Privacy Notice

Last updated October 20, 2026

Spiralflows LLC runs Spiral Mirror and is the data controller for the personal data described here. That means we decide why and how it is used.

What we collect and why

• Account details: your email address and sign-in information (including from Google if you use it). Used to create your account and keep it secure. Legal basis: providing the service (contract).
• What you write: your question, optional feeling and the current reflection. Sent to our server and an AI provider to generate your response. We don't save your reflections to your account. The current session is kept only in your browser tab until you clear it or close the tab. Legal basis: contract.
• Usage and access: how many free reflections you've used and whether you have an active subscription. Used to provide your plan. Legal basis: contract.
• Marketing (only if you opt in): your email, so we can send updates and offers, and the broad theme of each new reflection (for example "work" or "relationships"), never your actual words. Used to understand interest and send relevant offers. Legal basis: consent. You can turn this off anytime in the app, which also deletes your saved themes.
• Technical data: basic information such as IP address, device and browser details, and error logs, kept by our hosting providers. Used for security, fraud prevention and keeping the service working. Legal basis: legitimate interests.

Payment details are collected and handled by Paddle, not by us.

Who we share it with

• Service providers that host and run the app, including our database, hosting and AI providers.
• Paddle.com, our Merchant of Record, for selling the product, managing subscriptions, payments, tax and invoicing.
• Professional advisers, such as lawyers and accountants, when needed.
• Authorities, where required by law.

We do not sell your personal data.

How long we keep it

We keep account, usage and subscription data while your account is active and as long as needed for legal, tax and accounting duties. Marketing data is kept until you opt out. When data is no longer needed, we delete it or anonymise it.

Your rights

Depending on where you live, you may have the right to access, correct, delete or export your data, to object to or restrict its use, and to withdraw consent at any time. You may also complain to your local data protection authority. If you are in the UK or EEA, we will respond within one month. Some of our providers process data outside your country. Where required, they use safeguards such as standard contractual clauses.

Security

We use appropriate technical and organisational measures, such as encrypted connections and access controls, to protect your data.

Cookies and browser storage

We use only essential browser storage: to keep you signed in and to recover your current session in this tab. We don't use advertising cookies.

Contact

For privacy requests, contact Spiralflows LLC by email at jl@spiralflows.org. For billing questions, visit paddle.net.