Privacy Policy

Last updated: October 27, 2026

This Privacy Policy explains how [COMPANY LEGAL NAME] ("Mirror", "we", "us"), [REGISTERED ADDRESS], e-mail: iletisim@mirroroutfits.com handles personal information when you use the Mirror app and website (mirroroutfits.com). Mirror is built so that most of your data never leaves your device. Region-specific information for the United Kingdom and the United States is at the end.

1. The short version

• You can use Mirror without an account. Your style profile, likes, saved outfits, watchlist and try-on results are stored on your device.
• Your photo stays on your device. It is sent through our servers to an AI provider only when you tap "Try it on", only for that request, and it is never stored on our servers.
• We do not sell your personal information, we do not use advertising cookies or tracking pixels, and we do not share your data with the stores you shop at.
• When you buy something through a store link, the store or an affiliate network may pay us a commission. Your price stays the same.

2. Information we collect

• Stored only on your device: your gender, style, color and undertone choices, sizes and budget, likes, saved outfits, price watchlist, your "Tried on" history (up to the last 60 try-ons) and your interest profile. The interest profile is calculated on your device from what you like, save, open, track or search for, and is used only to rank outfits and products for you. You can see and reset it under Profile → "How Mirror knows you".
• Your photo (only if you use virtual try-on): stored on your device. Sent to an AI image provider each time you request a try-on (see section 4), together with your height and weight if you entered them, so the clothes fit your body. To make results reliable, an AI model on our provider's servers automatically checks whether the garment colors came out right and where your face is in the image (a box position only); your face and background are then blended back from your original photo on your device (MediaPipe). Nothing from these checks is stored.
• Account information (only if you create an account; guest use does not require one): your name; your e-mail address or phone number, depending on how you sign in; if you use Google or Apple sign-in, the account ID those services give us (and your e-mail if they share it); when your account was created and last used. We do not use passwords. One-time sign-in codes are stored only as a hash and expire after 10 minutes. With an account, your saved and liked outfits, style profile, watchlist and credits are stored on our servers so you can use them on any device.
• Sessions (only if you have an account): for each device you sign in on, a hash of the session key, when it was opened and expires, and the device's browser or app information (user agent). Profile → My account → "Sign out of all devices" closes them all.
• Shared outfits (only if you share an outfit by link): the products in the outfit and its name. The link is not tied to you; anyone with the link can see it.
• Device sync (only if you link devices without an account): your outfit lists and style profile are stored on our server under a random sync ID. Your photo is never synced.
• Stylist messages: the text you type to the Stylist, together with your gender, chosen styles and budget, is sent to our AI provider to generate a reply. Please do not include sensitive information or other people's personal information.
• Searches: the words you search for in Explore. They are sent to our search provider without any information about you.
• Credits: if you get or buy credits, an anonymous wallet ID, your credit balance and a record of credit purchases and use. Credit sales, once enabled, are handled only by Google Play or the App Store; we do not receive your card details.
• Price alerts (mobile app only, and only if you turn them on): your device's push notification token, its operating system, and the IDs and last seen prices of the products you track. Your name, profile and photo are not included.
• Store visits: when you open a product at a store, we record the store, product and outfit, the time, and a random click ID that we pass to the affiliate network. This record does not identify you.
• Contact form (only if you write to us): your name, e-mail address, topic and message.
• AI output reports: if you report a try-on image, the reason you choose, the provider and your optional note. The image itself is not sent.
• Technical and security data: IP address, request time and browser or device information in server and network security logs; in abuse-prevention counters, only a keyed one-way pseudonym of your IP address, never the address itself. When you first open the app, we use your IP address to look up your country so we can show the right stores and currency; the country is not stored on our servers.
• Website analytics: we use Cloudflare Web Analytics to count visits to our website. It does not use cookies or local storage and does not track you across other websites.

We do not extract face geometry or any other biometric identifier from your photo, and we do not use it for facial recognition.

If you choose the "Modest" style, that choice could reveal religious beliefs. It stays on your device and is removed from requests sent to the Stylist.

