1. In short
- Your activity stays on your phone. Mirror never sees what you do inside your apps. On iPhone, Apple only gives Mirror anonymous tokens for the apps you select, so Mirror can’t even read their names.
- No selling, no ads. We never sell or rent your data, and there is no advertising in Mirror.
- Only what’s useful. We collect what makes Mirror work, keeps your progress safe and helps us improve the app. Each item is explained below.
2. Who we are
This policy applies to the Mirror app on iPhone and Android, and to the playmirror.so website. The data controller is Jordan Gloaguen, sole proprietor, 61 rue Chevalier de Kermelec, 29000 Quimper, France. Contact: contact@playmirror.so.
3. The data we collect
A. Data you give us
| Data | Examples | Why | Legal basis |
|---|---|---|---|
| Profile | First name, birth year, profession, how you heard about Mirror | To personalize Mirror, adapt its content and offers to your age, and produce aggregate statistics about who uses Mirror | Contract; legitimate interest (statistics) |
| Progress and settings | Your streak and daily results, unlocked avatars and the names you give them, goals, completed lessons, Vacation Mode periods, notification preferences | To save your progress so you can find it again (after reinstalling, or on a new phone) | Contract |
| Account (optional) | The email address and name provided by Apple or Google when you sign in with them | To keep your account and restore your progress on another device | Contract |
| Invitations | Your invite code, and the link between the person who invites and the person invited | To validate invitations, grant rewards and prevent abuse | Contract; legitimate interest (fraud prevention) |
| Support and feedback | Your message, the email address you give us, the technical diagnostic attached by the app | To answer you and fix problems | Legitimate interest |
B. Data collected automatically
| Data | Examples | Why | Legal basis |
|---|---|---|---|
| Device | Phone model, system version, language, time zone, app version | Compatibility and bug fixing | Legitimate interest |
| App usage | Features used, screens visited, onboarding progress, sessions created | To understand how Mirror is used and improve it | Legitimate interest |
| Identifiers | Pseudonymous account ID (Firebase), installation ID, analytics ID | To link your data together without asking who you are | Contract; legitimate interest |
| Crash reports | Error traces | To diagnose and fix crashes | Legitimate interest |
| Purchases | Subscription status, plan, product, transaction identifiers, price and currency, trial eligibility | To manage your Premium access | Contract; legal obligation |
| Security checks | Device checks provided by Apple and Google when an invite code is used | To make sure invitations come from genuine devices | Legitimate interest |
What we never collect: the content of your apps, your messages, photos, contacts or location, or the content of your notifications.
4. Screen time and blocking
To measure and block, Mirror relies on the tools built into your phone’s system. The detail of your usage (which apps you open, and for how long) stays on your phone. To keep your streak and your progress, Mirror saves a single result per day: the time spent on your distracting apps, compared with your daily goal.
On iPhone, Mirror uses Apple’s Screen Time frameworks (FamilyControls, DeviceActivity, ManagedSettings). The apps you select are stored as anonymous tokens, and only iOS knows which apps they are.
On Android, Mirror asks for the permissions below. Each one is used on your phone, only to measure and to block:
- Usage access: to measure the time spent on your distracting apps.
- Accessibility service: to detect when an app you blocked is opened and, in your web browser, which site is open, so that Mirror can show its blocking screen. This information is used on your phone only and is never sent to us.
- Display over other apps: to show the blocking screen.
- Device administrator (if you turn it on): only to prevent Mirror from being uninstalled during a blocking session. Mirror uses no other administrator right.
- Notifications, alarms, battery optimization, start at boot: to keep your sessions running on time.
On both platforms, notifications (reminders, session alerts) are generated on your phone. If you save an image, for example to share your progress, Mirror only adds it to your photos and never reads your library.
5. Your account
The first time you open Mirror, Firebase Authentication creates a random identifier. It isn’t linked to your name, email address or phone number, but we treat everything linked to it as personal data.
