Privacy Policy

The short version

• The camera, microphone and location are used on your phone only. Auto mode analyzes the scene on the device; frames are never sent to us to choose a setting.
• Your photos and videos are saved to your phone's photo library. We only receive a photo if you publish it as a sample in Discover.
• An account is optional for shooting. If you create one, we store what is needed to sign you in, sync your presets and run Discover.
• We don't sell your personal data, we don't show ads, and we don't track you across other companies' apps or websites.
• You can delete your account in the app or on the web. It is hidden at once and permanently purged after 7 days.

Who we are

Eff Mirrors (the iPhone and Android apps, the Discover gallery and this website) is operated by Eff Mirrors [legal entity name],[Street address], [City], [Postal code], [Country] ("we", "us"). We are the controller of the personal data described in this policy. You can reach us about privacy at privacy@effmirrors.app.

What stays on your phone

• Camera and microphone. Used to show the viewfinder and record photos, video and sound. The live feed is processed on the device.
• Scene detection. Auto mode recognizes portraits, night scenes, food and more with on-device models. Nothing is sent to our servers for analysis.
• Location. Only used if you turn on geotagging, which is off by default. The location is written into the photo file on your phone.
• Photo library. Photos and videos you take are saved to your library. We don't upload your library, and the app has no way to import photos from it into Discover.

You can change camera, microphone, location and photo access at any time in your phone's settings.

What we collect

We only receive the following when you use features that need our servers.

Account

• An account ID we create, and the subject identifier from the sign-in method you choose (Sign in with Apple, Google, a passkey or an email link).
• Your email address, if you or your sign-in provider give it to us. With Sign in with Apple you can share a private relay address instead.
• Your handle and display name.

Presets

• Presets you save to your account (up to 5 presets you create) and their versions, so they sync across your devices.
• Share links you create for a preset.

Capture verification

• When you shoot with a preset, the app keeps a capture record so samples and reviews can be verified: file hashes, the device model, the preset ID and version, and the time of capture. We receive this metadata when it is needed to verify a sample or a review, not the photo itself.
• Photos you choose to publish as samples in Discover. Before upload, the app strips GPS and other sensitive EXIF data and resizes the image.

Devices

• Device registration and attestation keys. To prove that a sample was shot in Eff Mirrors on a genuine device, the app uses Apple App Attest on iPhone and Google Play Integrity on Android. Apple and Google process the attestation under their own privacy policies.
• Anonymous device capability reports (for example, which formats a camera supports), only if you opt in. They are not linked to your account.

Discover and community

• Presets you publish to Discover (listings), their samples and descriptions.
• Reviews you write. Only people who got a preset and shot with it can review it.
• Reports you send and accounts you block.

Requests sent to us

• Messages you send to support, account deletion requests made on the web (email address and an optional note), and copyright notices or counter-notices (name, contact details, the work concerned and the statements and signature the law requires).

Diagnostics

• The app does not send crash reports or diagnostics today. If we add them, we will update this policy before they are turned on.

Why we use it and our legal bases

Where the GDPR or a similar law applies, we rely on these legal bases:

We don't use your data for advertising, and we don't make decisions about you based solely on automated processing that have legal or similarly significant effects.

What other people can see

Your handle, display name, and anything you publish to Discover (listings, samples and reviews) are public. Anyone with a share link you create can open that preset. Presets you keep in your account and don't share stay private.

Sharing and service providers

We don't sell your personal data and we don't share it for targeted advertising. We share it only with:

• Service providers that host and run Eff Mirrors for us, under contracts that limit them to our instructions (listed below).
• Apple and Google, when you use their sign-in or when the app requests device attestation.
• Authorities or other parties when the law requires it, or to protect the rights, safety and security of our users and the public.
• A successor, if Eff Mirrors is ever merged or sold. This policy would continue to apply to your data.

Our backend runs on our own servers with a MongoDB database and S3-compatible object storage. Our service providers are:

How long we keep it

Deleting your account

Delete your account in the app under Settings → Account → Delete account, or request it with theweb form. Your account is hidden immediately and your listings are removed from Discover. Your personal data is permanently purged after 7 days, and backups that still contain it age out within 7 days after that. Photos in your phone's library are not affected. See exactly what is deleted and kept.

Your rights

Depending on where you live, you have the right to:

• access the personal data we hold about you and get a copy in a portable format;
• correct data that is wrong;
• delete your data;
• object to, or ask us to restrict, processing based on our legitimate interests;
• withdraw consent at any time, without affecting processing before you withdrew it;
• complain to your local data protection authority.

Email privacy@effmirrors.app from the address linked to your account. We may need to verify that the account is yours, and we reply within one month. We will not treat you differently for using these rights.

Security

Connections to our servers are encrypted, sign-in uses Apple, Google, passkeys or one-time email links instead of passwords, and access to production systems is limited to the people who run the service. No system is perfectly secure, so if you think your account has been misused, contact us right away.

International transfers

Our providers may process data outside your country. When personal data from the European Economic Area, the UK or Switzerland is transferred to a country without an adequacy decision, we use safeguards such as the European Commission's Standard Contractual Clauses.

Children

Eff Mirrors is not directed at children under 13, and you must be at least 13 (or the minimum age of digital consent in your country, if higher) to create an account. We don't knowingly collect personal data from children under that age. If you believe a child has given us personal data, email privacy@effmirrors.app and we will delete it.

This website

This website doesn't use cookies, analytics or third-party scripts. Our hosting provider processes standard request data such as IP addresses to deliver and protect the site. Data you enter in the forms on this site is sent to our API only to handle that request.

Changes to this policy

When we change this policy we update the effective date at the top. If a change is significant, we will tell you in the app or by email before it takes effect.

Contact