Privacy Policy
MirrorSage is a companion app you talk to. Talking means your voice, your words and, if you choose the portrait feature, your face pass through our systems and through the providers that make the app work. This page says exactly what goes where, for how long, and what say you have in it. The short version: we keep what the app needs to work and remember you, we do not sell any of it, and we do not use it to advertise to you.
1. Who controls this data
MirrorSage is the controller of the personal information described here. Privacy requests go to [email protected].
2. What we collect
- Account information. When you sign in with Apple or Google we receive a stable account identifier and, if you allow it, your name and email address. We never receive your Apple or Google password. The app also keeps a secret device credential on your phone so it can talk to our servers; it is not a hardware identifier.
- Your guide and settings. Which guide you chose, the voice you picked, changes you asked for (warmer, calmer, deeper), and your preferences.
- Conversations. What you type, what you say, and what the guide answers. Voice turns are recorded on your phone while you speak, sent to our server, transcribed to text, and the audio is discarded after transcription. The text of the conversation is kept so the guide can remember you across sessions.
- Your photo and portrait, only if you buy "Your face as light": the photo you take in the app, and the painted portrait that comes back. See section 5.
- Purchases. Apple or Google tell us which pack or portrait you bought and give us a transaction reference so we can credit your account. We never see your card details.
- Usage and device data. Ordinary server logs: IP address, app version, requests, timestamps, and error or crash logs, kept for security and debugging, not for profiling.
- Camera feed in "In your room" mode. Stays on your device. Not recorded, not stored, not sent to us.
- The website (mirrorsage.com) sets no cookies and runs no analytics or advertising scripts. Our hosting and CDN providers see standard connection data (section 4).
3. How we use it
To run the app (sign-in, conversations, voices, minutes, the portrait); to let the guide remember what you told it; for security and fraud prevention; to credit purchases; to give support; to comply with the law; to improve the product; and to send you transactional messages (purchase confirmations, terms updates). We do not send marketing email unless you opt in, and we do not use your conversations or your photo to train any model, ours or anyone else's.
4. Who we share it with
We do not sell your personal information and we do not share it for advertising. We share it only with the companies that make the app work, each for its own job:
- Apple and Google, for sign-in and in-app purchases, under their own privacy policies.
- Anthropic, whose language model generates the guide's replies. It receives the text of your conversation (and the guide's instructions). Under our agreement it does not use your data to train its models.
- ElevenLabs, which transcribes your voice recordings to text and turns the guide's replies into speech. It receives the audio of what you say and the text the guide answers.
- Higgsfield, which paints the portrait. It receives the photo you took and a style reference, temporarily, to run the painting job. See section 5.
- Resend, to deliver our email.
- Cloudflare, our DNS, content delivery network and DDoS protection provider, which sits in front of the site and sees standard connection and request data.
- DigitalOcean, our hosting provider in the United States.
- Law enforcement or another party, if the law requires it or to protect someone's safety.
- A buyer of the business, if MirrorSage is ever sold or merged, under the same commitments in this policy.
- Anyone you direct us to share it with.
5. Your photo and the portrait
- You take the photo in the app, on purpose, after a notice that it will leave your phone. We never read your camera roll.
- The photo is uploaded to our server, re-encoded, and stored under an unguessable name only while the painting runs. It is deleted from our server as soon as the painting finishes, whether it succeeded or failed.
- The photo and a style reference are placed in our painting provider's temporary file store and sent to its image model to generate the portrait. The provider keeps the files only temporarily to run the job.
- The painted portrait (a picture of a being of light that resembles you) is stored on our server, attached to your guide, until you remove it in Settings, replace it, or delete your account.
- Your photo and portrait are never used to train any model, never shown to other users, and never used for anything other than painting and showing your own portrait.
6. Legal bases for visitors in the EEA or UK
Where European or UK privacy law applies, we process your information under one of these bases: performance of a contract (running your account, the conversation, your purchases), legitimate interests (security, preventing fraud, improving the app), your consent (the portrait photo, marketing email), or a legal obligation.
7. Retention
- Account data and conversations: kept while your account exists, then deleted within 30 days of closure. Ask us by email to delete a conversation or all of them.
- Voice recordings: discarded right after transcription.
- Portrait photo: deleted from our server when the painting finishes; held by the painting provider only temporarily to run the job.
- Portrait: kept until you remove it, replace it, or delete your account.
- Terms acceptance records: kept 7 years, as evidence of agreement.
- Purchase records: kept 7 years, for tax and accounting.
- Server logs: kept up to 30 days.
- Backups: kept up to 90 days on a rolling basis. Content you delete leaves the live system immediately and backups as they rotate out.
- Moderation records: kept 2 years.
8. Security
Data moves over TLS in transit and is encrypted at rest on our hosting volumes. Access to production systems is limited to the people who run MirrorSage, and secrets are kept in a secrets manager, not in code. The app authenticates with a device credential kept in your phone's secure storage. No method of transmission or storage is perfectly secure, and if a breach affects your information we will notify you as required by the Texas Business and Commerce Code section 521.053 and any other law that applies.
9. Your rights
You can ask us to access, correct, delete, or export (in a portable format) the personal information we hold about you, and you can object to or ask us to restrict certain processing. Remove your portrait in Settings; for conversations or your whole account, email [email protected]. We will verify your identity before acting on a request and respond within 45 days.
California (CCPA/CPRA). If you are a California resident, you have the right to know what personal information we collect, to delete it, to correct it, to opt out of the sale or sharing of it (we do neither), to limit use of sensitive personal information, and to not be discriminated against for exercising these rights. You can use an authorized agent to make a request on your behalf.
Texas (TDPSA). If you are a Texas resident, you have the right to confirm whether we process your personal data, to access, correct, delete and get a portable copy of it, and to opt out of targeted advertising, the sale of personal data, and profiling in furtherance of decisions with legal or similarly significant effects (we do none of these). To exercise a right, email [email protected]. We will respond within 45 days. If we decline a request, you can appeal by replying to our decision within 60 days, and if we deny the appeal we will tell you how to file a complaint with the Texas Attorney General.
EEA/UK. If European or UK data protection law applies to you, you also have the right to lodge a complaint with your local supervisory authority.
10. Children
MirrorSage is not directed to children. We do not knowingly collect personal information from anyone under 13, and we do not knowingly let anyone under 18 hold an account. If we learn we have collected information from a child, we delete it. A parent or guardian can write to [email protected].
11. International transfers
MirrorSage is hosted and operated in the United States, and personal information is stored there. Where a transfer of EEA or UK data to the United States requires a safeguard such as standard contractual clauses, our processors provide it.
12. Cookies, Do Not Track and Global Privacy Control
The website sets no cookies. The app uses no advertising or analytics trackers. Because we do not sell or share personal information, there is nothing for a Global Privacy Control signal to opt you out of, and we do not respond to browsers' Do Not Track signal, which is not a consistent standard.
13. Deleting your data
Email [email protected] from the address on your account and we will delete the account and everything tied to it, subject to the retention periods in section 7.
14. Changes to this policy
We update this policy when what we collect or share changes. Material changes are announced the same way as changes to the Terms of Use. The version and date at the top tell you which one you are reading, and the current version always lives at this address.
15. Contact
MirrorSage. Everyday support: [email protected]. Privacy requests and legal notices: [email protected]. Our terms of use are at mirrorsage.com/terms.