Website Privacy Policy

1. In Short

This website has no account and no sign-up form. The only page that asks you to type in anything about yourself is the gift claim page, which asks for an email address so that the MirrorMii app's service can keep your gift for it (Section 9).

Analytics start only after you answer our cookie question. "OK" allows analytics cookies; with "No thanks" we count only the pages you open, without cookies (Section 4). You can change your answer at any time.

We do not sell information about visitors, and we do not use it for advertising.

Records from the email sign-up and the wellness check-in that earlier versions of this website had were deleted by October 27, 2026. Section 8 has the details.

2. Who We Are and What This Policy Covers

This website is run by Miia Labs Ltd., a company incorporated in British Columbia, Canada.

This policy covers the pages at mirrormii.ai, including the blog. It does not cover the MirrorMii app (see its own documents, linked above), the App Store or Google Play, other sites at mirrormii.ai subdomains such as the Genii quiz (empathize.mirrormii.ai), which has its own privacy policy, or other websites we link to.

The terms for using this website are on a separate page: mirrormii.ai/terms.

3. What Reaches Us When You Visit

Hosting. This website is hosted by Amazon Web Services (AWS): Amazon CloudFront delivers the pages from storage in Amazon S3. As with any website, each request your browser makes carries your IP address, the address of the page asked for, the page that linked to it, your browser and device type (the "user-agent"), and any cookies set for this website (Section 5). AWS uses this to deliver the pages and to keep the service running safely.

Pages built in advance. Our pages, blog posts included, are built before they are published and served as ready-made files, so reading a post does not contact our content system. A post's images load from a separate media address, blog-media.genomii.ai, which is also hosted on AWS; those requests carry your IP address and browser details in the same way.

Fonts. The site's fonts are served from this website, not from a font service.

4. Analytics and Your Cookie Choice

Analytics across this website. Until you answer the question "OK to use analytics cookies?", this website sets no analytics cookies, does not load Google Analytics, and sends nothing to PostHog. On the home page, what you do before you answer is held in the open page and sent only if you choose "OK"; if you choose "No thanks" or leave without answering, none of it is sent.

If you choose "OK", it loads Google Analytics (a Google service) and PostHog (a product analytics service, used here through its US cloud), which set their own cookies to measure how the site is used. These cookies hold a random ID, so the two services can recognize your browser when you come back.

If you choose "No thanks", Google Analytics is not loaded, and Google Analytics cookies left by an earlier "OK" are removed. PostHog counts only the pages you open, without cookies and without an identifier stored on your device, and is sent no other measurements. It receives your IP address and browser type with each request, as any web service does, and may use them to tell one visit from another.

Your browser remembers your answer for a year, after which we ask again. You can change it at any time with "Cookie choices" in the site footer, which this page has too. The pages that only send you on to an app store or to the Genii quiz, and the pages that show the app's documents, run no analytics and do not ask the question.

The gift claim page (Section 9) asks the question too, but it does not load Google Analytics, and it uses PostHog only after "OK", without cookies, for the few things Section 9 lists. A "No thanks" given there stops PostHog on that page at once; the cookies and stored data that Google Analytics and PostHog set after an earlier "OK" are removed when you next open another page of this website that runs analytics.

What we measure after "OK": which pages are opened and for how long; how far down a page you scroll, and which parts of the home page you reach and use (for example, which questions you open); which buttons and links you press, including the download buttons; where on a page you click, tap or move the pointer; clicks and taps that get no response, with the part of the page they landed on and the words shown there; how quickly the home page loads and responds, with your connection speed and a rough device memory size; and your answer to the cookie question. Along with these we record general facts about the visit: device type (and model, where your browser reports it), operating system, browser and its user-agent, language and time zone, screen size, whether you are using an app's built-in browser, whether your device is set to reduce motion, your approximate location (such as country or city) worked out from your IP address, and where you came from (the page that linked you here, or the campaign tags, such as utm_source, in the link you followed). After "No thanks", PostHog receives only the page views, each with general facts like those above.

PostHog receives your IP address, and may keep it with these records, depending on the settings of our account with it.

What we do not measure: we do not record your screen or what you type, and we do not link any of this to your name or email address. The only public page with fields to type into is the gift claim page, and what you type there is not sent to Google or PostHog.

Addresses are trimmed. Before analytics start, the website removes from the page address every parameter it does not use itself, such as an email address or an advertising click ID that a link may carry. Google Analytics and PostHog then receive page addresses with campaign tags only.

How long and where. Google Analytics and PostHog keep data about individual visits for the retention periods we have set in our accounts with them; Google Analytics' summary reports, which do not single out visitors, are not covered by those periods. Google and PostHog may process it outside your country, including in the United States.

No advertising. This website uses no advertising cookies or advertising pixels, and we do not use analytics data for advertising.

5. What Is Stored on Your Device

Your cookie answer. When you answer, the website stores your answer and the time you gave it in your browser's local storage (under the name mm_consent_v1). We use it for a year, then ask again. "Cookie choices" deletes it and asks you again.

After "OK". Google Analytics sets the cookies _ga and _ga_ followed by an ID, which last up to two years from your last visit. PostHog sets a cookie that lasts up to a year from your last visit and keeps related data in your browser's storage (names starting with ph_ or __ph_). The website keeps the campaign tags of your visit in your browser's session storage (mm_attr_v1), which your browser clears when you close the tab. The analytics cookies are set for mirrormii.ai and its subdomains, so your browser also sends them to other sites at mirrormii.ai addresses, such as the Genii quiz.

