Mirrocle

Privacy Policy

Last updated: April 27, 2026 · Effective: April 27, 2026

This Privacy Policy explains how Mirrocle ("we", "us", or "the app") collects, uses, and protects your information when you use our iOS application.

Plain-English summary

• We only collect what we need to personalize your compliment program.
• We do not record video, audio, or images from your camera. The mirror is live-only.
• We do not sell your data, ever.
• You can delete your account and all your data from inside the app at any time.

1. Who we are

Mirrocle is operated by [YOUR LEGAL NAME OR COMPANY].

If you have any questions about this policy, contact us at [YOUR_SUPPORT_EMAIL].

2. Information we collect

2.1 Account information

When you create an account, we collect:

• Email address (if you sign up with email/password)
• Apple ID identifier (if you sign up with Sign in with Apple — this is a stable but app-specific identifier; we never receive your real Apple ID email unless you choose to share it)

2.2 Onboarding answers

To personalize your compliment program, we ask you a series of questions during onboarding. We store your answers, which include:

• Age range
• Self-described insecurities
• Triggers (when you tend to feel worst about yourself)
• Inner-critic style
• Things you've tried before (therapy, journaling, etc.)
• Personal goals
• Voice and timing preferences
• Self-assessment ratings

This information is used only to tailor your in-app experience.

2.3 Usage data

We store records of your sessions:

• Number of compliments played
• Session duration
• Session completion status
• Compliment preferences (which compliments you enable, disable, or reorder)

2.4 Camera (live access only)

The app uses your front-facing camera to display a live mirror image while compliments play. Camera data is never recorded, stored, transmitted, or analyzed. Frames stay on your device and are discarded immediately. We do not use facial recognition, AI/ML inference, or any analysis of camera input.

2.5 Subscription information

If you purchase a subscription, Apple processes the transaction. We receive only a confirmation that the purchase was made and your subscription status. We do not see your payment method.

2.6 Information we do not collect

• We do not collect your real name (unless you provide one)
• We do not collect your contacts, location, calendar, photos, or microphone input
• We do not use third-party advertising trackers, IDFA, or analytics tied to your identity
• We do not scan your photo library or social accounts

3. How we use your information

Purpose	Data used
Authenticate you	Email or Apple ID identifier
Personalize compliments	Onboarding answers, insecurity selections
Generate your daily program	Onboarding answers + usage data
Sync your preferences across reinstalls	Account data
Improve the product	Aggregated, anonymized usage data
Provide customer support	Account data + your support messages

We do not profile you for advertising, sell your data, or share it for marketing.

4. Third-party services we use

4.1 Supabase, Inc.

• What: Authentication, database, file storage
• Data shared: Account information, onboarding answers, usage data
• Why: Stores your account so it survives reinstalls; powers personalization
• Privacy policy: https://supabase.com/privacy

4.2 Apple Inc.

• What: Sign in with Apple, in-app subscriptions, App Store delivery
• Data shared: As required to authenticate and process subscription purchases
• Why: Required for App Store distribution and payment processing
• Privacy policy: https://www.apple.com/legal/privacy/

4.3 ElevenLabs, Inc.

• What: Text-to-speech generation
• Data shared: None at runtime. Compliment audio is generated by us in advance and pre-recorded into static audio files. Your usage of the app does not transmit any data to ElevenLabs.
• Privacy policy: https://elevenlabs.io/privacy

We do not use Google Analytics, Facebook SDK, Mixpanel, Amplitude, AppsFlyer, or any other tracking SDK.

5. How we store and protect your information

• Data is stored encrypted at rest in Supabase's infrastructure (AWS).
• All data in transit is encrypted via HTTPS/TLS 1.2 or higher.
• Access to production data is restricted to authorized personnel.
• Authentication is handled by Supabase Auth, which uses industry-standard JWT tokens.
• We use row-level security (RLS) so users can only access their own data, never anyone else's.

6. Data retention

We keep your data for as long as your account is active.

If you delete your account using the Delete Account button in the app's Profile screen, we permanently delete:

• Your authentication record
• Your profile, including all onboarding answers
• Your insecurity selections and compliment preferences
• All your session history

Deletion is immediate and irreversible.

7. Your rights

Depending on where you live (EU/UK under GDPR, California under CCPA, or other jurisdictions), you may have the right to:

• Access the data we hold about you
• Correct inaccurate data
• Delete your data ("right to be forgotten") — built into the app under Profile → Delete Account
• Export your data in a portable format
• Object to processing
• Withdraw consent at any time

To exercise any of these rights beyond in-app deletion, email us at [YOUR_SUPPORT_EMAIL]. We will respond within 30 days.

8. Children

Mirrocle is not intended for children under the age of 13 (or under 16 in the EU). We do not knowingly collect data from children. If you believe a child has provided us with information, contact us and we will delete it.

9. International users

We are based in [YOUR COUNTRY]. If you use the app from outside this country, your data will be transferred to and processed where we and our service providers operate. By using the app, you consent to that transfer.

For EU/UK users, transfers outside the European Economic Area are protected by Standard Contractual Clauses where applicable.

10. Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top will reflect the most recent change. Material changes will be communicated in-app or by email.

11. Contact

Questions, requests, or complaints?

• Email: [YOUR_SUPPORT_EMAIL]
• Mailing address: [YOUR_LEGAL_ADDRESS]

If you are in the EU, you may also lodge a complaint with your local data protection authority.