Mirror Aura — Privacy Policy
Mirror Aura stores your birth data, journal entries, conversations with Aura, and notes about your Circle so we can give you a personalised experience. We never sell your data. You can export everything you've shared at any time, and you can delete your account at any time without warning. We rely on a small number of carefully chosen service providers to run the app; you can ask us at any time who they are.
1. Who we are (data controller)
Mirror Aura ("we", "us", "our") is operated by Better Me SRL, a Romanian limited liability company. Better Me SRL is the data controller for the personal data described in this Privacy Policy.
Contact (including data-protection requests): contact@mirroraura.app
2. The data we collect and why
We collect only the data we need to deliver Mirror Aura's features to you personally. Categories:
2.1 Account & sign-in
| Data | Source | Purpose | Lawful basis (GDPR Art. 6) |
|---|---|---|---|
| Email address | You provide it at sign-up | Secure sign-in, transactional notifications (data-export delivery, account changes) | Contract (Art. 6(1)(b)) |
| Sign-in session data | Created when you log in | Keep you securely signed in | Contract |
2.2 Profile & spiritual context
| Data | Source | Purpose | Lawful basis |
|---|---|---|---|
| Name (full birth name, or what you choose to provide) | You provide it at onboarding or in Profile | Numerology calculations (Expression / Soul Urge / Personality numbers); personalised greetings from Aura | Contract; explicit consent for the spiritual context (Art. 9(2)(a) — see §3) |
| Pronouns | You provide it (optional) | How Aura refers to you | Consent |
| Birth date | You provide it | Numerology Life Path number; astrological Sun, Moon, and Rising signs; daily Personal Day calculations; chart positions | Contract + explicit consent (special category — see §3) |
| Birth time (optional) | You provide it | Refines Moon sign and unlocks Rising sign | Contract + explicit consent |
| Birth place (text + map coordinates) | You provide the text; we convert it to coordinates using a third-party geocoding service | Astrological house calculations; situating you in time and place | Contract + explicit consent |
| Numerology numbers + zodiac signs | Computed from your name + birth data | Render your Cosmos page; personalise Aura's responses | Contract |
2.3 Your activity
| Data | Source | Purpose | Lawful basis |
|---|---|---|---|
| Journal entries (text, optional mood, optional moon-phase + personal-day context) | You write them | Provide the Journal feature; inform Aura's memory if you choose to discuss an entry with her | Contract |
| Aura conversations (your messages + Aura's replies) | You send messages; Aura replies | Provide the Aura chat feature; enable Aura's "memory" over time | Contract |
| Aura's memory of you (short summaries and a distilled persona drawn from your past conversations and journal entries) | Generated automatically with the help of an AI provider (see §4) | Let Aura speak with continuity — remembering open threads, your values, your patterns — without re-reading your entire history each time | Contract; explicit consent for AI-generated reflective profiling |
| Journey records (which goal × magic × duration you started; step progress; completion dates) | You start them; we record progress | Provide the Journey feature; populate the Grimoire; compute streaks | Contract |
| Circle members (their names, nicknames, relationship, birth dates, and the signs and numbers we derive for them) | You enter this data about people in your life | Compute compatibility between you and them; reflect on relationships with Aura | Contract for you; legitimate interest in compact relationship-context recording (Art. 6(1)(f)) |
| Streaks, practice logs, points, crystal level | Derived from your activity | Gamification — your streak count, your crystal progression | Contract |
| Subscription tier and renewal status | Reported to us by the relevant payment provider | Gate paid features; show your tier in Profile | Contract |
2.4 Technical / device data
| Data | Source | Purpose | Lawful basis |
|---|---|---|---|
| IP address (briefly, at the time of a request) | Your device | Routing, abuse prevention | Legitimate interest |
| Device / operating-system / browser information (in standard request data and error logs) | Your device | Diagnose technical errors | Legitimate interest |
| Timezone | Your device | Daily reading and personal-day calculation in your local day | Contract |
| Account-event records (account creation, sign-in events, account deletion) | System-generated | Fraud / abuse prevention; security audit trail | Legitimate interest |
We do NOT collect advertising identifiers, continuous or fine-grained location, your contacts, your camera or microphone, or any data we do not need.
