Privacy Policy

Last updated September 2, 2026

This Privacy Policy explains how Theard Ventures LLC (“Theard Ventures,” “we,” “us,” or “our”), the company that operates Mirror, collects, uses, stores, and shares information when you use the Mirror website, web application, and mobile applications (the “Service”).

Information we collect

Depending on how you use Mirror, we may collect:

  • a randomly generated account or installation identifier and the credentials needed to keep that installation connected;
  • your email address when you choose to verify an account for purchases, account recovery, export, or deletion;
  • Reflection messages and related session timestamps and status;
  • subscription and purchase information, such as product, plan, status, transaction identifiers, and billing-provider customer identifiers;
  • limited content-free operational information, such as request identifiers, error categories, model usage, and performance data.

How we use information

We use information to:

  • provide and preserve your Reflection sessions;
  • generate and supervise conversational responses;
  • verify access, purchases, and subscriptions;
  • deliver requested account-verification messages;
  • protect the Service and diagnose reliability problems;
  • respond to export, deletion, support, and legal requests.

Reflection privacy

Reflection content is encrypted before it is stored in Mirror’s database. Mirror does not put Reflection text in billing systems, analytics events, or application logs. A bounded portion of the current Reflection is sent to our model provider to generate and supervise a response. Mirror does not create or save a generated summary of your inner state.

Service providers

We use service providers to operate Mirror. They may process information only as needed to provide their services:

  • Anthropic for conversational generation and supervision;
  • Render for application hosting and managed database services;
  • Stripe for web checkout and billing management;
  • Apple, Google, and RevenueCat for native purchases and entitlement verification;
  • Resend for requested email-verification messages;
  • PostHog for content-free product analytics and operational telemetry.
  • Meta for ad delivery and content-free conversion measurement. When configured, Meta may receive page and event names, a random event identifier, browser and network information, Meta click/browser identifiers, session counts and timing, a one-way hash of a verified email on account setup, and purchase tier and value. Mirror does not send Reflection text, questions, summaries, topics, sentiment, or raw email to Meta.

Retention

Mirror is configured to delete encrypted Reflection content and cached responses 30 days after the last session activity. Limited lifecycle metadata may remain so retention cannot create another free session. Billing and operational records may be kept as needed for access, reconciliation, fraud prevention, accounting, and legal obligations. Deleting your account removes the account data held by Mirror, subject to provider availability and records we must retain by law.

Your choices

The Service provides controls to export your account information and delete your account. You may also manage or cancel a subscription through the billing provider that processed it. Deleting a browser’s local storage or removing the app may remove that installation’s credentials but does not by itself delete server-side account data.

Mirror honors supported browser opt-out signals, including Global Privacy Control, by not loading Meta advertising measurement. You can also use your browser controls to block or delete advertising cookies.

Security

We use technical and organizational safeguards designed to protect information, including encrypted transport, encrypted Reflection storage, scoped credentials, and access controls. No system is completely secure, and we cannot guarantee absolute security.

Children

Mirror is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided personal information, contact us so we can review and delete it.

Changes

We may update this policy as the Service changes. We will post the updated policy here and change the “Last updated” date.

Contact

Theard Ventures LLC operates Mirror. For privacy questions or requests, visit Mirror Support or email support@mirrorxyz.com.