Privacy Policy

1. Information we collect

When you leave a message

We collect the message you submit, the name you choose to provide, if any, your email address, your notification preferences, and the date and time of your submission.

Your email address is not displayed publicly with your message.

When you create an account

We collect your email address and information needed to provide and secure your account. Your password is handled by our authentication provider and is not visible to us in plain text.

If you create an account using an email address that you previously used to leave messages, eligible previous messages may be associated with your account after your email address has been verified.

When you use the website

Our service providers may process technical information necessary to operate, secure and deliver the website, such as your IP address, browser or device information, request logs and similar technical data.

If we introduce analytics, advertising or other technologies that require additional notice or consent, we will update this policy and provide appropriate choices before using them where required.

2. How we use your information

We use information to operate On The Mirror, receive and moderate submissions, select messages for the mirror, publish selected messages, provide accounts and message history, prevent abuse, maintain security, respond to requests, and send emails you have requested.

We may also use limited information where reasonably necessary to maintain, protect and improve the service.

3. Our lawful bases

Where UK or European data protection law applies, we process personal data under one or more appropriate lawful bases.

We rely on contractual necessity where processing is required to provide an account or service you request, legitimate interests where reasonably necessary to operate, secure and protect On The Mirror and its community, and consent where you make an optional choice such as subscribing to particular emails.

Where we rely on consent, you may withdraw it at any time.

4. Messages and publication

Messages submitted to On The Mirror enter our moderation process. Submitting a message does not guarantee that it will be approved or published.

Approved messages may be randomly selected to appear publicly on the mirror. A selected message may have a permanent public page so that it can continue to be accessed through its original link.

Please do not include personal information about yourself or another person in the text of a message that you would not want to become public.

5. Accounts and account deletion

Accounts are optional. You can leave a message without creating one.

If you delete your account, we remove the account and detach messages associated with it. Private account information associated with those messages, including the stored email address, is removed.

Messages themselves may remain on On The Mirror after account deletion. This includes messages awaiting moderation, approved messages that may later be selected, and messages that have already been published.

Once messages have been detached through account deletion, creating another account using the same email address will not reconnect those messages to the new account.

6. Emails

We may send essential emails relating to your account, such as email verification, security or password reset messages.

We will only send optional emails, such as daily On The Mirror messages or notifications that your message has appeared, where you have requested them.

You can change applicable email preferences through your account or use the unsubscribe option provided in marketing or subscription emails.

7. Sponsored content and marketing

On The Mirror may contain sponsored content or partnerships in the future. Sponsored content will not influence which community message is selected for the mirror.

We do not currently provide personal information to sponsors for their own direct marketing.

If our use of personal information changes in connection with sponsorship, advertising or marketing, we will update this Privacy Policy and provide any notices, consent choices or opt out mechanisms required by applicable law before beginning that processing.

8. Who processes your information

We use trusted service providers to operate On The Mirror. These may include providers of website hosting, databases, authentication, email delivery, security and related infrastructure.

These providers may process personal information on our behalf where necessary to provide their services.

Our current core infrastructure includes Supabase for database and authentication services and Vercel for website hosting and delivery. We expect to use a specialist email delivery provider when email features launch.

We do not sell personal information.

9. International data transfers

On The Mirror is based in the United Kingdom but is available internationally, and some of our service providers may process information in other countries.

Where data protection law requires safeguards for an international transfer of personal information, we will use an appropriate legal mechanism or other recognised safeguard.

10. How long we keep information

We keep personal information only for as long as reasonably necessary for the purposes described in this policy, including operating the service, maintaining security, complying with legal obligations and resolving disputes.

Account information is retained while an account remains active and is removed or anonymised as described above when an account is deleted, subject to information we may be required to retain by law or for legitimate security purposes.

Submitted messages may be retained indefinitely as part of On The Mirror, including after the associated account has been deleted. Where an account is deleted, retained messages are detached from the account as described above.

Technical and security records may be retained for shorter periods determined by operational and security requirements and the policies of our service providers.

11. Your privacy rights

Depending on where you live, you may have rights concerning your personal information. These may include rights to access information we hold about you, correct inaccurate information, request deletion, restrict or object to certain processing, receive a portable copy of certain information, and withdraw consent.

Some rights depend on the law that applies and the reason we process the information, so they may not apply in every circumstance.

We will not discriminate against you for exercising privacy rights available to you under applicable law.

12. Children

On The Mirror is designed to be accessible to everyone.

If you are a child or young person, the privacy laws where you live may affect whether you can provide certain personal information or create an account without the involvement of a parent or guardian.

We aim to collect only the information necessary to provide On The Mirror and do not knowingly use children's personal information for profiling or targeted advertising.

If you are a parent or guardian and believe a child has provided personal information in a way that raises a privacy concern, please contact us.

13. Security

We use reasonable technical and organisational measures intended to protect personal information. No internet service can guarantee absolute security.

14. Changes to this policy

On The Mirror will continue to evolve. We may update this Privacy Policy when our service, technology or legal obligations change.

If a change materially affects how we use personal information, we will provide additional notice where required before the new processing begins.

The latest version will always be available on this page, with its most recent update date.

15. Contact and complaints

If you have a question about this Privacy Policy, want to exercise a privacy right, or have a concern about how your information is handled, contact:

me@charliecourtenay.co.uk

On The Mirror is based in the United Kingdom.

If UK data protection law applies, you also have the right to raise a concern with the UK's Information Commissioner's Office. If you live elsewhere, you may also have the right to contact the relevant privacy or data protection authority where you live.