Privacy Policy

1. Who we are

MirrorNotes is a private journaling application for iOS developed by Lokesh Pudhari ("we," "us," or "our"). The app is available on the Apple App Store.

For questions about this policy, contact us at: [email protected]

2. The fundamental privacy guarantee

MirrorNotes is built on a single architectural principle: your journal text never leaves your device.

This is not a policy promise that can be changed by a future update. It is a technical fact about how the app is built:

• Journal entry text is stored in SwiftData on your local device.
• iCloud sync via Apple CloudKit copies your entries to your own iCloud account, accessible only with your Apple ID credentials. We have zero access to this data.
• AI analysis (Daily Nudge, Ask, Weekly Digest) is performed by Gemma 3 1B, a model that runs entirely on your device's Neural Engine. Your entry text is never sent to any server for AI processing.
• Generated insights (e.g., a Daily Nudge) are cached on-device in SwiftData. Insight text is not transmitted to our servers.

3. What data we collect and why

The table below summarizes every category of data involved in MirrorNotes's operation:

What we explicitly do not collect

• Journal entry text (never leaves your device)
• Voice recordings (transcribed locally; audio is discarded)
• AI insights or generated content
• Behavioral analytics, ad identifiers, or tracking pixels
• Location data
• Contact list, photos, microphone (except for in-app voice input, no storage)
• Any data for advertising purposes

4. Third-party services

RevenueCat (subscription management)

RevenueCat processes in-app purchase receipts from Apple and updates your subscription status. RevenueCat receives your Apple purchase receipts and assigns you a subscriber ID. No journal data is involved.

RevenueCat Privacy Policy: revenuecat.com/privacy

Apple (iCloud + App Store)

Apple CloudKit syncs your entries between your devices using your iCloud account. Apple handles all payment processing for subscriptions. No account or sign-in is required to use MirrorNotes.

Apple Privacy Policy: apple.com/privacy

5. On-device AI and local processing

All AI features in MirrorNotes (Daily Nudge, Ask, Weekly Digest) are powered by Gemma 3 1B, a large language model that runs entirely on your device.

• The model file is bundled with or downloaded by the app and stored locally.
• Inference (generating AI responses) happens in memory on your device.
• Entry text passed to the model never leaves your device's local memory.
• We impose a 10,000-character maximum on text sent to the model (truncating oldest entries first) to protect device performance.
• Generated insights are cached on-device and not regenerated within 24 hours.

There are no API calls to any AI cloud service (no OpenAI, Anthropic, Google Cloud AI, etc.) for AI processing.

6. Data retention and deletion

Your journal entries

Stored on-device. Deleted immediately when you delete them. No server copy exists. If you delete the app, SwiftData is cleared. iCloud copies are managed by your Apple ID settings.

Subscription data

Subscription status is stored by RevenueCat for as long as you have an active subscription. Deleted within 30 days of a deletion request.

How to delete your data

1. Open MirrorNotes → Settings → Account
2. Tap "Delete Account"
3. Confirm deletion

This removes your subscription status from RevenueCat. Your journal entries, stored locally and in your iCloud, must be deleted separately through iOS Settings or by deleting the app.

You may also contact us at [email protected] to request account deletion.

7. Your rights

Depending on your location, you may have certain rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you (your user ID and subscription status).
• Correction: Request correction of inaccurate data.
• Deletion: Request deletion of your account data (see Section 6).
• Portability: Request your data in a portable format. Note: journal data is stored on your device, you own and control it directly.
• Opt-out: We do not engage in data selling or cross-context behavioral advertising. There is nothing to opt out of in that regard.

To exercise any right, contact [email protected]. We will respond within 30 days.

California residents (CCPA/CPRA)

We do not sell or share personal information for cross-context behavioral advertising. We collect only the minimum data necessary to provide the service. You have the right to know, delete, and opt-out as described above.

European residents (GDPR)

Our legal basis for processing subscription data is contract performance (providing the service you signed up for). You have the rights described above under GDPR Articles 15–22. To lodge a complaint, contact your local Data Protection Authority.

8. Security

We take security seriously:

• All network requests (to RevenueCat and Apple) use HTTPS/TLS.
• Because journal data never leaves your device, the blast radius of any server-side breach is limited to subscription status only, not your writing.

If you discover a security vulnerability, please report it to [email protected].

9. Children's privacy

MirrorNotes is not directed to children under the age of 13 (or under 16 in the European Economic Area). We do not knowingly collect personal information from children. If you believe a child has provided personal information to us, contact us and we will delete it promptly.

10. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you via an in-app notification and update the "Last updated" date at the top of this page. Continued use of MirrorNotes after a policy update constitutes acceptance of the updated policy.

We will never change the core architectural fact that your journal entries remain on your device without also giving you clear advance notice and the ability to export your data.

11. Contact us