Your words belong to you.

1. Who we are

MIRROR:RY is operated by Truth Allegiance Ltd ("we", "us", "our"), a company registered in the United Kingdom. Truth Allegiance Ltd is the data controller responsible for personal data processed through this site and app.

2. Personal data we collect

• Account data — email address, authentication identifiers (e.g. Google account ID when you sign in with Google), account creation and login timestamps.
• Profile data — any display name or preferences you save.
• Session data — session counts, timestamps, and optional distilled reflections you choose to save. Your raw reflections are stored locally on your device by default; only what you explicitly save is written to our database.
• Voice interaction data — when you use voice features, audio and transcribed text are sent to our voice processing subprocessor to synthesise a response.
• Technical data — IP address, browser type, device type, and diagnostic logs necessary to run the service securely.
• Billing data — collected and processed by Paddle.com Market Limited as the Merchant of Record (see Section 5). We receive limited billing metadata (subscription status, plan, country) but not full card details.

3. Why we process it and legal basis

• To provide the service (account creation, authentication, running sessions) — performance of a contract with you.
• To secure the service (fraud prevention, abuse detection, diagnostic logs) — legitimate interests.
• To process payments and comply with tax law (via Paddle) — performance of a contract and legal obligation.
• To improve the product (aggregated, non-identifying usage patterns) — legitimate interests.
• To send service communications (magic links, receipts, material changes) — performance of a contract.

We do not use your reflections for advertising, profiling, recommendation systems, or model training.

4. Who we share data with

We share personal data only with the following categories of recipients, each under written data-protection terms:

• Paddle.com Market Limited — our Merchant of Record. Paddle handles all payment processing, subscription billing, tax collection and remittance, invoicing, refunds, and related customer service. See Paddle's privacy notice at paddle.com/legal/privacy.
• Hosting and database infrastructure — the underlying platform that stores account and session records.
• Voice processing (ElevenLabs) — for voice synthesis and conversational voice features.
• Authentication providers — Google, when you choose to sign in with Google.
• Professional advisers — legal, accounting, and compliance advisers where necessary.
• Authorities — where we are required to disclose by law.

5. International transfers

Some of our subprocessors are located outside the UK/EEA. Where personal data is transferred internationally, we rely on appropriate safeguards such as Standard Contractual Clauses or adequacy decisions recognised under UK GDPR and EU GDPR.

6. Data retention

We retain account and session data for as long as your account is active. If you delete your account, we delete or anonymise associated personal data within 30 days, except where we are required to retain records for legal, tax, or accounting purposes (typically up to 7 years for billing records held by Paddle). Diagnostic logs are retained for up to 90 days.

7. Security

We apply appropriate technical and organisational measures to protect personal data, including encryption in transit (TLS), encryption at rest for our database, access controls, and row-level security so that users can only access their own records.

8. Your rights

Under UK GDPR and EU GDPR you have the right to access, rectify, erase, restrict, port, and object to processing of your personal data, and to withdraw consent where processing is based on consent. You can exercise these rights via the My Data page or by contacting us (Section 10). We aim to respond within one month. You also have the right to lodge a complaint with your local supervisory authority (in the UK, the ICO — ico.org.uk).

9. Cookies

We use only essential cookies and local storage required to keep you signed in, remember your preferences, and run the session locally. We do not use advertising or third-party tracking cookies.

10. Contact

Truth Allegiance Ltd — questions about privacy or requests to exercise your rights can be sent through the Contact & Support page with the category set to Privacy.