Privacy policy

Effective date: October 15, 2026

Mirra makes photos of you, from photos of you. That only works if you trust us with your face, so this policy is written to be read: what we collect, how and why, who else receives it, and the promises we make about it.

What we collect

• Selfies you enroll. The 10 to 20 photos of yourself you upload so Mirra can put your face into the photos it makes for you.
• Photos you generate. The reference images you share in and the results Mirra creates for you.
• Account identifiers. When you use Sign in with Apple or Sign in with Google, we receive a stable account identifier and, if you choose to share it, your email address and name. We also keep the dates you agreed to the consent screen, confirmed you are 13 or older, and last signed in.
• Purchase state. Your plan, credit balance, and transaction identifiers, so your purchases follow your account. We never see or store card numbers.
• Minimal analytics events. Small usage signals such as "generation started" or "paywall viewed", used only to understand which parts of the app work well. They never contain your photos.
• Reports and links. The text you write if you report a photo, and the links you share or paste into Mirra so it can find the image you picked.
• Notification token. If you allow notifications, a device token so we can tell you when a photo is ready. Deleting your account removes it.

How we collect it. All of it comes from you, through the app or this website: the photos you upload and the links you share or paste, the details Apple or Google pass to us when you sign in with them, purchase records from Apple (or from Stripe, for purchases on this website), and the usage events the app sends while you use it. We do not buy data about you or collect it from anywhere else.

Why we collect it

Solely to run the service and generate your own images. Your selfies exist so the app can put your face into the looks you pick, your account identifier exists so your photos and credits belong to you, and your purchase state exists so you get what you paid for. Your photos are also screened automatically so the service stays safe, your notification token lets us tell you when a photo is ready, and analytics events show us which parts of the app work well. There is no other use.

The promises

• Your photos are never used for advertising.
• Your photos are never used to train models. Not ours, not anyone's.
• Generation is restricted to your own enrolled face. Mirra will not create images of anyone else for you, and will not create images of you for anyone else.
• We never sell your data, and we run no advertising or tracking scripts on this site or in the app.

Who receives your data

We share personal data only with the companies below, only for the job described next to each one. Nobody else receives your personal data from us unless the law requires it.

OpenAI: image generation and safety checks

Mirra's image generation and safety checks are powered by OpenAI. Before any photo is sent, the app's consent screen explains this and asks your permission.

• What is sent. Your selfies, the reference photos you choose, and the photos Mirra makes from them. Only the images and Mirra's fixed instructions for making a photo are sent. Your name, email address, and account details are never sent.
• How it is sent. From our servers, over an encrypted connection, never straight from your phone. A selfie or reference photo is sent for an automated safety check when you upload it. When you create a photo, your selfies and the reference you picked are sent to OpenAI's image service, which makes the new photo. Each finished photo gets the same safety check before you see it.
• Why. Only to create the photos you ask for and to keep the service safe, for example by blocking explicit or graphic images and photos of more than one person. Nothing else.
• How long it is kept. OpenAI keeps what it receives for up to 30 days, only to monitor for abuse, and then deletes it. Deleting a photo or your account in Mirra removes it from our servers right away, and any copy at OpenAI is deleted within those 30 days.
• No training. OpenAI does not use your selfies, your reference photos, or the photos Mirra makes to train its models.
• Equal protection. OpenAI processes this data as our service provider. It is contractually bound to use the data only on our instructions, to keep it confidential and secure, and to protect it with the same or equal protection that this policy gives it.

Other companies that help run Mirra

• Hetzner (hosting). Our servers are rented from Hetzner Online. They store your account, your selfies, your photos, and our backups. Hetzner stores this data on our behalf as our hosting provider and may not use it for anything else.
• Apple (sign-in, purchases, notifications). If you use Sign in with Apple, Apple gives us a stable account identifier and, if you choose, your name and email address. Apple processes App Store purchases and tells us which plan or pack you bought. If you allow notifications, we send Apple your device token and the notification text so it can deliver them. Apple handles this under its own privacy policy.
• Google (sign-in). If you use Sign in with Google, Google gives us a stable account identifier and, if you choose to share them, your email address and name. Google handles sign-in under its own privacy policy.
• Stripe (purchases on this website only). If you buy a plan on this website, Stripe collects your card details directly and processes the payment. We send Stripe your Mirra account identifier, the plan you picked and, if we have it, your email address, and Stripe tells us whether the payment went through.

