Informativa sulla privacy

1. What this policy covers

This Privacy Policy explains how Vexil LLC processes information for MirrorBox, including the website, mobile app, public profile pages, and support interactions. It does not cover third-party sign-in providers or websites linked from user content.

MirrorBox is a product of Vexil LLC, a New Mexico limited liability company (Business ID 0008061085), 1209 Mountain Road Pl NE, Ste R, Albuquerque, NM 87110, United States. Vexil LLC is responsible for the information described here. Full company details are at vexil.io/legal.

2. Information you provide

• Account details: your sign-in provider identifier, email address, display name, handle, and profile settings.
• Profile and content: your bio, theme choices, avatar or banner, tags, submissions, replies, reports, reactions, and moderation requests.
• Age confirmation: when you create a page we ask for your birth month and year to check that you meet our minimum age. We keep the date you confirmed it and the month you turn 18 (so we can keep teen walls off adult sites), not your birth date.
• Your wall: the drawings, text, stickers, photos, and live blocks you put on your wall, its settings (such as whether other websites may show it), and how many times it was viewed on MirrorBox and on other sites each day. Photos on a wall are uploaded to MirrorBox and may be reviewed before they are shown.
• Linked sites: when you link your MirrorBox account to another website, which site you linked, the permissions you approved, when, and anything that site sends us with your permission, such as what you are reading for the “Now reading” block.
• Developers: if you register a partner app, the details you send when applying, including a contact email that we use to tell you about our review.
• Support messages: information you include when you ask for help or report a safety issue.

3. Information collected automatically

We collect service events such as profile views, device or platform information, timestamps, authentication events, and basic diagnostic data needed to secure and operate MirrorBox. We may receive a push-notification token if you enable notifications. To warn you about sign-ins from new devices, we keep a list of the devices you've signed in from (a name such as "Chrome on Mac", and when it was first and last used) and include the device, time and IP address of a new sign-in in the email we send you. We do not use message content to build advertising profiles.

• Product analytics: which pages and screens you open and which features you use (for example, that a card was sent or a reply was published), with your account identifier, device type, app version, language, and approximate location derived from your IP address. We use AnyAnalytics for this. Analytics never include the text of messages or replies, your name, email address, or handle.
• Purchases: if you buy MirrorBox+, the app store tells us (through RevenueCat, which manages subscriptions for us) which plan you have, when it renews or ends, whether it's a trial, and which store it came from. We use your account identifier to link the purchase to your account. We never receive your card or bank details; Apple or Google handle payment.
• Error reports: when the app or website crashes or an error occurs, technical details such as the error, the screen or request involved, device and operating system, app version, and your account identifier. Error reports exclude message text, cookies, and request bodies.

4. How we use information

• provide profiles, messaging, authentication, notifications, and other requested features;
• show cards you choose to publish and keep private cards private;
• prevent spam, fraud, abuse, unauthorized access, and service attacks;
• respond to support requests, enforce our terms, and resolve disputes;
• email you about your account: a welcome when you join, sign-ins from new devices, websites you link, changes to your account's status, and confirmation when you delete it. If you're 18 or older we may also send optional emails: a monthly recap, a reminder when messages have been waiting (only the number, never what they say or who sent them), when your wall is approved, and occasional news and tips. You can turn each one off in the app under Settings → Email or with the unsubscribe link in the email. Account and security emails, including when content you posted is removed, can't be turned off while you have an account. We keep a sent email, including your address, for up to 30 days, and a list of addresses that our email provider reports as not existing so we stop sending to them;
• send you occasional questions from MirrorBox when your inbox is quiet, always labelled as coming from MirrorBox rather than from another person;
• measure reliability, understand how features are used, and improve the product; and
• comply with legal obligations or protect people and the service.

5. When information is shared

Public profile information, your published wall, and cards you publish are visible to people who can access the page. If you allow it, your wall can also be shown on other websites that MirrorBox has approved. When you link your account to another website, that site receives a random identifier that is different for every site, your name, @handle, profile photo, and wall, depending on the permissions you approve. It never receives your email address, password, or messages, and you can unlink it at any time in Connected sites, which stops it from showing your wall. Linked sites are responsible for how they use what they receive. We share information with vendors that provide hosting, authentication, storage, notifications, subscription management (RevenueCat), product analytics, error monitoring, and security services only as needed to provide MirrorBox. We may share information when required by law, to protect rights and safety, or as part of a merger, financing, or transfer of the service. We do not sell personal information.

6. Retention and deletion

We keep information while your account is active and for as long as needed for the purposes described above. You can delete or unpublish eligible profile content in the app. Some records may remain for a limited period in backups, fraud-prevention logs, moderation records, or where required by law. Contact us to request account deletion or ask what information we hold.

7. Your choices and rights

Depending on where you live, you may have rights to access, correct, export, delete, restrict, or object to processing of your personal information. You can also control notification preferences, turn off questions from MirrorBox, and choose your profile's public visibility in the product. We may need to verify requests to protect accounts from unauthorized access.

8. Security

We use access controls, authenticated requests, and operational safeguards designed to protect information. No internet service is completely secure, so please use a strong sign-in method and report suspected account compromise promptly.

9. Children and international use

You must be at least 13 years old, or older if your location requires it, to create a MirrorBox page, and we ask for your age before you can. If we learn that someone under the minimum age created an account, we delete it. If you believe a child provided information, contact us so we can investigate. Information may be processed in countries where our service providers operate, subject to applicable safeguards.

10. Updates and contact

We may update this policy as MirrorBox changes. The current effective date appears above. Email the privacy contact ([email protected]) with questions or requests, or write to [email protected] with “MirrorBox” in the subject.