AI Use Disclosure

1The Provider Chain

Two vendors, and one hop to each.

• Your phone talks only to our own server. It never talks to an AI vendor directly, so your IP address is never exposed to one.
• Our server runs on Cloudflare Workers and is operated by us. One table on it decides which model answers which feature.
• Google's Gemini, reached through the Gemini API. Currently gemini-2.5-flash for the skin read, photos of your skin in chat, a product's published ingredient list and the search behind People say; gemini-3.8-flash for reading product photos; and gemini-3.1-flash-lite-image for Beautify.
• Anthropic's Claude, reached through the Claude API. Currently claude-haiku-5-5 for Mira's chat messages, her take on a product, the short takes under People say, and naming products when our catalogue has none. When Claude cannot be reached, fails on its side, or has no key on our server, the same request goes to a Gemini model instead. Nothing ever falls back the other way, and no photograph is ever sent to Anthropic.

We may change model or provider at any time, on notice through an update to this page.

2Feature 1: The Skin Read

Transmits: one face-cropped JPEG for each pose of the scan you just took, up to three: the front at 1536 pixels across, and your left and right at 768. If you choose "I can't turn my head", only the front is sent, and a side you skip is not sent. A scan saved by an earlier test version, which took five poses, sends one frame for each of its poses if it is read again. With them go the measurements your phone made from those frames (redness, tone, evenness, texture, shine and under-eye darkness for each zone, whether the phone is sure of each zone, and which zones it could not measure). No name, no identifier, no account, no device id, nothing that could tie the request to you or to another request.

Read by: Gemini.

Runs: when you finish a scan, once, and again only if that read did not land and you tap Try the read again or open that scan's report. Never on a schedule.

Kept: nothing. The images are read once and discarded. They are not written to a database, a cache or object storage at any point.

Constrained: the model is instructed, in capitals, to produce no numbers, scores, percentages, grades, diagnoses, conditions, causes, treatments, brands or products. It is not trusted to obey. Its answer is then checked in code: a comfort word better than your phone's own measurements allow is pulled back down, any note containing a digit is dropped, a zone your phone could not measure is forced to a neutral reading with a fixed sentence, and a read that could see almost nothing is refused. The model's answer is a suggestion to the app, not the app's output.

3Feature 2: Reading a Product from a Photograph

Transmits: the part of your photo inside the window you set in the scanner, and the words your phone read off it.

Read by: Gemini, and only when those words do not already find the product in our catalogue. If the product is then named but no ingredient list is found, Gemini is asked, by brand and name only and with no photo, for that product's published ingredient list.

Runs: each time you take a photo in the scanner or move its window onto something new. The same label twice is not sent again.

Kept: a one-way hash of the image and the reading, for 180 days, so the same photo is not read twice. The image itself is not stored. An ingredient list from the model's knowledge is kept against the product for 90 days.

Labelled: a product read from a photograph is marked in the app as identified by AI, with a line telling you to check the label, and an ingredient list from the model's knowledge is marked as coming from AI. Every field can be edited, because the bottle in your hand is the authority.

Checking an ingredient list sends the ingredient names to our server, which may look them up in an outside ingredient database. No model is involved.

4Feature 3: Beautify

Transmits: a copy of your product photo cropped to the product, at most 640 pixels on its long side; a hint of up to 120 characters with the product's brand, name and kind, which helps the model read the label; and a random id made on your phone for Beautify alone.

Read by: Gemini's image model, which returns an edited picture. The id is not passed to Google.

Runs: only when you tap Beautify photo on a scan result or a product page. A photo you have already tidied is answered from your phone, with nothing sent. Each phone gets three new tidies a day.

Kept: on our side, the photo and the hint are not stored; one row counts that day's tries under a one-way code made from the day and the id, and is deleted the next time anyone uses Beautify on a later day. On your phone, every version of the photo is kept, your original included, so Undo returns exactly to what you had.

Constrained: the model is asked to remove hands and anything touching the product, keep the product exactly as photographed, including its label text and logo, set it upright on plain white, and add nothing. An image model can still change a label, which is why the app tells you, after every tidy, that AI did the touch up and to check the label matches your bottle.

5Feature 4: Chat with Mira

Transmits: your message (up to 600 characters), up to the last eight messages of the conversation as text, and a context: your goal, your routine level, the names of the products in your routine, your morning steps, which step is sunscreen, your streak, today's UV index and your city.

Your check-ins: with Mira remembers your check-ins on, which is the default, the message also carries a summary of today, yesterday and the day before, built on your phone from fixed lists: your mood, the kinds of off you tapped, what felt good, products in your routine you said reacted, anything new you noticed, a feeling word, and up to three topic words, such as work or sleep, that your phone matched in your note. Never the words of your notes, your skin note, dates or anything from Apple Health. Our server drops any value that is not on its own copy of those lists. She is told to let it make her kinder, not nosier, and never to quote it back to you. Turn the switch off in Settings, under Photos and privacy, and no summary goes with any message.

Read by: Claude, or Gemini when Claude cannot answer.

Runs: each time you send a message, and only then. A note from "What's on your mind" reaches the chat only if you tap Talk it through with Mira and then press send yourself.

Kept: nothing on our side. The conversation lives in the app's memory and is gone when the app closes.

6Feature 5: Photos in Chat

Transmits: one photo you choose for one message, at most 1600 pixels on its long side, marked as your skin or as a product.

A photo of your skin is sent only when you pick My skin and send it. The app marks each one as yours to share, and our server refuses a skin photo without that mark. It goes to Gemini with that one message and is never sent again: later messages carry only a note that there was a photo. The reply is checked in code sentence by sentence, and any sentence with a number or a condition word in it is removed; if nothing is left, Mira says she would rather not guess from a photo.

A photo of a product is read the same way as in the scanner (Feature 2), and Mira, on Claude, is told in words what the product is. The model that writes her reply never sees the picture.

Kept: for a skin photo, nothing. For a product photo, the same hash and reading as Feature 2. Neither photo is stored on our side, and the thumbnail in the conversation lives in the app's memory.

7Feature 6: Mira's Take on a Product

Transmits: the product with its ingredient list, the products in your routine with theirs, and these answers from your profile: skin type, how easily your skin reacts, your goal, what you react to, your formulation and product preferences, whether you told Mirror you have rosacea, eczema or atopic dermatitis, and whether retinoids should be left out.

Read by: our code first, which works out clashes with your routine, anything you react to or avoid, where the product would go, and which verdicts are allowed. Then Claude, or Gemini when Claude cannot answer, which sees only your skin type, how easily it reacts, your goal and the ingredients you avoid, in words, with the facts our code found. The name of a condition and the reason retinoids are left out never reach the model.

Runs: when you ask what Mira thinks of a product, and when you add a product to your shelf or move one into your routine.

Kept: nothing.

Constrained: the model writes a sentence or two and picks a verdict, and code holds the verdict inside the allowed ones whatever it answers. The words are then scrubbed: no dashes, no numbers, no medical words, three sentences at most.

8Feature 7: Picks When the Catalogue Has None

Transmits: a routine step, your budget level, your country, and the ingredient families to avoid, which your phone works out from what you react to, what you asked labels to leave out and whether retinoids are off. Your profile itself does not travel.

Read by: our catalogue first. Only when nothing in it fits is Claude, or Gemini, asked to name up to three products for that step, country, budget level and families to avoid.

Kept: nothing. A model's suggestion is never cached.

Labelled: each one says "Mira's suggestion, not checked yet", makes no claim about where it is sold or whether it suits you, and has no buy button. Suggestions the model is unsure of are dropped.

9Feature 8: People Say

Transmits: the product's brand, name, catalogue id and kind. Nothing about you.

Read by: Gemini, with Google Search, for what reviewers say; then Claude, or Gemini, which rewrites that answer into three or four short takes without searching or adding facts.

Runs: when you open a product page or a scan finds a product.

Kept: nothing.

Labelled: the panel is marked as an AI summary, the pages it came from are listed under it, and Google's search suggestions are shown as Google provides them. A star rating appears only when one of those pages shows one.

10The Written Pieces

Mirror's Insights library is written by AI and it says so on every piece, in a badge above the first paragraph rather than a note at the bottom.

Mira reads published research, guidance from dermatology bodies and interviews with named dermatologists, and writes each piece from those sources. Every figure and finding is tied to the source it came from, and the sources are listed at the foot of the piece with links. A person checks each piece against those sources before it ships. Nothing is generated while you read, and nothing in the library knows anything about you.

This is a different kind of AI use from the features above: it happens on our side, before publication, and none of your data is involved in it.

11What is Generated, and How It is Held

Written by a model: Mira's chat replies when our server answers, her take on a product, the People say summary and its short takes, product names when our catalogue has none, the sentences in a skin read, the reading of a product photo, an ingredient list from AI knowledge, and the picture Beautify returns.

Written by hand and chosen by the app: her notes on Today, her replies to your check-ins, her reminders and lock-screen lines, her affirmations, her page tours, and the chat replies she gives when our server cannot answer.

How the chat is held. A model is told rules, and a model can break them, so the ones that matter most are also enforced in code on every reply. Our server's chat code replaces dashes, turns a shop's name into "the shop", takes out a bare price, sets the spelling to the app's, keeps at most three emoji, cuts an overlong reply, and always returns exactly three suggested follow-ups, filling any gap from a fixed set. A reply to a photo of your skin loses any sentence with a number or a condition word in it. If your message reads as a hard moment, the reply loses its emoji, always carries 988, the crisis line for the US and Canada, and its follow-ups are fixed and gentle.

Other rules are instructions only, and we say so: Mira is told that the products in your routine are the only brand names she may use, not to diagnose, not to advise on prescriptions, pregnancy or procedures, and never to quote your check-ins back to you. Those are requests to the model, not checks, and she can get them wrong.

12What is Never Transmitted

The mirror image of the lists above, and the more useful half of them.

• Your original scan photographs never leave the device. Only the cropped copies do, and only for that scan's read.
• Your age band, your gender and your life stages never leave the device. The rest of your profile travels only in the reduced forms named above: your goal and routine level with chat; your skin type, sensitivity, goal, reactions and preferences with Mira's take, along with whether you have rosacea, eczema or atopic dermatitis, which our code reads and no model sees; and ingredient families to avoid with picks.
• The words of your notes and your diary, your dates and anything from Apple Health are never transmitted. Mira's chat gets the summary in fixed words described above, and a note travels only if you send it yourself.
• Your skin readings and measurements travel only with that scan's read, never with chat or anything else.
• Nothing links one AI request to another, with two exceptions. There is no session, no cookie and no account on any AI request, so two scans by the same person are indistinguishable from two scans by two people. A chat message carries its own conversation, which links it to the earlier messages in it and to nothing else. Beautify carries a random id so our server can count three tries a day for each phone; it is kept only as a one-way code that changes every day, and it is never passed to Google.
• Nothing face-derived ever reaches an affiliate network, an advertiser, or the usage events. There is no advertising in Mirror.

13What AI Output is Worth

AI can be wrong. Large language models are probabilistic. They can hallucinate, misread, omit, and state things confidently that are not true. Mirror constrains and re-checks the skin read and Mira's chat for exactly this reason, and the constraint reduces the risk rather than removing it.

A photograph is not a diagnosis. A comfort word about a zone of your face is a cosmetic observation from a set of photographs taken in whatever light you were standing in. It is not an examination, and Mirror is not looking for disease.

Mira can be wrong in chat, about a product, an ingredient or your routine. Check anything that matters before you act on it.

A product guess from a photograph can be wrong, and so can an ingredient list from AI knowledge. Check the name, the size and the label on the bottle before you trust them, which is why the app says so on the screen.

A tidied photo can be wrong. Beautify may change a word on a label. Your own photo is always kept, one tap away.

Availability is not guaranteed. The AI features depend on third parties and on our budget for them. When they are unavailable the app says so, and Mira's chat falls back to her written replies, rather than inventing an answer.

14Do Not Rely on It

Do not use Mirror's output as the basis for a medical decision, for deciding whether a mole or a lesion needs looking at, for deciding whether to start, stop or change a prescription treatment, for anything during pregnancy or breastfeeding without asking a clinician, or for any decision where being wrong would matter.

Verify anything that matters. If something on your skin is new, changing or worrying, see a doctor, and do not let anything Mirror said talk you out of it.

15Consent, and How to Decline

Using Mirror means agreeing to the processing described here, as the Terms say. On top of that, each feature asks in its own way.

• The face scan. Before your first scan, the app shows what happens to your face photos and asks you to agree. It records which version of that description you agreed to, and if what happens to the photos changes, it asks again before your next scan. A scan only ever runs when you start it.
• Product photos and Beautify. Sent only when you take a photo in the scanner or tap Beautify photo.
• Chat. A message goes only when you send it, and a photo only when you pick one and send it.
• Your check-ins in chat. Turn off Mira remembers your check-ins in Settings, under Photos and privacy, and no summary goes with any message.
• Mira's take, picks and People say. There is no separate switch for these. Mira's take is asked for when you ask what she thinks of a product and when you add one to your shelf or move one into your routine; picks when Mirror fills a step of your routine; People say when you open or scan a product.

There is no separate switch for the skin read, because a skin app that does not read skin is not the product. If you do not want a particular photograph transmitted, do not take it in Mirror.

16Changes

If we change provider, model, what is transmitted, or what is retained, we update this page and the version number at the top. Where the change affects your face photographs, the app asks for your consent again before your next scan.