3. How we use information

• To provide Mirror: build outfits that match your style, sizes and budget; show your saved outfits; run your account and device sync; send sign-in codes.
• Virtual try-on: show outfits on your photo, only with your consent (see the AI Try-On Consent).
• Stylist and search: answer your requests.
• Credits and purchases: keep your balance, deliver credits you buy and refund credits when a try-on fails.
• Notifications: send price alerts and, if you opt in, promotional notifications.
• Commissions: count store visits and match sales reported by affiliate networks to clicks, so we can be paid commissions.
• Security: prevent abuse, fraud and excessive requests, and fix errors.
• Legal: comply with the law, respond to lawful requests, and establish or defend legal claims.

We do not use your photo, your try-on images or your Stylist messages to train AI models, and we do not use your information for targeted advertising.

4. Who we share information with

We share personal information only with service providers that process it on our behalf to run Mirror, and only what each one needs:

• Virtual try-on: Cloudflare, Inc. (Workers AI, running the FLUX.2 image model and the Moondream model for color and face-position checks; inputs are not stored after processing or used for training). For Pro try-ons paid with credits: Pruna AI (through Cloudflare AI Gateway), Google LLC (Gemini API) or, as a fallback, FASHN LTD (UK; its sub-processors include Google Cloud, OpenAI and fal; it keeps generated images for up to 72 hours).
• Stylist: Anthropic, PBC (USA).
• Product search: SerpApi, LLC (USA), search words only.
• Hosting, database, content delivery, security and website analytics: Cloudflare, Inc.
• Sign-in: Google LLC and Apple Inc. (if you sign in with them); Resend, Inc. (sign-in codes by e-mail); Twilio Inc. (sign-in codes by text message, where available).
• Push notifications: Google LLC (Firebase Cloud Messaging, Android) and Apple Inc. (Apple Push Notification service, iOS), push token and notification text only.
• App stores and payment providers, for purchases you make.
• Authorities, courts or others where required by law, or to protect the rights, property or safety of Mirror, our users or others.
• A buyer or successor, if Mirror is involved in a merger, acquisition or sale of assets, subject to this Policy.

Stores and affiliate networks: when you go to a store, we do not send them your personal information. The link only tells them the visit came from Mirror, with a random click ID. Once you are on a store's website, the store and any affiliate network are responsible for the information they collect under their own privacy policies.

The full list of providers and their locations is in "Service Providers & International Transfers".

5. How long we keep information

• On-device data: until you delete it. Profile → "Reset my data" deletes it all. Uninstalling the app or clearing site data also deletes it.
• Your photo: never stored on our servers; discarded from memory when the try-on request finishes.
• Account data: until you delete your account (Profile → My account → "Delete my account").
• Device sync data: deleted automatically after 1 year without use, or any time you delete it. Link codes are valid for 10 minutes.
• Sessions: until you sign out; a session not used for 90 days closes and is deleted automatically.
• Sign-in codes: at most 1 day. Abuse-prevention counters (IP pseudonym): at most 3 days.
• Server security and error logs: at most 7 days.
• Shared outfit links: deleted after 2 years without being opened. AI output reports: 1 year.
• Push registration: deleted when you turn price alerts off or reset your data; automatically when the token becomes invalid or after 180 days of not opening the app.
• Contact messages: 1 year.
• Store visit records (no identity) and credit purchase records (anonymous wallet ID only): as long as needed for commission reconciliation and tax and accounting law, up to 10 years.
• Deleted data may remain in our infrastructure provider's disaster-recovery backups for up to 30 more days and is not used for anything else.

6. Your choices and rights

• Download a copy of the data on this device: Profile → Privacy → "Download my data".
• Delete your photo: Profile → My Mirror photo → "Delete my photo".
• Delete everything on this device: Profile → "Reset my data". Delete your account: Profile → My account → "Delete my account".
• Turn notifications off: Profile → Notifications, or your phone's settings.

Depending on where you live, you also have legal rights over your personal information (see the UK and US sections below). To use them, follow "Your Privacy Rights" or e-mail iletisim@mirroroutfits.com.

7. Security

We use encryption in transit (HTTPS), store session keys and sign-in codes only as hashes, encrypt linked device keys, limit request rates and keep access to production systems to a minimum. No system is perfectly secure, so please keep your device protected.

8. Age requirement

Mirror is for people aged 18 and over. We do not knowingly collect personal information from anyone under 18, including children under 13. If you believe a minor has given us personal information, contact iletisim@mirroroutfits.com and we will delete it.

