. You can turn camera, photo, and notification access on or off in your device settings, and change or turn off reminders in the App.
• Tax tools. Tax tools are off unless you turn them on. You can delete your tax profile information in the App.
• Contact us. You can also make any request below by emailing [email protected].

Your privacy rights

Depending on where you live, you may have rights over your personal information, including the right to know or access the information we hold about you, to correct it, to delete it, to receive a portable copy, and to opt out of the sale or sharing of personal information, targeted advertising, or certain profiling. We do not sell or share personal information, use it for targeted advertising, or profile you in ways that produce significant effects, so there is nothing to opt out of; you may still contact us with any request.

To exercise a right, use the controls in the App or email [email protected]. We will verify your request by confirming it through the email address or sign-in account associated with your Mik account, and we will respond within the time the law requires (for example, 45 days under California law, which may be extended once by 45 days where permitted). You may use an authorized agent to submit a request on your behalf; we may require proof of the agent’s authority and ask you to verify your identity directly. If we deny your request, you may appeal by replying to our decision, and we will respond to your appeal within the time required by law. We will not discriminate against you for exercising any of these rights.

California residents

This section supplements the rest of this Privacy Policy and applies to California residents under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA”), to the extent the CCPA applies to us.

In the preceding 12 months, we have collected the following categories of personal information, from you, from your device, and from our authentication providers, for the business purposes described in “How we use information”:

We do not collect sensitive personal information as defined by the CCPA for the purpose of inferring characteristics about you, and we use any sensitive information only as permitted by the CCPA. We do not sell or share (as those terms are defined in the CCPA) personal information, and we have not done so in the preceding 12 months. We do not knowingly sell or share the personal information of consumers under 16.

Shine the Light. California Civil Code § 1798.83 permits California residents to request information about disclosures of personal information to third parties for their direct marketing purposes. We do not disclose personal information to third parties for their direct marketing purposes.

Do Not Track and Global Privacy Control. Because we do not track you across third-party websites or sell or share personal information, we do not change our practices in response to Do Not Track signals. If your browser sends a Global Privacy Control signal, we treat it as a request to opt out of sale and sharing, which we already do not engage in.

Other US states

Residents of other states with consumer privacy laws (such as Colorado, Connecticut, Virginia, Texas, and Oregon) may exercise the rights described above in the same way, including the right to appeal a decision.

Users outside the United States

The Services are operated from the United States, and your information is processed and stored in the United States, where data protection laws may differ from those in your country. If you are in the European Economic Area, the United Kingdom, or Switzerland, we process your information on the following legal bases: to perform our contract with you (providing the Services), our legitimate interests (securing and improving the Services and measuring Site visits in a privacy-protective way), your consent (such as device permissions, which you can withdraw at any time), and compliance with legal obligations. You have the rights described above and may also object to or restrict our processing and lodge a complaint with your local data protection authority. Where required, we rely on appropriate safeguards, such as standard contractual clauses, for international transfers.

Security

We use reasonable administrative, technical, and physical safeguards designed to protect your information, including encryption in transit (HTTPS/TLS), private storage accessed only through short-lived signed links, a database that is not reachable from the internet, access limited to the people and systems that need it, and verification of your sign-in on every request. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we learn of a security breach affecting your personal information, we will notify you and any required authorities as the law requires.

Please protect your device and your Apple or Google account, since anyone with access to them may be able to access your Mik records.

Children

The Services are not directed to children under 13, and we do not knowingly collect personal information from children under 13. You must meet the age requirement in our Terms of Service to use the Services. If you believe a child under 13 has provided us with personal information, contact us and we will delete it.

Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated version here and change the effective date above. If we make a material change, we will notify you in the App or by other reasonable means before it takes effect, and where the law requires your consent, we will ask for it.

Contact us

If you have questions or requests about this Privacy Policy or your information, contact:

Sosa Projects, LLC
California, United States
Email: [email protected]