MIRROR — Privacy Policy
Effective date: August 23, 2026 Data controller: John Greg (sole trader), 14610 Bull Run Road, Miami Lakes, FL 33014, USA, contact contact@mirrorspeak.app.
1. Who we are and what this covers
MIRROR ("we", "us") is a language-learning app in which you record yourself speaking lines from movie scenes and receive a pronunciation/accuracy score. This policy explains what personal data we collect when you use the app, why, how long we keep it, who processes it on our behalf, and your rights.
2. What we collect
| Category | Data | Source |
|---|---|---|
| Account | Username, email address, password (stored only as a bcrypt hash — we never store or see your plaintext password) | You, at registration |
| Voice recordings | The audio you record when practising a scene | Your device microphone, with your permission |
| Transcripts | The text transcription of each recording | Generated from your audio (see §4) |
| Practice & progress data | Per-attempt scores, best scores, points, division/rank, daily streak, level progress, chosen avatar scene | Generated as you use the app |
| Technical | IP address (used transiently for rate-limiting), basic request logs | Automatically, when you use the service |
We do not collect payment card details directly — subscriptions are handled by our payment processor (see §5).
3. Why we process it, and our lawful basis (UK/EU GDPR)
- To provide the service (score your speech, track progress, run leaderboards): lawful basis performance of a contract (Art. 6(1)(b)).
- To process your voice recordings specifically: lawful basis your consent (Art. 6(1)(a)), which you give by accepting the recording notice shown before your first recording, and then by choosing to record (see §6). You can withdraw consent at any time by stopping recording and/or deleting your account; withdrawal does not affect processing already carried out.
- To secure the service (rate-limiting, abuse prevention): legitimate interests (Art. 6(1)(f)).
We do not sell your data, and we do not use your recordings or transcripts to train our own or anyone else's models. Our transcription provider's API terms state that data sent to their API is not used to train their models unless the customer opts in, and we have not opted in (see §5).
4. How your voice is processed, and retention
When you submit a recording:
- The audio is uploaded to our server over an encrypted connection.
- It is written to a temporary file and sent to OpenAI (see §5) for speech-to-text transcription.
- The audio is deleted from our server immediately after transcription. We do not retain a copy of your recording. OpenAI may retain it for up to 30 days for abuse monitoring before deleting it (see §5).
- The resulting transcript text and your score are stored and associated with your account, so we can show your history and progress.
Retention periods:
- Voice audio: not retained by us — deleted within the same request after transcription.
- Transcripts, scores, progress, account data: retained for as long as your account exists.
- Request/IP logs: retained for 30 days.
Deleting your account. You can delete your account at any time from the Profile tab in the app — open Profile and choose Delete my account at the bottom of the panel. You will be asked to type your username and re-enter your password to confirm.
Deletion is immediate and permanent. It erases your account and sign-in details, every recording transcript and score, your points, rank and division, your day streak and mission progress, your vocabulary mastery, and any challenge links you created. It cannot be undone, and because we do not retain your voice recordings there is no backup to restore from.
Two things worth knowing. If you have an active MIRROR Pro subscription, we cancel it for you as part of the deletion — you will not be billed again. The cancellation happens before anything is erased, so if it fails for any reason your account is left untouched rather than deleted with a subscription still running. Note that cancelling stops future payments but does not refund the period you have already paid for, and it is not possible for us to end that period early. In the rare case where we cannot cancel automatically, the app tells you so and gives you a link to cancel it yourself; nothing is deleted until that is done. And once your account is deleted your username becomes available for anyone to register again; a new account using it inherits nothing from yours.
If you would rather not use the in-app path, or you cannot sign in, email contact@mirrorspeak.app and we will action the deletion for you.
5. Processors and third parties
We share data only with the service providers needed to run MIRROR, each bound by a data-processing agreement:
| Processor | What they receive | Purpose | Notes |
|---|---|---|---|
| OpenAI | Your voice recording (audio) | Speech-to-text transcription | Not used for training: "As of March 1, 2023, data sent to the OpenAI API is not used to train or improve OpenAI models (unless you explicitly opt in to share data with us)." Abuse-monitoring logs are retained "for up to 30 days, unless longer retention is required by law", then deleted. Source: OpenAI — data controls in the OpenAI platform (checked 22 August 2026). |
| Anthropic | The scene identifier only (no audio, no personal data) | Generating study vocabulary for a scene | Called once per scene, on a cache miss only; the request contains the scene id and nothing else, and the result is stored and reused for all users. No user personal data is sent. |
| Lemon Squeezy | Name, email, payment details you enter with them | Processing subscriptions | They act as controller for payment data under their own policy: Privacy · DPA. |
| Render | All data above, at rest and in transit | Application and database hosting | Region: Oregon, USA (US West). |
| TMDB | No personal data | Movie artwork/metadata only | Data flows to us, not from you. |
If we add a new provider that processes your voice (for example, a pronunciation-assessment service), we will update this policy and, where required, ask for your consent before enabling it.
6. Consent to recording
Recording is always deliberate. Your browser asks for microphone permission the first time, and audio is captured only while you are actively recording a scene — never in the background. When you submit a recording, that audio is sent to our transcription provider and the resulting transcript is stored against your account, as described in §4.
The notice you see first. Before your first ever recording, the app shows a short notice explaining that your audio is sent to OpenAI to be turned into text, that OpenAI deletes it within 30 days and does not use it for training, that we do not keep the audio ourselves, and that we do keep the transcript and your score against your account. It links to this policy, and you have to accept it before any recording starts. Nothing touches your microphone until you accept, so the notice always comes before your browser's own microphone prompt.
We record that you accepted, along with the date and which version of this policy was current at the time, so we can show what you agreed to. Because that is stored against your account rather than in your browser, you are asked once — not again on a new phone or a different browser. If you have recorded with us before this notice existed, you will see it the next time you record.
Declining is always possible: close the notice and no recording starts, no audio is captured, and your microphone is never opened. You can withdraw consent afterwards by deleting your account (§4), which erases your transcripts and scores along with it.
7. Your rights
Subject to applicable law, you can request to: access your data; correct it; delete it ("right to be forgotten"); export it; restrict or object to processing; and withdraw consent. Contact contact@mirrorspeak.app. You may also complain to your local data-protection authority (in the UK, the ICO).
Erasure you can exercise yourself. You do not need to ask us to delete your data — the Delete my account control in the app's Profile tab erases your account and everything tied to it immediately, cancelling any active subscription along the way. See §4 for exactly what is removed and how the subscription is handled. The email route above remains available if you prefer it or cannot sign in.
8. Children
MIRROR is not directed to children under 13. We do not knowingly collect data from them.
9. International transfers
Your data may be processed outside your country: we are based in the USA, our hosting is in Oregon, USA, and OpenAI processes your audio in the US. Where required — for example for users in the UK or EEA — these transfers rely on Standard Contractual Clauses.
10. Changes
We will post changes here and update the effective date. Material changes affecting how we process your voice will be notified in-app.
11. Contact
contact@mirrorspeak.app · John Greg (sole trader) · 14610 Bull Run Road, Miami Lakes, FL 33014, USA