Privacy Policy

PRIVACY POLICY
Last updated: October 2026

Reality Mirror is a personal journaling tool. Here is exactly what we do with your data.

WHAT WE STORE
Your email address, the daily entries you write (morning declarations and evening confirmations), timestamps, and your day count. Nothing else.

ZERO-KNOWLEDGE ENCRYPTION
Every journal entry is encrypted inside your browser before it is uploaded. The encryption key is derived from your password and is never sent to our servers. Not us, not Google, not anyone with access to the Firebase admin console can read your entries. When you sign up you receive a 12-word recovery phrase — this is the only second key that can unlock your journal if you forget your password. If you lose both your password and your phrase, the journal is permanently unrecoverable. This is intentional.

WHERE IT LIVES
Encrypted data is stored in Google Firebase (Firestore), hosted in the United States. Only ciphertext reaches the server.

THE AI FEEDBACK
When you save an entry, your browser decrypts the text locally and sends the plaintext to Azure AI Foundry (Microsoft Azure, EU region) to generate the Tufti and Mirror responses. The text is processed in real time and is not stored by Microsoft for model training under our terms of agreement. Our request proxy sets Cache-Control: no-store and does not log request or response bodies. The returned reflection is re-encrypted before being stored.

WHAT WE NEVER DO
We do not sell your data. We do not share your journal with any third party except the two infrastructure providers listed above (Google Firebase, Microsoft Azure). We do not run advertising. We do not track you across other websites.

ANALYTICS
On the public pages only (the home page, the guides, About, and the policy pages), we use Google Analytics to count visits and see which pages people read, and only if you choose "Accept" in the cookie notice. If you choose "No thanks", or make no choice, nothing from Google Analytics loads. Analytics never runs inside your notebook, on the sign-in pages, or while you are signed in. It receives no journal content and no account details. Google signals and ad personalisation are switched off. You can change your choice at any time with "Cookie settings" at the bottom of every public page.

We do not run an error-tracking service. Error information, if any, appears only in Netlify server logs (function invocations, HTTP status codes) and is not linked to your identity.

YOUR RIGHTS
You can delete your account and all associated data at any time from the Settings screen inside the app. The deletion is immediate and permanent. If you are in the EU or UK, you have the right to request a copy of your data before deletion — contact us at the address below.

CONTACT
For any privacy questions, write to us through the contact page at https://transurfingnavigator.com/contact