1. Who we are
Mirror (“Mirror”, “we”, “us”) is provided by Pixolent. Pixolent is the data controller for personal information processed through the Mirror mobile apps and this website. You can reach us about anything in this policy at support@bellatrixmediaconsult.com.
We process personal data in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
2. What we collect
Information you give us
- Account details: your name, email address and password (stored only as a secure hash). If you sign in with Apple or Google, we receive your name and email address from that provider, and never your Apple or Google password.
- Profile details you choose to add: phone number, date of birth, city and a profile photo.
- What you share about your journey: the struggles you describe, check-ins (how you're feeling and what you need), journal entries, reflections, prayer requests, and your onboarding preferences.
- Activity in the app: the plans you start, pause or complete, daily practice and streak history, and any community activity.
- Accountability partners: the people you invite and the sharing settings you choose for each of them.
- Messages to support: whatever you include when you email us.
Information from your device
- Approximate location, only if you ask for it: when you tap to fill in your city, the app uses your device's location once to look up the city name. We save the city name you confirm, not your coordinates.
- Photos, only the one you pick: if you choose a profile photo, we upload only that image. Mirror does not read the rest of your photo library.
- Basic technical data: device type, operating system and app version, plus server logs (such as IP address and request times) that we need to keep the service secure and working.
We do not use advertising identifiers, show ads, or use third-party analytics or tracking tools, and we do not track you across other companies' apps or websites.
3. Sensitive information
What you share in Mirror can reveal your religious beliefs, and may touch on your mental or physical health. UK GDPR treats this as special category data. We process it only because you choose to give it to us to receive the service, relying on your explicit consent. You can withdraw that consent at any time by deleting the content or your account. Doing so does not affect processing that already took place.
Your struggles, check-ins and journal are private by default. Nobody else sees them unless you explicitly choose to share something, for example with an accountability partner.
4. How we use your information, and our lawful bases
| Purpose | Lawful basis |
|---|---|
| Creating and running your account, signing you in, resetting your password | Contract |
| Matching what you share with relevant Bible characters, building your plans, and personalising your Today screen | Contract; explicit consent for sensitive information |
| Sharing with the accountability partners you choose | Consent |
| Sending service emails such as verification and password-reset codes | Contract |
| Reminders and notifications you have switched on | Consent (turn them off in Settings at any time) |
| Recognising signs of crisis in what you write so we can point you to urgent help | Vital interests; explicit consent |
| Keeping the service secure, preventing abuse and moderating community content | Legitimate interests |
| Answering support requests | Legitimate interests |
| Meeting legal obligations | Legal obligation |
We do not sell your personal information, we do not use it for advertising, and we do not use what you share about your struggles to profile you for anyone else.
5. Who we share it with
We share personal information only with service providers who help us run Mirror, under contracts that require them to protect it and use it only on our instructions:
- DigitalOcean: cloud hosting for our servers and database.
- Resend: delivery of account emails such as sign-in and password-reset codes.
- Google Maps Platform: turning your device location into a city name when you ask the app to fill it in. Our server makes this request, and Google does not receive your Mirror account details.
- Apple and Google: if you choose Sign in with Apple or Google Sign-In, and for app distribution and any in-app purchases through the App Store or Google Play. Payments are handled by Apple or Google, and we never see your card details.
We may also disclose information if the law requires it, to protect someone's life or safety, or as part of a business transfer, in which case this policy continues to apply.
6. International transfers
Some of our providers process data outside the UK. When they do, we rely on safeguards recognised under UK data protection law, such as UK adequacy regulations or the International Data Transfer Agreement or Addendum.
7. How long we keep it
- We keep your account and content for as long as your account is open.
- When you delete your account, your profile, struggles, check-ins, journal, plans, progress and partner connections are permanently removed from our systems straight away. Any copy held in a backup is removed when that backup expires, within 30 days.
- Password-reset codes expire after 15 minutes and are then deleted. Server logs are kept only as long as we need them for security and troubleshooting, and no more than 90 days.
8. Keeping it safe
All data travels between the app and our servers over encrypted connections (HTTPS). Passwords are stored as one-way hashes. Access to production systems is restricted to a small number of authorised staff, and administrative and moderation actions are logged. No system is perfectly secure, but we work to protect your information and will tell you and the regulator about a serious breach where the law requires it.
9. Your rights
Under UK data protection law you have the right to:
- access the personal information we hold about you;
- correct information that is wrong or incomplete;
- have your information deleted, which you can do yourself in the app (see how to delete your account);
- restrict or object to certain processing;
- receive your information in a portable format;
- withdraw consent at any time.
To use any of these rights, email support@bellatrixmediaconsult.com from the address on your account. We will respond within one month. If you are unhappy with how we handle your information, you can complain to the UK Information Commissioner's Office at ico.org.uk, though we'd welcome the chance to put things right first.
10. Children
Mirror is intended for people aged 13 and over. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has created an account, contact us and we will delete it.
11. Mirror is not an emergency service
Mirror is not a clinical or crisis service, and nobody monitors what you write in real time. If you or someone else is in danger, contact local emergency services straight away. Our support page lists places to get urgent help.
12. Changes to this policy
If we make significant changes, we will let you know in the app or by email before they take effect. The date at the top of this page shows when it was last updated.
13. Contact
Pixolent
Email: support@bellatrixmediaconsult.com