Privacy
policy

What Mirror stores on your device

Everything below is written to a database on your phone and nowhere else:

• Journal entries and their timestamps
• Moods, topics, tags and other information Mirror infers from your entries
• Goals you create and the progress Mirror infers for them
• Voice capsules — the audio recording, any accompanying words, and the date it unseals
• Your display name, chosen on first launch
• The questions you ask Mirror in Reflect, and the answers it composes
• App settings and preferences

How it is protected

The database is encrypted with SQLCipher (AES-256). The encryption key is derived from the password you choose at setup using Argon2id, a deliberately slow password-hashing function.

What is saved is a random value used in the key derivation (a "salt"), which is not secret and is useless on its own.

This has a consequence you should understand: if you forget your password, your journal cannot be recovered — by you, by us, or by anyone. There is no reset link, because there is no account and no copy of your key.

It also means your backup is genuinely portable. The salt is included in the backup file, so restoring on a new phone needs nothing from your old one — you install Mirror, open the backup, and type the same password. The only thing you have to bring with you is the password itself.

Voice capsule audio is stored inside that same encrypted database, not as a loose file.

The AI runs on your device

Mirror uses on-device language models (Gemma, and a separate small model for search) that run locally on your phone's hardware.

Mood detection, goal scoring, tagging and Reflect answers are all computed on your phone, offline.

Downloading the models

The first time you use Mirror, it downloads the AI model files (roughly 2.5 GB) from Hugging Face, a public model-hosting service. This is an ordinary file download of a public file. No account is needed and we send no information about you — though, as with visiting any website, Hugging Face and its content delivery network will see your IP address and the fact that a file was requested.

See the Hugging Face Privacy Policy.

What leaves your device

Only the following. Each is listed with what it contains and when it happens.

a) Backups to your own Google Drive — optional, and off until you turn it on

If you choose to set up backup, Mirror creates a backup file and uploads it to a "Mirror Backups" folder in your own Google Drive account.

This backup contains your journal — including entry text and capsule audio. It is stored in the same encrypted form as on your phone, so its contents cannot be read without your password. Alongside it, the backup carries a small unencrypted description file listing the app and database version, the number of entries and goals, when the backup was made, and the key-derivation salt. That file must stay unencrypted for the restore to work. It never contains your password or anything you wrote.

Important points:

• The backup goes to your Drive. We have no access to it and never receive a copy. It is not sent to any server of ours.
• Mirror requests only the drive.file permission, which allows it to see and manage only the files it created itself. Mirror cannot see, read or touch any other file in your Drive.
• To sign in to Drive, Mirror uses Google Sign-In. Google will tell the app your account identity for the purpose of the upload.
• Automatic backup, if enabled, runs when you open the app.
• You can delete a backup at any time from your Google Drive.

You can use Mirror fully without ever enabling this.

b) Restoring from a file — stays on your device

Mirror can also restore from a backup file you pick with your phone's file browser. This path involves no network access at all.

c) Usage analytics — Amplitude

Mirror sends anonymous usage events to Amplitude to understand which parts of the app people actually use. What is sent:

• Which screen was opened, and which button was tapped
• App lifecycle events, such as the app being opened or the session locking
• A randomly generated device identifier, not linked to any personal identity
• Your device model, manufacturer, device name, operating system version, app version and build

Where the app records that you saved an entry, it records only a rough size band (for example "short" or "long") — never the writing itself. See the Amplitude Privacy Policy.

d) Crash reports — Firebase Crashlytics

When Mirror crashes or hits a handled error, a report is sent to Firebase Crashlytics so the problem can be fixed. Reports contain the technical error, a stack trace, device and OS information, and a trail of recent screen and button events of the kind described above. The same anonymous device identifier is attached so a crash can be matched to the sequence of actions that led to it.

Crash reports do not contain your journal content.

e) App configuration — Firebase Remote Config and Cloud Messaging

Mirror fetches configuration values (such as internal limits) from Firebase Remote Config, and registers with Firebase Cloud Messaging so configuration can be refreshed. This registration means Google issues your device a messaging token. Mirror does not send push notifications advertising anything, and these messages carry no personal data.

Firebase is provided by Google. See the Google Privacy Policy and Firebase data disclosures.

Permissions Mirror asks for, and why

• Microphone — only to record a voice capsule, and only while you are recording one. Audio is written straight into the encrypted database. No audio is ever uploaded to us, and there is no speech-to-text service involved.
• Notifications — to tell you when a voice capsule you sealed has reached its date. Requested the first time you seal a capsule, not at launch. The notification never contains the capsule's title or contents, because it may appear on a locked screen. Tapping it opens the app, which still requires your password.
• Alarms and reminders / run at startup — so a capsule's unseal reminder survives a restart and arrives on time.
• Internet — for the items in section 3 only.
• Biometric / device credential — only if you switch on quick unlock (see below).
• Foreground service — so long-running work, such as the initial model download and processing your entries, is not killed while in progress.

Quick unlock

You can optionally turn on quick unlock, which lets you reopen Mirror with your phone's fingerprint, face or PIN instead of retyping your password.

If you enable it, your password is stored on your device in the operating system's protected credential store (Android Keystore). It is not transmitted anywhere. It is deleted when you turn quick unlock off, and when you delete your data. This feature is off by default, and the password remains the only thing that can decrypt your journal.

Retention and deletion

Your journal stays on your device until you delete it.

• Delete individual items — entries, goals and capsules can be deleted in the app at any time.
• Delete everything — the Me screen has an option that erases the app's database, your stored settings and any saved quick-unlock credential.
• Uninstalling Mirror removes its on-device data.
• Backups are yours to delete. Uninstalling the app does not remove a backup from your Google Drive; delete it from Drive directly.

Analytics and crash records are held by Amplitude and Google under their own retention schedules. Because those records are tied only to a random device identifier and contain nothing you wrote, we generally cannot single out an individual person's records — but if you contact us with your device identifier we will do what we can to have them removed.

Children

Mirror is not directed to children under 13, and we do not knowingly collect information from them.

Selling and sharing

We do not sell your data. We do not share it with advertisers. Mirror contains no advertising and no advertising SDKs. The only third parties that receive anything are the service providers named in section 3, acting on our behalf.

Your rights

Depending on where you live, you may have rights to access, correct, export or delete your personal data.

In Mirror's case most of these you can exercise directly and immediately: your journal is on your own device, you can read and edit all of it, you can export it as a backup file, and you can delete it. For anything relating to the analytics and crash data described in section 3, contact us using the details below.

Security

We encrypt your journal at rest, derive the key from a password only you know, and use encrypted connections (HTTPS) for everything in section 3.

In particular, the protection of your journal depends on the strength of your password and on your device itself — if someone else has your unlocked phone and your password, they have your journal.

Changes to this policy

If this policy changes materially we will update the date at the top and, for significant changes, note it in the app. Continued use after an update means you accept the revised policy.

Contact

This policy covers the Mirror mobile application, published by Prashan. Questions about this policy or your data:

hello@askmirror.app

askmirror.app