You can choose to sign in with Apple or Google so you don’t lose your progress when you change phones. We then receive the email address and name that service gives us (Apple lets you hide your real email address). They are only used to keep your account and to help you when you contact us.
6. Invitations
When you share your invite code, or use someone else’s, we record the link between the two accounts. It lets us validate the invitation, show the invited person who invited them, grant rewards and prevent abuse, including with device checks provided by Apple and Google. So that an invitation opened before installing Mirror still counts, the app can pick up the invitation link the first time it opens.
7. How we use your data
- To provide Mirror: blocking sessions, goals, lessons, avatars.
- To keep your progress and restore it on your devices.
- To adapt content and offers to you, for example to your age.
- To run the invitation program.
- To manage your subscription.
- To answer your messages. Support requests are handled by the Mirror team.
- To improve Mirror, using pseudonymized and aggregated statistics.
- To keep Mirror secure and prevent fraud.
We don’t use your data for advertising. No decision that has legal or similarly significant effects on you is made solely by automated means.
8. Who receives your data
We never sell or rent your data. It is only shared with:
- our technical providers, who process it on our instructions: Google (Firebase: authentication, database, servers, analytics and crash reports), RevenueCat (subscription management), our hosting, content delivery and email providers, and the tools we use to follow up on support requests;
- Apple and Google, for purchases, sign-in and device checks, under their own privacy policies;
- the people who use your invite code, who see your first name.
Our main database is hosted in the European Union. Some providers, such as Google and RevenueCat, may process data in the United States. These transfers rely on the EU–U.S. Data Privacy Framework and/or the European Commission’s Standard Contractual Clauses.
9. How long we keep your data
- Account, profile and progress: as long as your account exists. Deleted when you delete your account.
- Support and feedback: as long as needed to handle your request. Deleted with your account.
- Usage statistics: in pseudonymized form, as long as they help us measure how Mirror evolves over time. The copies that concern you are deleted within 30 days of your account being deleted; what remains after that is aggregated and can no longer be traced back to you.
- Crash reports: 90 days.
- Purchase records: as long as accounting and tax rules require (up to 10 years).
- Waitlist email address: until Mirror is available on your platform, or until you unsubscribe.
10. Your rights
You have the right to:
- access, correct and delete your data;
- receive it in a portable format;
- restrict its processing;
- object to processing based on our legitimate interests;
- withdraw your consent at any time, when processing relies on it;
- under French law, give instructions about what happens to your data after your death.
To exercise these rights, write to contact@playmirror.so. We reply within one month. You can also lodge a complaint with the CNIL (www.cnil.fr) or with the data protection authority of your country.
11. Deleting your data
- In the app: Settings > Account > Delete my account. Your account and the data linked to it are deleted immediately, on our servers and at our providers. The residual copies left in our technical logs and backups go within 30 days.
- If you no longer have the app: write to contact@playmirror.so with the subject “Delete my Mirror account”, giving the email address you used with Mirror (to sign in or to contact support).
- Uninstalling the app only erases the data stored on your phone, not your account.
The only exception is purchase records, which accounting and tax law require us to keep. Deleting your data does not cancel your subscription: cancel it in your App Store or Google Play subscriptions.
👉 The full details — what goes, what stays, how long it takes — are on the Delete your account and data page.
12. Security
Your data is encrypted in transit and at rest, and access to it is limited to what is needed to run Mirror.
13. Minimum age
Mirror is intended for people aged 13 and over (see our Terms of Service).
14. The playmirror.so website
The website uses no advertising or tracking cookies; it only remembers your language choice on your device. Visits to invitation pages are measured without cookies (type of device, country) to count invitations. If you join a waitlist, your email address is only used to tell you when Mirror is available, and you can unsubscribe at any time.
15. Changes to this policy
We may update this policy as Mirror evolves. The date at the top shows the current version. We will let you know about significant changes.
16. Contact
contact@playmirror.so, or the contact form in the app’s settings.