Privacy Policy — Mirror

Last updated: 3 August 2026 · Version 2.3

1. Our Principles

In short:

• Your entries stay with you — on your device and in your iCloud, not on the Operator's servers; they are encrypted.
• We collect minimal data about you: the entries themselves remain on your device and in iCloud, not on our servers.
• We do not sell your data and do not use it for advertising.
• Statistics and charts are calculated locally on your device.

2. Who We Are

The Operator (the data controller within the meaning of the GDPR) is SIA SCADA, Rīga, Rūpniecības iela 32B - 1I, LV-1045, Latvia, European Union. For privacy matters: hello@mirror.do.

This Policy explains what data the Mirror application (the "Application") processes, on what basis, to whom it is transferred, and what rights you have.

3. What Data We Process

• Diary entries and mood ratings. Texts, ratings on a 1–7 scale, date and time. Stored locally on your device and in your encrypted iCloud (including an automatic backup file in the Application's iCloud Drive container, which you can restore from or delete in the Application); the Operator does not store them on its servers and cannot access the copies on your device and in iCloud. When you use the AI or voice features, the relevant content passes through the Operator's proxy only in transit to the providers; the content is not stored on the proxy.
• Voice input (optional). If you dictate an entry by voice, the audio recording is transmitted to a speech-recognition provider (OpenAI Ireland Ltd.) solely for conversion to text. The audio is used only for recognition and is not stored by the Operator as separate content; thereafter the recognized text is processed. If you do not use voice input, no audio is recorded. Voice input is unavailable in Local Mode, so no audio leaves the device in that mode.
• Data transmitted for the AI analysis (optional). If you use the AI features, the entry text as written by you, the rating, and the metrics attached to the entry (including Apple Health data, if connected) are transmitted to the AI provider (Anthropic, PBC) solely to generate the analysis. The transmission carries no user or account identifiers. Entries created in Local Mode are never transmitted for AI processing — neither as the subject of analysis nor as context for analyzing other entries — and remain only on your device and in your iCloud, even if you later switch back to AI Mode.
• Apple Health data (optional). If you connect Apple Health, the relevant metrics (for example, sleep, activity) are used to enrich entries. We do not transfer them to third parties for their own purposes and do not use them for advertising.
• Purchases and subscriptions. Payments are processed by Apple. The Operator does not receive or store your payment details.
• Technical usage metrics. When you use the AI or voice features, the Operator records numeric usage counters — the number of requests, token counts, voice-recording duration, and the computed cost — linked to a random technical identifier generated in the Application. These counters contain no entry text, no transcripts, and no account data (such as your name, email, or Apple ID), and are used solely for fair-use enforcement and service-cost accounting. This identifier is not transmitted to the AI or speech-recognition providers.

4. Legal Bases for Processing (GDPR)

• Explicit consent — Art. 9(2)(a) and Art. 6(1)(a). For processing diary entries, mood ratings, and related special-category data, for transmitting data (without user or account identifiers) to the AI provider, and, when voice input is used, for transmitting the audio recording to the speech-recognition provider. You give consent explicitly and can withdraw it at any time.

These features are optional and under your control: you can switch the Application to Local Mode in Settings at any time — new entries are then processed entirely on your device and never transmitted for AI analysis — as well as disable access to Apple Health and not use voice input. If you do not use these features, the corresponding processing and data transmission do not take place.

5. How We Use Data

• To provide the Application's features and to generate the AI analysis.
• For support, responding to inquiries, and troubleshooting.
• To ensure the security and improve the operation of the Application.

We do not use your data for advertising, do not sell it, and do not transfer it for third-party marketing. Data transmitted for the AI analysis and speech recognition is not used by the providers to train models by default.

6. To Whom We Transfer Data (Processors)

We engage a limited number of processors acting on our behalf when you use the relevant features:

• Anthropic, PBC (USA) — processing the entry text as written (transmitted without user or account identifiers), rating, and attached metrics to generate the AI analysis. Policy: https://www.anthropic.com/legal/privacy.
• OpenAI Ireland Ltd. (Ireland; processing may also take place in the USA) — converting the voice-input audio recording to text. Policy: https://openai.com/policies/.
• Apple (iCloud, App Store) — storing your data in your iCloud and processing payments. Policy: https://www.apple.com/legal/privacy/.
• Vercel Inc. (USA) — hosts the Operator's proxy, which relays requests for the AI analysis and voice transcription in transit to the respective providers (Anthropic, OpenAI). The content of your entries and recordings is not stored on the proxy; only the numeric usage counters described in Section 3 are stored. Policy: https://vercel.com/legal/privacy-policy.

7. International Data Transfers

When you use the AI and voice-input features, data (text, ratings, attached metrics, and the voice-input audio recording) may be processed outside the European Economic Area (in particular, in the USA). In such cases, the transfer is safeguarded by appropriate mechanisms — Standard Contractual Clauses approved by the European Commission (SCC), as part of the contracts with the providers.

8. Retention Periods

• Entries and ratings are on your device and in your iCloud and are retained until you delete them. Deleting entries and the Application is under your control.
• Data transmitted for the AI analysis and the voice-input audio recording are, under the providers' current policies, as a general rule deleted from their servers within 30 days, unless longer retention is required by law.
• Technical usage metrics (Section 3) are stored as monthly aggregate numbers and are retained for as long as necessary for fair-use enforcement and service-cost accounting.

9. Security

Data is encrypted in storage on the device and in transit. Storage in iCloud is provided by Apple's infrastructure. Entries are not stored on the Operator's servers, and the Operator cannot access the copies on your device and in iCloud; when you use the AI or voice features, the relevant content passes through the Operator's proxy only in transit, and no content is stored on the proxy (only the numeric usage counters described in Section 3). We take reasonable protective measures; however, no method of transmission or storage on the internet is absolutely secure.

10. Your Rights

Because entries are stored with you (on your device and in iCloud) rather than on the Operator's servers, you exercise access, rectification, deletion, and portability directly in the Application — you view, edit, delete, and export entries, and you can delete them together with the Application and the iCloud copy.

With respect to the processing carried out by the Operator (the AI analysis and speech recognition on the basis of your explicit consent), you have the following rights under the GDPR:

• access to the data;
• rectification or erasure;
• restriction of, or objection to, processing;
• portability;
• withdrawal of consent at any time — in the Application's settings and, for features with system permissions (microphone, Apple Health), also in your device settings. After withdrawal, the corresponding features become unavailable, the lawfulness of processing already carried out is not affected, and data already transmitted to the providers is, as a general rule, deleted by them within 30 days.

11. Residents of the USA and Other Countries

Because the Application is available worldwide, you may have additional rights depending on your jurisdiction. We do not sell or share your personal data within the meaning of US privacy laws (including California's CCPA/CPRA). Residents of certain US states have the right to request a copy, deletion, or correction of their data and not to be discriminated against for exercising these rights. Because entries are stored with you on your device, you exercise most of them yourself in the Application.

12. Children

The Application is intended for persons aged 16 and older and is not directed to children under 16. If you are under 16, you must not use the Application unless this is permitted by applicable law and authorized by your parent or legal guardian.

13. Changes to the Policy

We may update this Policy. You will be notified of material changes through the Application. The Operator determines, at its reasonable discretion, which changes are material. Continued use after the changes take effect means acceptance of the updated Policy.

14. How to Contact Us

For privacy matters and exercising your rights: hello@mirror.do.