Privacy Policy

1. Overview

At Mirror AI Technology, Inc. ("Mirror", "we", "us"), protecting your privacy is one of our highest priorities. This Privacy Policy explains how your personal data is collected, used, and safeguarded when you use the Mirror app and related services.

For the purposes of GDPR and the Turkish Data Protection Law (KVKK), the data controller is Mirror AI Technology, Inc., 131 Continental Dr, Suite 305, Newark, DE 19713, USA — hi@mirrorid.ai.

2. Data We Collect

When you use Mirror, we may collect:

• • Account information: Email address, name (optional), profile photo
• • Reflection data: Text you enter, voice recordings, photos, your selections
• • Emotional analysis: Seven-dimension scores, soul map data
• • Purchase history: Store receipt information and subscription status to verify your subscription (card details never reach Mirror)
• • Approximate location (optional): With your permission, coarse location for the weather card; coordinates are not saved to your account
• • Usage data (opt-in): If you enable it, which modules you use and session duration — anonymized
• • Technical data: Device model, OS and app version; anonymous crash diagnostics (Firebase Crashlytics)
• • What we never collect: Advertising identifiers (IDFA/GAID), ad-network data, third-party tracking profiles

3. How We Use Data

We use collected data to:

• • Offer a personalized emotional reflection experience
• • Improve Mirror Brain AI and provide better guidance
• • Create anonymous matches on Misel Network
• • Improve app performance
• • Maintain security and prevent fraud

Legal bases (GDPR Art. 6 / KVKK Art. 5): We process your data to establish and perform our contract with you (providing the Service), on the basis of our legitimate interest (security and fraud prevention), and — where required — your explicit consent (for example, optional health data and cross-border transfers).

4. Data Security

All requests are encrypted in transit with TLS 1.2+, and your data is encrypted at rest with AES-256 in the EU region (europe-west1). Firestore security rules ensure that only you can access your reflections and voice recordings; every API call is verified by Firebase App Check. Content shared on Misel Network is fully anonymous and cannot be linked to your identity.

We never sell your data and never share it with ad networks or data brokers. Your data is processed only by the service providers listed in Section 7, solely to deliver the Service.

5. Your Rights

Under GDPR and applicable privacy laws, you have the right to:

• • Access your data and obtain a copy
• • Correct or update your data
• • Know the third parties to whom your data is transferred
• • Delete your data entirely (close your account)
• • Restrict or object to processing
• • Data portability (transfer to another service)

How to exercise your rights: send your request to hi@mirrorid.ai — we respond free of charge within 30 days. You can also permanently delete your account in-app: Settings → Account → "Delete My Account". Users in Turkey may additionally lodge a complaint with the Turkish Data Protection Authority; EU users with their local supervisory authority.

6. Children's Privacy

Mirror does not knowingly collect data from anyone under 13 (US/COPPA), under 16 (EU/GDPR), or under 18 (Turkey/KVKK). If we learn that we have collected data from a minor, that data is deleted immediately. If you are a parent and believe your child has provided personal information to us, please contact us.

7. Third-Party Services, Cookies, and Tracking

Mirror uses no advertising or tracking cookies; there are no third-party analytics SDKs, no ad identifiers (IDFA/GAID), and no tracking profiles. To provide the Service we work only with the following providers:

• • Google Firebase: Authentication, database, and storage. Your reflections are stored in the EU region (europe-west1) and encrypted at rest.
• Google’s Gemini API service, through Mirror’s server. Mirror requires third-party data processors to provide the same or equivalent protection as this policy. Google’s service and data processing terms govern processing purposes, confidentiality, security obligations and subprocessors. The provider’s retention and processing terms are described in the links below.
• • Apple In-App Purchase: Subscription verification. Your card details are never seen or stored by Mirror.

These providers process your data solely to deliver the Service to Mirror; they may not use it for their own purposes.

8. Data Retention

We retain your data while your account is active. When you delete your account, all personal data is permanently removed within 30 days. Some data (such as payment records) may be kept longer where required by law.

9. International Data Transfers

Your reflections and account data are stored on Google Cloud / Firebase infrastructure in the European Union region (europe-west1) and encrypted at rest. The data controller, Mirror AI Technology, Inc., is a company incorporated in Delaware, USA.

For users in Turkey (KVKK Art. 9): when you use Mirror, your personal data is transferred abroad — to Google Cloud servers in the EU region and to the US-based data controller. This transfer is necessary to provide the Service and relies on the explicit consent you give when you start using the app. For users in the EU, transfers are carried out under GDPR safeguards and standard contractual clauses.

AI data sharing

Who receives it?

Google’s Gemini API service, through Mirror’s server.

What is shared?

Depending on the feature: your text and chat history; selected past reflections and memory summaries; audio recordings, drawings or images you submit for analysis. Personal information you include in this content may also be sent. Your display name, language preference and module activity summaries may also be included as context.

What is it used for?

To generate AI replies and reflections, analyze audio and images, translate text, build chat memory, and check the safety of content you choose to submit to Collective Mirror.

Your choice

Without permission, no data is sent to AI. You can open your saved entries and write without AI. You can withdraw permission in Settings › Privacy to stop future sharing.

Google’s Gemini API service, through Mirror’s server. Mirror requires third-party data processors to provide the same or equivalent protection as this policy. Google’s service and data processing terms govern processing purposes, confidentiality, security obligations and subprocessors. The provider’s retention and processing terms are described in the links below.

Gemini API · Google Data Processing Addendum

11. Health Data (Apple Health / Body Layer)

If you open the optional Body Layer and tap the explicit "Allow Health Access" button:

• • Read-only: Mirror only reads from Apple Health (heart rate, resting heart rate, HRV, sleep, steps, active energy, workouts, blood oxygen, respiratory rate). It never writes, modifies, or deletes Health data, and never requests clinical health records.
• • Never: Your health data is never used for advertising, tracking, or third-party profiling, and is never included in anything sent to the AI provider.
• • You stay in control: You can revoke access at any time via iPhone Settings → Privacy & Security → Health → Mirror ID. Without permission, the Body Layer stays closed and no Health data is read.

12. What Mirror Is Not

Mirror is a mirror — not therapy, not medical diagnosis, not a treatment tool, not coaching. Mirror only reflects; it does not change, transform, or direct. The emotional content you share is processed as personal reflection content, not as clinical data.

13. Contact

For questions about this Privacy Policy or your data:

Email: hi@mirrorid.ai

Company: Mirror AI Technology, Inc.

Address: 131 Continental Dr, Suite 305, Newark, DE 19713, USA