3. Special-category data and explicit consent
Mirror Aura is a spiritual / wellness companion. The birth data you provide and the conversations you have with Aura may, in some interpretations, fall under "special categories of personal data" within the meaning of GDPR Article 9 — specifically as data revealing philosophical or religious beliefs.
By creating an account and providing your birth data, you give your explicit consent (Art. 9(2)(a)) to our processing of that data for the spiritual, astrological, and numerological purposes described in this Privacy Policy. You can withdraw this consent at any time by deleting your account (§7).
4. Who we share your data with
To run Mirror Aura we rely on a small number of trusted service providers ("processors"). Each one receives only the data necessary for its specific role, and only under a data-processing agreement (or equivalent contractual safeguard) that requires it to protect your data and act on our instructions. We describe them here by role rather than by name; a current list of the named providers is available on request at contact@mirroraura.app.
| Provider role | What they do for us | Data they handle |
|---|---|---|
| Cloud hosting & infrastructure provider | Stores our database, files, and runs the back-end that powers the app | The data we store about you, protected in transit and at rest |
| AI provider(s) | Powers Aura's replies, generates personalised journey content, and produces Aura's memory summaries | Your messages to Aura, the summaries derived from them, journal excerpts you choose to discuss, and your numerology / astrology context |
| Email delivery provider | Sends transactional emails (data-export links, account notices) | Your email address and the contents of those emails |
| Payment providers | Process paid subscriptions and report tier/renewal status to us | A purchase/subscription record — we receive only your tier and status, and never see your card details |
| Geocoding provider | Converts the birth-place text you enter into map coordinates | The birth-place text string you entered |
We never sell your personal data, and we do not share it for advertising.
We may add or change providers as the app evolves. Material changes will be reflected in the "Last updated" version of this Policy, with at least 14 days' advance notice in-app and by email.
5. International data transfers
Some of our providers operate outside the European Economic Area (EEA), including in the United States. Where your data is transferred outside the EEA, we rely on:
- ✦The European Commission's Standard Contractual Clauses (SCCs) included in those providers' data-processing agreements; and / or
- ✦An adequacy decision where one applies to the destination country or framework.
You can request details of the safeguards we apply by emailing contact@mirroraura.app.
6. How long we keep your data
We keep your personal data for as long as your account is active.
When you delete your account (§7):
- ✦Deleted immediately: all of your free-text content (journal entries, Aura conversations and messages, Aura's memory of you) and all data you entered about other people in your Circle.
- ✦Anonymised immediately: your identifying details — name, email, birth date, birth time, birth place, coordinates, and pronouns — are removed so your remaining records can no longer be linked to you.
- ✦Retained, anonymised: limited records about your subscription history, your completed journeys (counts and dates, not titles or content), gamification metrics, and the fact that an account-deletion occurred are kept for legitimate-interest purposes — financial reporting, fraud prevention, and our security audit trail. Once your identifying details are removed, these records are no longer personal data under the GDPR.
Backups rotate out naturally over time; we do not actively restore deleted accounts from backup. If you sign up again with the same email after a deletion, we treat you as a new user.
