Privacy Policy

1. Who we are

Mirror provides self-discovery questionnaires and personalized reflections. Mirror is responsible for the personal data described in this policy. Contact us at support@lookatmirror.com.

2. Data we collect

• Assessment data: your answers, including any optional free text, assessment progress, scores, generated results, and your evolving personality portrait.
• Account data: your email address, optional display name, account settings, and consent choices.
• Subscription data: your Stripe customer reference, subscription status, and billing period. Stripe processes your payment details; Mirror does not store complete card numbers.
• Technical and usage data: necessary session cookies, an anonymous assessment token, and limited events such as page or feature use. Our analytics are designed not to record answers, free text, names, or email addresses.
• Communications: messages you send to support.

3. How we use data

We use personal data to:

• run, secure, troubleshoot, and improve Mirror;
• save your progress and create and display your results;
• manage accounts, subscriptions, support, and service messages;
• prevent fraud, abuse, and security incidents; and
• send marketing only if you separately choose to receive it.

Where applicable, our legal bases are performing our contract with you, our legitimate interests in operating and securing the service, complying with law, and your consent where we ask for it.

4. AI-generated results

Mirror may send sanitized answers and computed scores to Google's Gemini API to generate a result or update your portrait. We do not include your email address, display name, or Mirror account ID in those requests. If AI generation is unavailable, Mirror may use a deterministic scoring system instead. These outputs are for reflection and are not clinical decisions or diagnoses.

5. Optional research program

If you give separate, optional consent, Mirror may provide de-identified or pseudonymized assessment answers, scores, results, and related research variables to universities, research institutions, or commercial research organizations for psychology or behavioral research. Mirror may receive payment for providing researchers with access to this data.

We will not provide researchers with your email address, display name, payment details, or direct account identifiers. We will take steps to reduce identification risk and require recipients not to try to identify you or use the data for advertising, employment, insurance, credit, or decisions about you. No de-identification method can eliminate every risk.

Research participation is not required to use Mirror. You may refuse or withdraw consent at any time without losing service by emailing us. Withdrawal stops new disclosures, but may not remove data already included in completed research or data that has been made truly anonymous and can no longer be linked to you.

6. When we share data

We may share only what is needed with:

• Supabase for database hosting and authentication;
• Stripe for payments and subscription management;
• Google for Gemini AI result generation;
• our hosting and infrastructure providers;
• researchers, only under the optional program described above; and
• authorities or advisers when reasonably necessary to comply with law, protect rights and safety, or complete a merger, financing, or sale of the business with appropriate safeguards.

Some providers may process data outside your country. Where required, we use recognized transfer safeguards. Contact us for more information about the safeguards relevant to you.

7. Storage and security

We use reasonable technical and organizational safeguards, including encrypted connections, access controls, validation of server requests, restricted service credentials, and hashing of anonymous session tokens. Results are private by default. If you turn on sharing for a result, the public page shows only its limited share-card fields, and you can turn sharing off again. No online service can guarantee absolute security.

8. Retention

We delete abandoned anonymous assessment sessions after 30 days. Account data, answers, and results are generally kept until you delete your account. We may retain limited records longer where required for billing, tax, fraud prevention, dispute resolution, security, or other legal obligations. Backups may take additional time to cycle out securely.

9. Cookies

Mirror currently uses cookies that are necessary for sign-in, security, and resuming an anonymous assessment. If we add non-essential cookies, we will request consent where required.

10. Your choices and rights

Depending on where you live, you may have the right to access, export, correct, or delete your data; object to or restrict some uses; withdraw consent; opt out of a sale or disclosure of personal data; and appeal a denied request. You may export or delete your account in Settings. For other requests, email support@lookatmirror.com. We may need to verify your identity. We will not discriminate against you for exercising a privacy right. You may also complain to your local data protection authority.

11. Children

Mirror is not intended for anyone under 16. We do not knowingly collect personal data from children under 16. If you believe a child has provided data, contact us so we can delete it.

12. Changes and contact

We may update this policy as Mirror changes. We will post the new version here and provide additional notice when a change is material. Questions or privacy requests can be sent to Mirror at support@lookatmirror.com.