How long we keep your photos

Your selfies, the photos Mirra makes for you, and the pictures you share in as inspiration are stored on our servers so the app can show your gallery and make new photos for you. They are used only to make your photos and to run automated safety checks on them, and they are kept only while your account is in use:

• Deleting a selfie in the app removes it from our servers right away.
• Deleting a photo Mirra made removes that photo from our servers right away. The picture you shared in to make it stays in your account until you delete your account.
• Deleting your account removes all of them right away. The Deletion section below lists everything it removes.
• After 3 years without use. If your account has no sign-in and no new photo for 3 years, we automatically delete your selfies, the photos Mirra made for you, and the pictures you shared in. Your account and any credits stay, so you can come back and enroll again.

The copies sent to OpenAI to make and check your photos are kept by OpenAI for up to 30 days, only to detect abuse, and are then deleted. OpenAI processes them only on our instructions and does not use them to train models.

Facial images

Your selfies show your face, so they get extra care.

• Your permission comes first. Before any photo leaves your phone, Mirra shows a consent screen that explains what is sent and who receives it, and asks your permission to send your selfies and chosen photos to OpenAI to create your images. Nothing is uploaded until you agree. Your photos, and the facial features in them, are used for that purpose only.
• No face templates. Mirra does not create, store, or share face templates or faceprints. Your selfies are kept as ordinary photos and are used only to make your photos and to run the safety check when you upload them.
• The face check stays on your phone. When you pick selfies, the app checks each one on your phone. It only confirms that one face is in the photo and that the face is large enough to work with. A photo is uploaded only when you tap Upload, and the result of the check itself never leaves your phone.
• Never sold, never shared for anything else. Your photos are never sold, never used for advertising, and never used to train models. They go only to OpenAI, which makes your photos and runs the safety checks on our instructions, as described in Who receives your data above.
• Deleted on a schedule. Your selfies are deleted when you delete them, when you delete your account, or after 3 years without use, whichever comes first.

Deletion

Delete Account in the app removes your data immediately: every selfie, every photo Mirra made for you, every picture you shared in, your account record, your reports, the records of safety checks on your uploads, your device tokens, and your analytics events. There is no grace period and no soft delete. Apart from routine server logs, which never contain photos, we keep only records that are no longer linked to your account: past purchase records (transaction numbers and dates), which we need for accounting and so a purchase is never counted twice, and invite code tallies, so the person who invited you keeps the credits they earned. If you cannot reach the app, email support@mirraai.app from your account address and we will do it for you.

We also keep one scrambled code made from the account you signed in with, together with whether that account had used its free photo or an invite code, and the date. The code is made with a one-way function: it cannot be turned back into your account identifier, and it contains no email, no name, and no photo. It exists only so the free photo and invite rewards are given once per person: if you later sign up again with the same account, the new account starts without them.

To protect against data loss, we keep backup copies of our database and of stored photos on our own server. They are replaced every night: photo backups are deleted after at most 3 days and database backups are deleted after 7 days, so anything you delete is gone from every backup within 7 days.

Payments

In-app purchases are processed by Apple under Apple's own terms. Purchases made on this website are processed by Stripe, which collects your card details directly. In both cases, card numbers never reach our servers and are never stored by us.

Children

Mirra is for people aged 13 and over. We do not knowingly collect photos or data from anyone younger. If you believe a child under 13 has an account, contact us and we will delete it.

Changes

If this policy changes, we will update this page and the effective date above. A change will never quietly weaken the promises in this policy; anything material will be called out in the app.

Contact

Questions, requests, or concerns: support@mirraai.app.