Your data, visibly.

The policy, in full

The short version

• No analytics, tracking pixels, session recording, fingerprinting or advertising. No social logins.
• The Mirror and the synthetic Twin need no account. Practice history stays in your browser. The synthetic Twin shows a fictional person — no real person’s data.
• A personal Twin needs an account (email and password). It holds only the traces you choose to add, and you can inspect, export and delete every one of them — or the whole account.
• Nothing is inferred about you from data you did not add. Meaning is never inferred from behaviour.
• Remote AI never receives your history just because you are signed in. It is used only when you ask, through the Privacy Aperture.

Using the Mirror without an account

These stay on your device. We cannot see them.

• Inner Sky traces (IndexedDB), only when you choose “Keep locally”: session date and time, weather word, movements visited, guidance mode, whether a Trace or Ground was used, the number of prompts shown, and an optional closing word.
• Fade preferences (IndexedDB), settings (localStorage), an in-progress session (sessionStorage) and offline copies of pages (Cache Storage).

Words you type as a Song reflection are not stored anywhere.

A personal Reflective Twin

Your account

• Your email address and a password hash (scrypt). We do not ask for a name, age or any demographic detail.
• A session cookie (httpOnly, Secure, SameSite=Lax) that keeps you signed in, and a record of your sessions with the browser description, so you can see and end them. IP addresses are not stored with sessions.
• To slow down password guessing, a salted hash of the email address used in failed sign-ins is kept with a counter, and request counts per IP address are kept for up to an hour for rate limiting (they can appear in that night’s encrypted backup).

What you add

• Observations — check-ins, words, sleep intervals, step counts, calendar timing, practice sessions and so on — each with its source, time, the UTC offset where it happened, and a privacy class.
• Derived features and patterns computed from them (for example sleep midpoint, calendar fragmentation, Resonance relationships), with the derivation version and the sources each came from.
• Reflections, context notes, meaning anchors, personal traces and your feedback on patterns.
• Calendars: by default only when events start and end. Titles are kept only if you tick that option for an import; attendees, locations and descriptions are never kept.
• Voice reflections recorded in the Data Studio are measured in your browser; only the duration and three sound signals (pace, pauses, pitch variability) are sent. The audio never leaves your device. If you instead upload an audio file (WAV), the file itself reaches our server, is read for the same signals, and is deleted after processing unless you choose to keep it. Nothing is transcribed.
• Images are kept only if you choose to, and only after location, camera and text metadata have been removed. When that cannot be done safely (for example HEIC photos), the original is not kept at all. No faces or people are identified.

Uploaded files

• Files are encrypted as they arrive (age, X25519, a fresh key per file) and read by a separate worker. You see what was found — and what will not be stored — before anything enters your Twin.
• By default the original file is deleted after processing. You can choose to keep an encrypted original instead; it is deleted with its source.
• Uploads you never confirm are deleted within a day.

Where and how it is stored

• On our server in France (EU), in a database on an application data volume, and encrypted files for anything you keep. Every database query is scoped to your account; other people’s ids behave as if they do not exist.
• Encrypted database backups are taken daily and before each release, kept for 14 days, and can only be decrypted with a key that is not stored on the server. A deleted account disappears from backups as they age out; backups are never selectively restored into use.
• Server logs record import run ids, durations, error types and counts — never file contents, reflections, health observations, patterns or AI context.

Your rights, in the product

• Inspect every observation in Inspect data.
• Remove a source and everything derived from it — observations, features, dependent patterns and retained files.
• Export everything in open formats (CSV, JSON, Markdown) from Account.
• Delete your account: your account, uploaded files, observations, features, patterns, reflections and meaning structures are permanently removed. No shadow profile is kept.

AI

• Patterns are found by transparent statistics on the server, not by a language model.
• No remote model is configured. Reflections are written on our server from the inputs you approve in the Privacy Aperture. Nothing is sent to an AI provider.

Sent to our server when using the site

• Ordinary page requests. The application does not log them, and the reverse proxy keeps no access log for this site; its error log may briefly record the IP address of a request that fails.
• The Gathering, only if you tap “Sit with the Gathering”: a random temporary identifier held in memory for under a minute.

Microphone

The browser asks for microphone access only when you start Breath-trace in the Mirror or record a voice reflection. Sound is analysed in your browser; it is never recorded on our server.

Links to other sites

References link to journals, DOI and PubMed, and the Ground page links to a helpline directory. Those sites have their own privacy practices.

Children

AI for Meaning is intended for adults and is not directed at children.

Contact

A contact address for privacy questions is being set up and will be published here.