7. Your rights (GDPR + EU law)
You have the following rights regarding your personal data. To exercise any of them, email contact@mirroraura.app. We respond within 30 days (extensions up to 90 days are possible for complex requests; we'll tell you if we need more time).
| Right (GDPR article) | What it means | How to use it |
|---|---|---|
| Access (Art. 15) | Get a copy of the data we hold about you | Profile → Privacy → Export my data. You receive an emailed link to a file containing your data. |
| Rectification (Art. 16) | Correct inaccurate or incomplete data | Your name and birth details are editable in Profile. Or email us. |
| Erasure / "Right to be forgotten" (Art. 17) | Delete your data | Profile → Privacy → Delete my account. Immediate, irreversible, no grace period. |
| Portability (Art. 20) | Get your data in a machine-readable format | The Export feature returns your data as a structured file. |
| Restriction (Art. 18) | Pause processing in certain circumstances (e.g., while a correction is being verified) | Email us. We can flag your account so it does nothing but hold your data. |
| Object (Art. 21) | Object to processing based on legitimate interest | Email us. We will stop the contested processing unless we have compelling legitimate grounds that override your interests. |
| Withdraw consent | Remove the explicit consent given for processing your birth data and other special-category data | Delete your account. We cannot continue the spiritual processing of your data without your consent. |
| Lodge a complaint | Complain to a Data Protection Authority | Romanian DPA: ANSPDCP (dataprotection.ro). Or the DPA in your country of residence if outside Romania. |
We do not make automated decisions that produce legal effects on you (Art. 22). Aura's reflections are personalised, but they do not determine your eligibility for anything, make financial decisions about you, or otherwise produce binding outcomes.
8. Children
Mirror Aura is intended for users aged 16 and over. We do not knowingly collect data from anyone under 16. If you are a parent or guardian and you believe your child under 16 has provided us with personal data, contact us at contact@mirroraura.app and we will delete it.
9. Cookies and similar technologies
The Mirror Aura mobile app does not use marketing cookies, advertising trackers, or third-party analytics. When you use the web version, we use only the essential session storage needed to keep you signed in — no advertising, fingerprinting, or cross-site tracking.
10. Security
We protect your data with industry-standard measures, including:
- ✦Encryption in transit on every connection between your device and our systems.
- ✦Encryption at rest for the data we store.
- ✦Strict access controls, so your data is only ever accessible to you and to the limited internal processes needed to operate the Service — never to other users.
- ✦Carefully managed credentials for the providers we work with, kept separate from our app code.
- ✦Server-enforced account deletion, so a deletion cannot be bypassed.
No system can guarantee absolute security. If a data breach affects your personal data and meets the legal threshold for notification, we will notify you and the relevant DPA within 72 hours of becoming aware, in line with GDPR Articles 33–34.
11. Profiling and automated decision-making
Aura builds a short "persona" of you over time by distilling your conversations and journal entries into brief written summaries (refreshed occasionally, typically at most once a day). This is a form of profiling under GDPR Article 4(4), used purely to make Aura's reflections feel coherent and personalised.
This profiling does not make decisions that produce legal effects on you or similarly significantly affect you (Article 22). You can see the current persona at Profile → What Aura knows about you, and delete it by deleting your account.
12. Marketing communications
We do not send marketing emails. We send only:
- ✦Transactional emails — sign-in links, data-export download links, account-change confirmations, security notices.
- ✦Service updates — if we make material changes to these Terms or this Privacy Policy, we send a single notice email at least 14 days before the change takes effect.
You cannot opt out of transactional emails because they are necessary to operate the Service for you. You can opt out of service-update notices by deleting your account.
13. Links to other services
Mirror Aura may link to external websites (DPA contact pages, app stores, the EU ODR platform, etc.). We are not responsible for the content or privacy practices of those sites.
14. Changes to this Policy
We may update this Privacy Policy. When changes are material we will give at least 14 days' notice in-app and by email before they take effect. The "Last updated" date always reflects the current version.
15. Contact
For any privacy question, complaint, or data-subject request:
- ✦Email: contact@mirroraura.app
- ✦Operator: Better Me SRL
- ✦Supervisory authority (Romania): Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP), dataprotection.ro
Mirror Aura is a sanctuary disguised as an application. We treat your data with the same reverence we ask Aura to treat your words.