Privacy Policy

Mirrage is run by Mirrage ("we", "us"). For the purposes of UK and EU data protection law (the UK GDPR, the Data Protection Act 2018 and the EU GDPR), we are the controller of the personal data described here. You can reach us about anything in this policy at support@mirrage.app.

When you buy a subscription

Checkout is handled by Stripe. Stripe collects your email address, payment details and billing address or country (used for tax). Your full card number goes straight to Stripe and never touches our servers. From Stripe we receive and store:

• your email address;
• your Stripe customer ID and subscription ID;
• your plan, subscription status and the date your current period ends.

Your licence

When your payment completes we create a licence key (for example GM-XXXXX-…) and store it with the details above and the date it was created.

When you activate Mirrage on an iPhone

Each iPhone you activate is added to your licence with:

• a device identifier - a random ID Apple gives to Mirrage on that iPhone. It can't be used to identify the phone in other apps and can't be linked to your Apple ID;
• the device name iOS reports to apps (on current iOS versions this is usually just "iPhone"), so you can tell your devices apart on your account page;
• the date it was activated.

The app checks your licence with our billing service about twice a day, and when you open your account screen. Those checks send only your licence (the key, or a signed token issued for it) and the device identifier.

Technical information

Like any web service, our servers receive your IP address with each request. Our billing service stores it, together with a counter, for about 10 minutes to stop people guessing licence keys or flooding checkout. Our hosting provider, Cloudflare, may also process IP addresses and request details for security and to keep the service running, as described in their own privacy policy.

When you contact us

If you email us, we keep the email and anything you choose to include so we can help you.

What we do not collect

• Your real location, or the locations you set in Mirrage.
• Your contacts, photos, messages or browsing history.
• Analytics, advertising identifiers or any tracking across other apps and websites.
• Your Apple ID or Apple ID password (see section 5).

These are stored only on your iPhone or computer, and are never sent to us:

• the locations you teleport to, journeys, routes, GPX files, saved places and your settings;
• the pairing file that lets Mirrage talk to your iPhone's developer services. Mirrage Setup creates it on your computer and copies it straight into the app over your cable;
• your Apple ID details, if you choose to let Mirrage refresh itself.

To work, the app talks directly (not through us) to a few outside services. Each one receives the information it needs and your IP address:

• Apple - map search, place names and driving or walking directions (Apple Maps), and the developer files iOS needs to allow location simulation.
• OpenStreetMap's Overpass API - when you plan a journey, the area around your route, to look up speed limits. It does not receive your real location.

While Mirrage runs in the background it may ask iOS for location access purely to keep itself running. That location is not stored or sent anywhere.

Apps that aren't from the App Store must be signed with an Apple ID, and apps signed with a free Apple ID stop working after 7 days unless they're signed again. So Mirrage Setup, and optionally the Mirrage app, sign in to Apple with your own Apple ID.

• Your password is sent only to Apple, using Apple's own secure sign-in protocol. We never receive it.
• Mirrage Setup keeps it in memory only while it runs. It is never written to your computer's disk.
• If you tick "Keep Mirrage working", Setup copies your Apple ID over the cable into the app, which stores it in the iPhone's Keychain (Apple's encrypted credential store) and deletes the copied file. You can remove it any time in Settings → App refresh → Apple ID → Forget Apple ID.
• Apple's sign-in requires extra device information called "anisette data". Mirrage requests this from an anisette server (by default ani.stikstore.app, run by a third party). That server sees your IP address and that a sign-in is happening, but it does not receive your Apple ID password.
• Apple will see that your Apple ID created a development certificate and registered your iPhone, as it does for any app developer. Apple's handling of that is covered by Apple's privacy policy.

We don't use your data for advertising, profiling or automated decisions that have legal or similarly significant effects on you. We don't send marketing emails.

We never sell your personal data, and we don't share it for advertising. We only share it with service providers that help run Mirrage, each bound by its own data protection terms:

• Stripe - payments, subscriptions, invoices and the billing portal. Stripe's privacy policy.
• Cloudflare - hosts our billing service and stores licence records. Cloudflare's privacy policy.
• Our website and download hosting provider, which receives standard request information such as your IP address.

The app and Setup also connect directly to Apple, OpenStreetMap's Overpass API and the anisette server, as described in sections 4 and 5. We don't send them anything about you.

We may disclose information if the law requires it, to protect the rights, safety or property of our customers or others, or as part of a sale or reorganisation of the business, in which case this policy will continue to apply to your data.

Stripe and Cloudflare may process data in the United States and other countries outside the UK and EEA. Where they do, the transfer is protected by the safeguards the law requires, such as the UK International Data Transfer Addendum, the EU Standard Contractual Clauses, or the UK-US and EU-US Data Privacy Framework.

• Licence and device records: while your subscription is active, and for up to 12 months after it ends so you can come back to the same key. Ask us and we'll delete it sooner.
• Removed devices are deleted from your licence straight away.
• Payment and tax records are kept by Stripe and by us for as long as tax law requires (usually 6 years in the UK).
• IP addresses used for rate limiting are deleted automatically after about 10 minutes.
• Support emails: up to 2 years after our last conversation.
• Data on your devices stays until you delete it or remove the app.

• Everything sent between Mirrage, our servers and Stripe is encrypted with HTTPS.
• Card details are handled only by Stripe, which is certified to PCI DSS Level 1.
• Licence keys are generated randomly with about 100 bits of randomness, so they can't realistically be guessed, and our billing service limits how many attempts can be made.
• The app and website only ever see your licence, never your Stripe customer details.
• Our server credentials are stored as encrypted secrets, not in our code.
• Your Apple ID is held in the iPhone Keychain and your pairing file never leaves your own devices.

No system is perfectly secure. If we learn of a breach that affects your personal data, we'll tell you and the regulator when the law requires it.

Depending on where you live, you have the right to:

• get a copy of the personal data we hold about you;
• have inaccurate data corrected;
• have your data deleted;
• restrict or object to how we use it, including where we rely on legitimate interests;
• receive your data in a portable format;
• withdraw consent where we rely on it.

Email support@mirrage.app from the address you bought with, or include your licence key, and we'll respond within one month. You can see and remove your devices, and manage or cancel your subscription, yourself at any time on your account page or in the app under Settings → Account.

If you're unhappy with how we've handled your data, please tell us first. You also have the right to complain to the Information Commissioner's Office (ICO) or your local data protection authority.

California residents

We don't sell or "share" personal information as those terms are defined by the California Consumer Privacy Act, and we don't use sensitive personal information to infer anything about you. You can ask to know, correct or delete your personal information using the contact details above, and we won't treat you differently for doing so.

The website doesn't use cookies for analytics or advertising. It uses your browser's local storage for two things only, both of which stay in your browser:

• remembering your licence key on the account page, so you don't have to type it again (sign out to remove it);
• remembering that you've downloaded Mirrage Setup, so the setup checklist shows the right step.

When you check out or manage your subscription, you're taken to pages run by Stripe, which sets its own cookies needed for payments and fraud prevention.

Mirrage is not for children. You must be 18 or older to buy a subscription, and we don't knowingly collect data from anyone under 16. If you think a child has given us personal data, contact us and we'll delete it.

If we change this policy, we'll update the date at the top. If a change materially affects how we use your data, we'll tell you by email or in the app before it takes effect.

Questions, requests or complaints about privacy: support@mirrage.app. See also our Terms of Service.