Privacy Policy

The person responsible for data processed in connection with the App (the data controller) is:

Justyna Politanska, operating as the developer of Mirror Works.
E-mail: hello@mirrorwrk.com

You can start using Mirror without creating a traditional account. When you choose "Continue as guest", the App creates an anonymous account for you on our backend (Supabase). This account is identified by a randomly generated identifier, not by your name or e-mail, and it lets your sessions and progress be saved and synced.

You may later choose to add an e-mail address and password to secure your account and keep access to your data across devices. If you do, we store your e-mail address and a securely hashed version of your password (handled by our authentication provider — we never see your password in plain text). You may also add a display name and, optionally, a profile photo.

Mirror saves your work to our servers so it can sync and is not lost if you change device. Associated with your (anonymous or e-mail) account, we store:

• Your reflective work: your sessions, the beliefs you identify, the contents of your conversations with the guide, your progress through the process, and the new belief ("new truth") you reach.
• Profile: your display name and, if you add one, a profile photo.
• Preferences: your interface language and your reminder settings.
• Usage information: simple counts such as active days and completed sessions.

This data is stored using Supabase, our backend provider. Our database is hosted in the European Union — West EU (Ireland) region, on infrastructure operated by Amazon Web Services (AWS). Storing your data within the EU is a deliberate choice to keep it under EU data-protection rules.

To generate the AI guide's responses, the content of the messages you send during a session is sent to an external AI model provider. These providers may include, but are not limited to, OpenAI and Anthropic, or another provider offering comparable technology. The provider we use may change over time depending on quality, availability, security, cost or technical requirements. In every case, the provider processes your message content only as far as needed to generate a response and run the App's features.

Some of these providers operate outside the European Economic Area (EEA), including in the United States. This means your message content may be transferred to and processed outside the EEA, including in the United States. Such transfers rely on the safeguards required by the GDPR, such as the European Commission's standard contractual clauses.

The App does not collect:

• Payment-card details or banking information (payments are handled entirely by the app stores).
• Your GPS location.
• Your contacts.
• Advertising identifiers — the App does not show ads or track you for advertising.

You are not required to give an e-mail address: if you stay in guest mode, we do not have your e-mail.

Mirror uses an AI-powered guide to lead you through a reflective, step-by-step process. Please understand its limits:

You remain responsible for how you use the guide's responses and for seeking professional help when it is needed.

Under the GDPR, we rely on the following grounds:

• To provide the App — creating your account, saving your sessions and generating AI responses are necessary to deliver the service you asked for (Art. 6(1)(b) GDPR).
• To personalise and improve the App — based on our legitimate interest in offering a useful, reliable experience (Art. 6(1)(f) GDPR).
• To send reminders — only if you turn them on and grant permission (Art. 6(1)(a) GDPR, consent).

The following providers may process data in connection with the App:

• Supabase — authentication, database and storage for your account and content; hosted in the EU (Ireland) on AWS. supabase.com/privacy
• AI model providers — to generate AI responses; these may include OpenAI and Anthropic, among comparable providers. See openai.com/privacy and anthropic.com/legal/privacy.
• RevenueCat — manages subscription status. revenuecat.com/privacy
• Apple (App Store) — iOS distribution and payments. apple.com/legal/privacy
• Google (Google Play) — Android distribution and payments. policies.google.com/privacy

We do not sell, rent or trade your personal data.

Mirror is free to start. Some features are free; the full process is available through an optional Premium plan, offered as a monthly or yearly auto-renewing subscription, or as a one-time Lifetime purchase. All payments are handled by the Apple App Store (iOS) or the Google Play Store (Android) — we never see or store your card details. Subscription status is verified through the store and through RevenueCat. There is currently no free trial. You can cancel at any time in your store account settings, and refunds follow Apple's and Google's rules.

The App can send reminders (for example, a gentle once-a-day nudge to return to your practice) only if you allow notifications. You can adjust quiet hours, or turn reminders off entirely, at any time in the App's settings or in your device's system settings.

The App is intended for adults only. You must be at least 18 years old to use Mirror Works. If we learn that data of a person under 18 has been collected, we will delete it.

We use reasonable technical and organisational measures to protect your data. Data is transmitted over encrypted (HTTPS) connections, passwords are stored only in hashed form, and your content is stored on Supabase infrastructure within the EU. No system is perfectly secure, but we apply safeguards appropriate to the data we hold.

• Account and content: kept for as long as your account exists, so that your sessions and progress remain available to you.
• Important: because your data is stored on our servers, uninstalling the App does not delete your account or your saved data. To remove it, use the deletion options below.
• AI processing: message content is sent to the AI provider in real time to generate a reply; any logs are kept according to that provider's standard practices.

You can delete your account and the data associated with it directly in the App, using the "Delete account" option in settings. You can also ask us to delete your data by writing to hello@mirrorwrk.com. Deleting your account removes your stored sessions, beliefs, conversations and profile. Full step-by-step instructions, including what is deleted and what is retained, are available at mirrorwrk.com/delete-account.html.

If you are in the EEA, you have the right to access, correct, delete, restrict, port, and object to the processing of your personal data, and to withdraw consent at any time without affecting processing already carried out. To exercise these rights, contact us at hello@mirrorwrk.com.

You also have the right to complain to a supervisory authority. In Poland this is the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw.

To the fullest extent permitted by law, the App is provided "as is". We are not liable for interruptions or technical failures, for the accuracy of AI-generated responses, or for decisions made in reliance on them. Nothing here limits liability that cannot be limited under applicable law.

We may update this policy. We will change the "Last updated" date above and, where appropriate, notify you in the App. Continuing to use the App after a change means you accept the updated policy.

For any question about this policy or your data: