Mirror · Legal
Privacy Policy
Version 1.4 · effective October 24, 2026
Contents
- Who this Policy Applies To
- There is No Account
- What Stays on Your Device
- What Leaves Your Device
- Mira's Chat and Your Check-ins
- Apple Health, Dictation and Your Notes
- The AI, and What It Sees
- What Mirror Measures, and What It Does Not
- Notifications and Location
- Subscriptions
- Children
- Where Things Are
- Keeping and Deleting
- Export
- Security
- Your Rights
- The Website
- No Warranty as to Privacy Outcomes
- Changes to this Policy
- Contact
1Who this Policy Applies To
This Policy covers the Mirror iPhone app and the website at native-dev.com/mirror. It does not cover Apple, Google, Anthropic, or any other company whose services Mirror touches. Where their handling matters, it is named below and you are pointed at them.
Mirror is operated by Artem Lapshin as Native Apps Team. In this document, "we", "us" and "our" mean the operator, and "you" means the person using the app.
2There is No Account
Mirror has no sign-up screen, no login, no password and no user record. We do not know your name, your email address, your Apple ID or your phone number, and no table on our side holds a name, an email address or an account. The nearest things to one are a random id on the usage events and a registration for Mira's lock-screen card, both described below.
Your identity in Mirror is your iCloud account, which is Apple's, not ours. That is why there is nothing to sign in to and no account for us to leak.
3What Stays on Your Device
The following is stored on your iPhone and, because the app uses SwiftData with CloudKit mirroring, synchronised to your own private iCloud database. A private CloudKit database is readable by your Apple ID and by nothing else. We have no access to it, no key to it, and no way to enumerate it.
- The photographs from your face scans. One frame for each pose you completed, front, left and right, at the camera's full resolution. Scans saved by earlier versions keep the frames they were saved with.
- Your skin readings. The comfort word and short note for each zone, and the on-device measurements the scan produced.
- Your profile. The answers you gave in onboarding: age band, gender if you gave one, skin type, sensitivity, goals, formulation and ethics preferences, known reactions, any chronic skin conditions and life stages you chose to tell it about, sunscreen habit, breakout frequency, actives you use, your routine budget, how often Mira reaches out and your quiet hours, and your city or region with a coarse latitude and longitude.
- Your shelf. The products you have added, their sizes, opened dates, ingredient text, any notes you wrote, and why you took one out of your routine.
- Your diary. Each day's mood, your answers to the check-in follow-up (what felt good, what was off, anything that reacted, anything new, how you felt), your note about your skin, and any photo attached to an entry in an earlier version.
- Your routine and its history. Steps, and which ones you completed on which day.
The following is kept on this iPhone only, outside the iCloud sync:
- Your notes from "What's on your mind". One file, protected so it cannot be read while the phone is locked, excluded from iCloud and computer backups, never synchronised and never sent. A new phone starts without them. Settings has Forget my notes.
- Your own photos of your products, with every version of each: as you took it, with the background lifted, and tidied by Beautify, so Undo always has something to go back to. They are files in the app's own storage, which a device backup includes; they are not part of the iCloud sync.
- Photos Beautify has already tidied, up to forty, in a cache named by a fingerprint of the photo that was sent, so the same photo twice costs nothing. iOS may clear this cache on its own.
- Small stores in iOS UserDefaults: your ratings of products you tried, the suggestions you hid and for how long, the kinds of product the scanner saved, which products started and stopped on which day, your app preferences (quiet hours, sound and haptics, your check-in reminder, which articles you have read or saved, the Mira remembers your check-ins and Help improve Mirror switches), and up to two random ids, each made on this phone for one job: the usage events and Beautify's daily limit. A phone set up by an earlier test build may also hold a third, for Mira's lock-screen card, until it unregisters.
- Your conversation with Mira, in the app's memory only. It is gone when the app closes.
- Anything read from Apple Health, in memory only, as described below.
Some of the profile is health-adjacent by nature. It sits in the same private store as everything else. A few parts of it travel, reduced to what one answer needs, with Mira's take on a product, her picks and her chat; the next section names exactly which.
4What Leaves Your Device
Mirror's own calls go to one server, which we operate on Cloudflare. Every one of them is in this table. Apple's services, pictures of products, and links you open are described after it.
| When | What is sent | What is kept |
|---|---|---|
| You finish a face scan | One face-cropped JPEG for each pose you completed (the front at 1536 pixels across, each side at 768), and the measurements your phone made from them: redness, tone, evenness, texture, shine and under-eye darkness for each zone, whether the phone is sure of each zone, and which zones it could not measure. No identifier of any kind travels with them. They go to Google's Gemini. A scan saved by an earlier test version, which took five poses, sends one frame for each of its poses if it is read again. | Nothing. The images and measurements are read once and forgotten. They are not written to a database, a cache, or object storage at any point, on our side. |
| You photograph a product in the scanner | The part of the photo inside the window you set, and the words your phone read off it. Read by Gemini when the words alone do not find the product in our catalogue. | A one-way hash of the image and the model's reading of it, used for 180 days so the same photo is not read twice (then deleted), and a line saying which sources were tried, which one answered and when. The image itself is not stored. If the product is named but no ingredient list is found, Gemini is asked by name for its published list, which is kept against the product for 90 days. |
| Mirror checks an ingredient list | The ingredient names. Our server may look them up in an outside ingredient database. | The analysis, keyed by a hash of the ingredient list, so the same list is not re-analysed. |
| You tap Beautify photo | A copy of your product photo cropped to the product, at most 640 pixels on its long side and about 120 KB; a hint of up to 120 characters with the product's brand, name and kind; and the random Beautify id from your phone. The photo and hint go to Gemini's image model. | The photo and the hint are not stored. To allow three tidies a day for each phone, one row holds that day's count under a one-way code made from the day and the id, so it cannot be traced back to your phone or matched across days. Rows from earlier days are deleted the next time anyone uses Beautify. |
| You send Mira a message | Your message (up to 600 characters), up to the last eight messages of this conversation as text, and a context: your goal, your routine level, the names of the products in your routine (up to forty), your morning steps, which step is sunscreen, your streak, today's UV index, your city, and, unless you switch it off, a summary of your last three check-ins in fixed words. It goes to Anthropic's Claude, or to Gemini when Claude cannot be reached. | Nothing. No message, reply or summary is written to a log or a database. |
| You show Mira a photo in chat | The photo, at most 1600 pixels on its long side, marked as your skin or as a product. A skin photo goes to Gemini with that one message. A product photo is read by Gemini the same way as in the scanner, and Mira is told only what the product is. | For a skin photo, nothing. For a product photo, the same hash and reading as the scanner keeps. The photo itself is not stored. |
| You ask what Mira thinks of a product, add one to your shelf, or move one into your routine | The product with its ingredient list; the products in your routine with theirs; and, from your profile, your skin type, how easily it reacts, your goal, what you react to, your formulation and product preferences, whether you told Mirror you have rosacea, eczema or atopic dermatitis, and whether retinoids should be left out. | Nothing. Our code reads all of it for that one answer. The model, Anthropic's Claude (or Gemini when Claude cannot be reached), is shown only your skin type, how easily it reacts, your goal and the ingredients you avoid, in words. The name of a condition and the reason retinoids are left out never reach it. |
| Mirror looks for products for a step of your routine | The step, your budget level, the country your phone is set to, and the ingredient families to avoid, worked out on your phone from what you react to, what you asked labels to leave out, and whether retinoids are off. They travel in the web address. With no country set, our server uses the country Cloudflare places the request in. | Nothing. Only when our catalogue has nothing that fits is a model (Claude, or Gemini) asked to name up to three products, and it is told the step, country, budget level and families to avoid, and nothing else. |
| You open or scan a product, and People say loads | The product's brand, name, catalogue id and kind. | Nothing. Gemini runs a Google search for what reviewers say, and Claude rewrites that answer into short takes. Nothing about you is in either request. |
| You search the catalogue, open a product page, or Mirror shows prices for your shelf | Your search text, a product's identifier, or the identifiers of the products on your shelf. | Nothing. |
| You let Mirror check your weather, and after that at most once a day for your morning reminder's UV, and when you open Mira's chat | A latitude and longitude rounded to two decimal places, which is about a kilometre, from the location you allowed or the city you typed. Our server passes them to Open-Meteo, a weather service, which sees our server rather than your phone. | Nothing on our side. Open-Meteo's terms say its server logs, which may include the coordinates, are deleted after 90 days; they show our server's address, not yours. Our host keeps Open-Meteo's answer for 15 minutes so the same spot is not asked twice. |
| You tap a buy link | The product's identifier and the name of the screen it was on, in a link to our server that your browser opens. | The product, the shop, the screen, the country Cloudflare places the request in, and the time. No user, device or IP address. |
| The app is in use, with Help improve Mirror on (the default) | In small batches: a random install id, the app and iOS versions, and events from a fixed list of ten (the app opened, the quiz finished, a scan started, a scan finished, a read landed, a read failed, a product was added, a plan was built, the paywall was shown, a purchase was made), each with a short fixed tag, such as the kind of scan or the plan bought, and the time it happened. | Each event, with the install id and the versions, for 90 days. Older rows are deleted the next time our server tidies up, which it does as new usage comes in. |
| Apple passes the app a report of a crash, a hang or heavy disk writing, with Help improve Mirror on | The kind of fault, the app and iOS versions, its exception and signal codes, Apple's termination reason, how long a hang lasted, and up to sixteen stack frames as code addresses. Once a day, Apple's average launch time and hang time. No install id. | Each report, for 90 days. Older rows are deleted the next time our server tidies up, which it does as new usage comes in. |
| A phone set up by an earlier test build opens this version | Only a request to forget it: the random id that build used to register Mira's lock-screen card. This version registers nothing for push, because our server sends no push. | Nothing. The row that earlier build left is deleted. |
| You open Insights | Nothing about you. The app asks for the list of published pieces, the ones it does not have, and for a newer piece, its recorded narration. | Nothing. |
Every model call also adds one to that feature's count for the day, and its token counts to a daily total for each feature and model. Those rows hold numbers and feature names, nothing about you. Our server also asks public product databases (Open Beauty Facts, openFDA and an ingredient database) about products; those requests carry product details, from our server, and nothing about you.
Apple. iCloud and its sync, App Store purchases, Apple Health, the location fix and turning a location into a city name, notifications and the lock-screen push token are Apple's services, under Apple's policy.
Pictures of products. When the app shows a shop's or a public product database's picture of a product, your phone loads that picture from where it is hosted, such as a retailer's image server or Open Beauty Facts. That server sees an ordinary request for a picture, with your IP address, the way any website does. Nothing about you is sent with it. The same happens when you choose a shop's photo for your shelf.
Links you open. Sources under People say, Google's search suggestions and buy links open in your browser, and the sites you land on see you as they see any visitor.
Requests to our server are sent over HTTPS. Our server sits behind Cloudflare, which sees each request the way any host does, including your IP address, and keeps its own edge logs under its own policy. Our server counts requests per IP address for a minute at a time to stop abuse, and keeps no record of the address.
5Mira's Chat and Your Check-ins
Mira's chat replies are written by a model when our server can answer, and chosen by the app from a set of written replies when it cannot. A text message goes to Anthropic's Claude, and to Google's Gemini when Claude cannot be reached. A photo of your skin goes to Gemini. No photo is ever sent to Anthropic.
What she is told about your check-ins. With Mira remembers your check-ins on, which is the default, each message carries a summary of up to three days: today, yesterday and the day before. Your phone builds it from fixed lists only: your mood (glowy, okay or off), the kinds of off you tapped, what felt good, the names of products in your routine you said reacted, anything new you noticed, a feeling word, and up to three topic words, such as work or sleep, that your phone picked out of your note by matching words. The words of your notes, your skin note, dates and anything from Apple Health are never in it, and a note that reads as a hard moment adds no topic words. Our server checks every value against the same lists and drops anything else, and a product name counts only if it is on the routine you sent.
Turn the switch off in Settings, under Photos and privacy, and no summary goes with any message.
Your notes. If you tap Talk it through with Mira, the note is copied into the chat box, cut to 600 characters if it is longer, and it goes only if you press send, as an ordinary message.
What our server keeps. Nothing you said. No message, reply or summary is written to a log or a database, and the conversation lives in the app's memory until the app closes.
6Apple Health, Dictation and Your Notes
If you connect Apple Health, Mirror reads two things: your period dates (menstrual flow) and your sleep. It asks to read only and never writes to Health. What it reads is held in the app's memory while it is open, to show where you are in your cycle on Your days and beside a read, and to choose the wording of some of Mira's reminders, which are written on your phone. It is never written to Mirror's database, so it never reaches iCloud through Mirror, and it is never sent to our server, to a model, to Mira's chat or into the usage events. You can switch it off in Settings; the permission itself lives in the Health app.
Dictation in the check-in uses Apple's on-device speech recognition only. The microphone is on only while you are dictating, and where your language cannot be recognised on the phone, the microphone button does not appear. Your voice is not saved or sent; the words become your note, which stays on this iPhone as described above.
7The AI, and What It Sees
Two vendors' models answer Mirror's AI features, always called from our server rather than from your phone, so your device never talks to them directly and your IP address is not exposed to them.
- Google's Gemini API: the skin read, reading a product photo, a product's published ingredient list, the search behind People say, photos of your skin in chat, and Beautify. Gemini also answers any of the features below when Claude cannot.
- Anthropic's Claude API: Mira's chat messages, Mira's take on a product, the short takes under People say, and naming products when our catalogue has none.
Our server does not keep the prompt or the answer for a skin read, a chat message, Mira's take, Beautify or People say. It is constructed for one request and discarded when the request ends. For a product photograph, the reading is kept against a hash of the image for 180 days; the image is not.
What we can and cannot promise about Google and Anthropic. We do not use anything you send to train, evaluate or fine-tune any model, and we never will. What each vendor does with an API request is governed by that vendor's terms for its API, not by us. We use both vendors' paid API services rather than their consumer products, because those are the services whose published terms state that submitted content is not used to train their models. Each may keep requests for a limited time under those terms, for example to look for abuse. That is a statement about their terms, not a promise we are in a position to make on their behalf.
The full per-feature breakdown is in the AI Use Disclosure.
8What Mirror Measures, and What It Does Not
Mirror measures whether it works. With Help improve Mirror on, which is the default, the app sends the ten usage events and Apple's crash reports listed above. They show whether people get through the quiz, the scan and the read, and where the app breaks. They carry no profile answer, no skin reading, no product, no note and no location. Turn the switch off in Settings, under Photos and privacy, and both stop, and the install id and any unsent events are deleted from your phone. Turning it back on starts a new id.
The rest of this list is absences, each checked against the build.
- No advertising, and no advertising code. There is no ad SDK in the app.
- No tracking identifier. Mirror never reads the advertising identifier and never shows the App Tracking Transparency prompt. Its three ids are random, made on your phone, each for one job, and none is shared with anyone but our server.
- Usage data is kept only to keep the app working, and for 90 days. It is not sold, not shared and not used for advertising or to build a profile of you.
- No third-party code at all. The app has zero third-party dependencies. Every framework in it is Apple's, and the crash reports come from Apple's MetricKit.
- Nothing derived from your face is ever used for marketing or advertising, and nothing derived from your face is ever sent to an affiliate network. This is a rule we hold ourselves to and also a condition of Apple's App Store guidelines.
9Notifications and Location
Reminders are scheduled by your phone and contain what your routine and your check-in settings already say. Mira's lock-screen card is started by the app while it is open. Nothing is pushed from our server, and the app does not register your phone for push. If that ever changes, this page will say so first.
Location is asked for on the onboarding screen that explains why, at an accuracy of about a kilometre, as a single fix. It is used to look up the weather where you are. The app keeps the coordinates in your profile and sends them again, rounded to about a kilometre, as the table above says, to refresh the UV reading. Your city's name goes with your messages to Mira, so she can talk about your weather. You can decline location and type a city instead, and every other part of the app works.
10Subscriptions
Mirror Plus is sold through Apple's in-app purchase system. Apple handles the payment and tells the app whether a subscription is active. We never see your Apple ID, your name, your email address or your payment method, and entitlement is checked entirely on your device against Apple's signed receipt. The only purchase information that reaches our server is the usage event for a purchase, which says which plan was bought and nothing else, and only while Help improve Mirror is on.
11Children
Mirror is for adults. It is not intended for anyone under 18, and you must not use it if you are under 18. We do not knowingly collect information from anyone under 18. Because the app has no account, we have no practical way to identify a user's age beyond asking; if you believe someone under 18 has been using Mirror, contact us at nativescan.tool@gmail.com and we will help you delete what is on that device.
12Where Things Are
We are in Canada. Our server and its database run on Cloudflare's network, which is global and will serve your request from a location near you. The Gemini API is operated by Google and the Claude API by Anthropic, both companies in the United States, and requests to them may be processed outside Canada. Where the law requires a transfer mechanism, we rely on the standard contractual terms those providers publish.
13Keeping and Deleting
On your device. Everything stays until you delete it. Settings has a Delete everything action that removes every scan, every photograph, every diary entry, your routine, your shelf and your profile from the phone, and because the store is mirrored, from your private iCloud too. It also removes your photos of your products in every version, the Beautify cache, your notes from "What's on your mind", your product ratings, hidden suggestions and the rest of the small stores in UserDefaults, including its random ids, and it disconnects Apple Health, clears pending reminders and the widget's copy, and deletes any export left on the phone. The one thing it keeps is whether Help improve Mirror is on; if it is, you come back under a new install id. There is no undo and no copy is kept anywhere.
On our side. Nothing is keyed to a name or an account. What we hold:
- Usage events and crash reports, for 90 days, then deleted the next time our server tidies up, which it does as new usage comes in. The events sit under an install id that your phone deletes when you switch Help improve Mirror off or delete everything; after that, nothing links them to your phone. Because the app does not show you your install id, we cannot pick out your events to delete them sooner on request.
- A lock-screen registration from an earlier test build, if your phone has one. This version asks our server to delete it, and Delete everything does too. Otherwise it goes 30 days after it was last refreshed.
- Beautify's daily counts. Deleted the next time anyone uses Beautify on a later day.
- About products, not people: the product-photograph cache, ingredient lists from AI knowledge, ingredient analyses, the product lookup log and the buy-link log. None of them holds a user, a device or an IP address.
If a data protection law gives you a right of access or erasure, we will honour it as far as it is technically possible, and we will tell you plainly where it is not, rather than pretending.
We do not back up your data and we cannot recover it. If you delete it, or lose your device without an iCloud backup, it is gone.
14Export
Settings has Export my data. It builds a zip file on your phone, which you save or send wherever you choose. Inside is a readable file of everything Mirror stores about you: your profile answers, every scan with its readings, your diary with your check-in answers, your shelf, your routine and what you ticked off, your product ratings, the suggestions you hid and the product kinds the scanner saved. Every photograph is beside it at the quality it was kept, including your photos of your products in every version, and your notes from "What's on your mind" are in a file of their own. The file is made on the phone and is not sent to us.
15Security
Traffic to our server uses HTTPS. Your data on the device is protected by iOS file protection and by your device passcode, and your notes from "What's on your mind" cannot be read while the phone is locked. Your private CloudKit database is protected by your Apple ID.
We do not claim end-to-end encryption, and we do not claim that any method of storage or transmission is completely secure, because no method is. What we claim is narrower and checkable: photographs you send are not stored on our server, and there is no account database to breach because there is no account.
16Your Rights
Depending on where you live, you may have rights to access, correct, delete, or port your information, to object to or restrict processing, and to complain to a regulator. In Mirror's case most of these you can exercise yourself, immediately, from Settings, because your data is on your device rather than on ours.
Write to nativescan.tool@gmail.com for anything else. In Canada you may complain to the Office of the Privacy Commissioner of Canada; in the EEA or the UK, to your local supervisory authority; in California, to the Attorney General.
We do not sell your personal information and we do not share it for cross-context behavioural advertising. There is no advertising in Mirror and no mechanism by which this could happen.
17The Website
The website at native-dev.com/mirror is a set of static pages. It sets no cookies and has no forms. Our host, Cloudflare, counts visits with Cloudflare Web Analytics: a small script that stores nothing in your browser (no cookies, no local storage) and, in Cloudflare's own words, does not "fingerprint" visitors by IP address or browser. We see totals such as page views, pages read and referring sites, never who you are. The typeface and every image are served from the same place as the pages; nothing loads from another company.
This section was added on 24 October 2026.
18No Warranty as to Privacy Outcomes
We have designed Mirror to keep as much as possible on your device, and this document describes that design honestly. We do not, and cannot, warrant a particular privacy outcome. Bugs happen, third parties change their terms, and future versions may transmit things this one does not. When that changes, this document changes first.
19Changes to this Policy
When we make a material change we update the version number and effective date at the top. If a change affects what happens to your face photographs, the app asks for your consent again before your next scan. For any other change, this page and its version are how we tell you. Continued use after an update means you accept the updated Policy.
20Contact
nativescan.tool@gmail.com. One address for privacy questions, deletion requests, and anything else on this page.
Reminder. Mirror gives cosmetic, educational skincare information. It is not medical advice, diagnosis or treatment, and it is not a substitute for a dermatologist.