9. Changes

We may update this Policy. If the changes are significant, we will tell you in the app before they take effect. The date at the top shows the latest version.

10. Contact

Questions or requests: iletisim@mirroroutfits.com or the contact form on our website. Data controller: [COMPANY LEGAL NAME], [REGISTERED ADDRESS].

United Kingdom: your rights under UK GDPR

If you are in the UK, [COMPANY LEGAL NAME] is the controller of your personal data under the UK GDPR and the Data Protection Act 2018. Our UK representative is [UK REPRESENTATIVE: NAME AND ADDRESS].

Our lawful bases are:

• Contract (Art. 6(1)(b)): providing Mirror, your account, sync, the Stylist, search, credits and purchases.
• Consent (Art. 6(1)(a)): virtual try-on with your photo, and promotional notifications. If your photo or a style choice such as "Modest" reveals special category data (for example religious beliefs), we rely on your explicit consent (Art. 9(2)(a)). You can withdraw consent at any time without affecting earlier processing.
• Legitimate interests (Art. 6(1)(f)): security and abuse prevention, error fixing, counting store visits for commission reconciliation, and website analytics. You can object to this processing.
• Legal obligation (Art. 6(1)(c)): tax and accounting records and responding to lawful requests.

You have the right to access your data, to have it corrected or erased, to restrict or object to processing, to data portability, and to withdraw consent. We respond within one month (extendable by two months for complex requests). We do not make decisions about you based solely on automated processing that have legal or similarly significant effects; outfit ranking only orders suggestions.

Some of our providers are outside the UK (mainly in the USA and the EU), and our team may access data from Turkey. Transfers rely on UK adequacy regulations (EU/EEA, and US organisations certified to the UK Extension of the EU-US Data Privacy Framework) or on the UK International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses. Contact us for a copy of the relevant safeguards.

Device storage: we only store and read information on your device where it is strictly necessary for the service you asked for (PECR, regulation 6). We do not use advertising or analytics cookies.

You can complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113). We would appreciate the chance to resolve your concern first.

United States: your privacy rights

This section supplements the Policy for residents of US states with consumer privacy laws, including California (CCPA as amended by the CPRA), Virginia, Colorado, Connecticut, Utah, Texas, Oregon and others. Some of these laws apply only to businesses above certain size thresholds; we offer the rights below to all US users regardless.

Categories of personal information we collect (in the last 12 months), with their sources and purposes as described above:

• Identifiers: name, e-mail address, phone number, account ID, Google or Apple account ID, push token, IP address. Source: you and your device.
• Commercial information: credit purchases and use (anonymous wallet ID); stores you visit through Mirror (not linked to you).
• Internet or other electronic network activity: search words, Stylist messages, security logs, aggregated website analytics.
• Approximate location: country derived from your IP address (not stored). We do not collect precise geolocation.
• Audio, electronic or visual information: your photo and try-on images, processed only when you request a try-on.
• Inferences: your interest profile and style preferences, kept on your device.

Sensitive personal information: we do not collect biometric identifiers. The "Modest" style choice, which could reveal religious beliefs, stays on your device. We use sensitive information only to provide the service you request, so we do not offer a separate "limit the use" option.

No sale or sharing: we do not sell personal information and we do not "share" it for cross-context behavioral advertising, as those terms are defined by California law. We have not done so in the past 12 months, and we do not knowingly sell or share the personal information of consumers under 16.

Your rights: to know or access the personal information we have collected about you, to receive a portable copy, to correct it, to delete it, and to opt out of sale, sharing, targeted advertising and profiling with legal or similarly significant effects (we do none of these). We will not discriminate against you for using your rights.

How to make a request: see "Your Privacy Rights" or e-mail iletisim@mirroroutfits.com. We verify requests by confirming control of the e-mail or phone number on your account; you may use an authorized agent. We respond within 45 days (extendable once by 45 days). If we decline your request, you can appeal by replying to our decision; if you are not satisfied with the result of the appeal, you can contact your state Attorney General.

Global Privacy Control and Do Not Track: because we do not sell or share personal information or use cross-site tracking, there is nothing for these signals to switch off; our practices are the same whether or not your browser sends them.

Children: Mirror is not directed to children under 13 and we do not knowingly collect their personal information (COPPA).