PART 1
The app and your account
Effective 30 September 2026
Who is responsible
Aleš Kovačič is the controller of data processed for Mirror State. Contact: ales@aleskovacic.com or +386 51 632 625.
Data we use
- Account: your email address and authentication information when you register or sign in. If you use Sign in with Apple, Apple may share a private relay email address instead of your personal address. Passwords are handled by our authentication provider, Supabase; we do not ask you to send them to us.
- Game progress: your in-game profile name and choices, chapter progress, relationships, resources, votes, and timestamps. A copy is stored on your device and in your account for syncing.
- Technical details: app version and device model/operating system information sent with a cloud save, plus the technical request and authentication logs needed to deliver and secure the service.
- Support: the information you include if you email us.
Day reminders are local notifications on your device. The app does not use advertising or third-party analytics SDKs, and it does not use your data for ad tracking.
Why we use it
We process account, game, and device data to provide sign-in, save and restore progress, generate in-game story continuations, and keep the service secure. The legal basis is performance of the service you request (GDPR Article 6(1)(b)); security and abuse prevention also rely on our legitimate interests (Article 6(1)(f)). We use support messages to respond to your request.
Who processes it
Supabase provides authentication, cloud storage, and server functions for the app. Apple provides Sign in with Apple, system password suggestions, and Passwords storage when you choose to use them. To draft new in-game stories, selected game context such as choices, progress, and fictional character or group details may be sent from our server to OpenAI. We do not send your email address or password in story prompts. Generated text is reviewed before it becomes part of the shared game world. bunny.net serves this website and may process technical web requests to deliver it. Apple also operates TestFlight and handles beta invitations, crash reports, and feedback under its own privacy terms. We do not sell your personal data.
How long we keep it
Your account and cloud progress remain while the account is active. In the app, you can reset progress without deleting your account, or delete the account and its cloud save. We keep support correspondence only as long as needed to resolve the request and any related legal obligations. Provider backups and security logs may remain for their limited retention periods before deletion.
Your choices and rights
You can correct your in-game profile in the app, reset progress, and delete your account in Settings → Progress. To request access, correction, a copy of your data, deletion, restriction, or to object to processing, contact ales@aleskovacic.com. You can also complain to your local data protection authority; in Slovenia, this is the Information Commissioner.
International processing
Our service providers may process technical or account data outside the European Economic Area. Where required, international transfers are governed by applicable transfer safeguards in their service agreements. Contact us for more detail about your data and the providers used for your account.
Changes
We may update this policy as the beta changes. The effective date above shows the latest version. Material changes will be explained in the app or on this page.
PART 2
The mailing list
This page doesn't use cookies, analytics or trackers. The only data we collect is what you type into the sign-up form.
Who we are
Mirror State is developed by Programer, Aleš Kovačič, s.p., Slovenia. Contact: ales@aleskovacic.com.
What we store
- Your email address.
- What you asked for (dispatches, beta testing, launch day) and which devices you'd test on.
- When you signed up, the wording you agreed to, and your browser language.
Why
We first send a confirmation link. Only after you open it do we add you to the list and send the emails you selected. We don't sell your data. The legal basis is your consent (GDPR Art. 6(1)(a)), which you can withdraw at any time.
Where and how long
Unconfirmed requests expire after 24 hours. Confirmed preferences are stored with Supabase in the European Union until you unsubscribe, ask for deletion, or the project ends. Resend sends list emails from its Ireland region; its open and click tracking are disabled. We keep a one-way hash of your IP address for up to 30 days to limit abuse.
Your rights
You can ask to see, correct or delete your data, or withdraw consent, by writing to the address above or using the unsubscribe link in any email. You can also complain to the Slovenian Information Commissioner (Informacijski pooblaščenec).