Privacy Policy

The Mirror Project ("we", "us") provides a private space for self-reflection. This policy explains what we collect, how it is used, how it is stored, how long we keep it, and the rights you have over your data.

1. Who this policy covers

This policy applies to everyone who visits mirrorproject.ai, creates an account, or uses any feature of The Mirror Project (the "Service").

2. Information you provide

• Account & profile: your name, email address, password (stored hashed), preferences such as AI tone and notification settings, and onboarding responses.
• Conversations with Mira: messages you send in Chat with Mira, along with Mira's responses.
• Journal entries: the text and metadata of any journal entries you write.
• Daily Check-Ins: mood ratings, notes, and any answers you record.
• Mirror Reflections & Deep Reflections: your prompt answers, the reflections Mira generates, and related session metadata.
• Mira Timeline & History: derived summaries and insights based on your own activity.
• Feedback: anything you submit through "Help Shape The Mirror", including feature requests and ratings.
• Referrals: your personal referral code and information about accounts you refer or that refer you.
• Subscription & billing: subscription status, plan, renewal dates, and identifiers created by our payment processor. We do not store your full card number.

3. Information collected automatically

• Basic device and browser information (user agent, approximate locale, timezone).
• Usage counters we need to enforce free-plan limits (for example, daily AI responses used).
• Server-side error information when something breaks, so we can fix it.

4. How we use your information

• To provide the Service and personalize Mira's responses to you.
• To enforce plan limits and prevent abuse.
• To operate billing, referrals, and account features.
• To respond when you contact support or submit feedback.
• To improve the Service, always using only aggregated or de-identified signals for product analysis.

5. AI processing

Mira's replies are generated by third-party large language models accessed through the Lovable AI Gateway. When you interact with Mira, the content of your message and relevant context (recent conversation, reflection prompts) is transmitted to the model provider to produce a response. Providers may temporarily process this content to generate a reply and for abuse monitoring under their own terms. We do not sell your content, and we do not use your private writing to train third-party models.

6. Payment processing

Subscriptions are processed by Stripe. Stripe receives the information necessary to complete the transaction (billing details, card data, IP). We receive only the subscription status, plan identifiers, renewal dates, and a customer identifier used to link the subscription to your account. Stripe's own privacy notice governs how they handle payment data.

7. How we store and protect your data

Data is stored on managed cloud infrastructure with encryption in transit (HTTPS/TLS) and encryption at rest provided by our database host. Access to production data is restricted to a small number of maintainers and protected by row-level security so that one user's reflections cannot be read by another user. No system is perfectly secure; we do not warrant that unauthorized access can never occur.

8. Sharing

We do not sell your personal information. We share data only with the service providers that make The Mirror Project work — hosting and database (Lovable Cloud / Supabase), payment processing (Stripe), and AI model access (Lovable AI Gateway) — and only to the extent needed to provide the Service. We may disclose information if required by law or to protect the safety of users or the public.

9. Your rights

• Access & export: download a structured copy of your data from Settings → Data.
• Correction: edit your profile and preferences at any time.
• Deletion: delete your account from Settings → Data. If you cannot sign in, use the public deletion request form.
• Portability: the export is provided in JSON.
• Depending on where you live (for example the EU/EEA, UK, or California), you may have additional rights, including the right to object to processing or file a complaint with your local data-protection authority.

10. Data retention & deletion

We keep your data for as long as your account exists. When you delete your account, your reflections, conversations, journal entries, check-ins, timeline entries, feedback, and referral entries are removed from our active systems within a reasonable period. We may retain a limited set of records that we are legally required to keep — including payment records for tax and accounting, and abuse or fraud-prevention logs — for the minimum period required, after which they are also deleted or anonymized.

11. Children

The Mirror Project is not intended for children under 13, and is not directed to anyone under the age required to consent to online services in their jurisdiction. Do not use the Service if you are under that age.

12. Changes to this policy

If we make material changes, we will update this page and the "Last updated" date above. Significant changes will be surfaced in the app.

13. Contact

Questions or requests: visit our Support page for the current contact email.