After "No thanks". The website keeps your answer (and your motion setting, if you set one), and PostHog keeps a note of your "No thanks" in local storage so that it remembers your choice. Cookies and stored data that Google Analytics and PostHog set after an earlier "OK" are removed. After a "No thanks" on the gift claim page, PostHog's note and this removal wait until you next open another page of this website that runs analytics (Section 4).

The motion switch. If you use the "Reduce motion" switch on the home page, your browser keeps that setting in its local storage (mm_motion), whatever your cookie answer.

The gift claim page. The gift claim page keeps nothing you enter on your device, neither the code nor your email address, and its analytics keep nothing there either (Section 9). Your cookie answer is kept as on every page.

Apart from the analytics cookies above, which are set only after "OK", no cookies are set on this website. You can also block or delete cookies and site data in your browser settings; if you do, we ask the cookie question again on your next visit.

6. Download Buttons, Links and Embedded Content

Download buttons. Our download buttons take you to Apple's App Store or Google Play, where Apple's or Google's own privacy policy applies. Across this website, our store links also tell the store that you came from mirrormii.ai and which button you pressed, together with any campaign tags in the link that brought you here (for Google Play, inside its "referrer" field); outside the home page, our App Store links carry none of this. This is part of the link itself, so it happens whatever your cookie answer; we add nothing that identifies you.

QR codes. On a computer, the QR codes on our pages take your phone to the store (the home page's code goes through mirrormii.ai/get). On the way they pass on only the campaign tags of your visit, inside Google Play's "referrer" field, and nothing else.

The Genii quiz. Our link to the Genii quiz goes through mirrormii.ai/genii to the quiz's own site (empathize.mirrormii.ai), which has its own privacy policy. On the way it passes on only the campaign tags of your visit, which link you used, and a marker saying that you came from mirrormii.ai. If you chose "OK", this website's analytics cookies also reach that site (Section 5).

Other links and share buttons. Links to Instagram and other sites are ordinary links, and the share buttons on blog posts open Facebook, X or LinkedIn in a new window with the post's address and title filled in. None of these services loads anything on our pages: they get nothing from this website unless you follow a link or press a share button, and then their own policies apply.

Embedded content. If a page shows content embedded from another service, such as a presentation from Canva, opening that page loads it from that service, under its own policy.

7. When You Email Us

If you write to us, for example at privacy@mirrormii.ai or contact@mirrormii.ai, we use your email address and what you write to reply, and we keep the conversation for as long as we need it to deal with your message and any follow-up.

8. Records From Earlier Sign-ups

Earlier versions of this website had an email sign-up form and, from July to September 2026, a wellness questionnaire called the check-in. This website stopped taking sign-ups and check-in answers in September 2026, and those forms are gone.

They collected email addresses, and for the check-in also the answers given (including questions about mood, stress, how supported people felt and how secure they felt about covering their basic needs, and anything written in the free-text questions), which edition of the terms was agreed to, the time of submission, the IP address and the browser user-agent. The download guide that followed the check-in recorded which buttons were pressed and when, with the IP address and browser user-agent. Copies were held in our database on AWS, in Omnisend (the email service the sign-up used, which also recorded the IP address and browser user-agent at sign-up) and at a separate profile service we used then to set each person's starting point.

We deleted these records from our database on October 27, 2026. We deleted the contacts in Omnisend, and the copies of these records exported from our database, by October 27, 2026. The profile service deleted its copy on October 22, 2026. Each of these deletions was made before this version of the policy was published. Copies in our database backups expire within 35 days of October 27, 2026, and the profile service's backups clear within 15 days of October 22, 2026.

Some of these records were collected under earlier versions of this policy that named Genomii Lab Ltd. as the company.

9. Claiming a Gift With an Event Code

The gift claim page. MirrorMii cards handed out at events carry a code (an "event code"), which you can enter with an email address on this website's gift claim page to claim a gift for the MirrorMii app. We run the claim service behind that page on behalf of Genomii Lab Ltd., the company that provides the MirrorMii app. Genomii Lab Ltd. is responsible for the codes and for the records of claims and gifts, and the app's Privacy Policy (mirrormii.ai/app-privacy-policy) applies to them. The claim service runs on Amazon Web Services in the United States.

What the page sends. When you enter a code, the page sends it to the claim service to be checked, and if it can be claimed, the page shows its gift. The claim service chooses the gift for each code and needs nothing more from you to do so. When you confirm your email address, the page sends it to the claim service too. With these go the result of a human check (below) and random numbers that the page and the claim service make for your visit and your claim; like any request, they also carry your IP address. The page keeps none of this on your device (Section 5).

The human check. To keep out automated programs, the page uses Cloudflare Turnstile. As soon as you start entering a code, or follow a link that fills one in, the page loads Cloudflare's script into the page, and the script runs the check in a frame from Cloudflare. Cloudflare receives your IP address and information about your browser and device. The check asks you to do something only when it needs to. The claim service then sends Cloudflare the check's result and your IP address to confirm it.

Your email address. We use your email address only to have your gift kept for it in the MirrorMii app and to check that each person gets one gift per event, and we share it only with the MirrorMii app's service, for your claim. To have your gift kept, the claim service sends that service your email address, the event and the gift. The app's service keeps the gift for your email address until it is collected, which is done by signing up or signing in to the MirrorMii app with that email address and verifying it.

What the claim service keeps. It does not keep your email address or your IP address. It keeps the codes in hashed form, a record of each claim (such as the event, the result and when) and, for each event, a hash of each email address a gift was sent to, or may have been sent to when a claim's result never became known, so that each email address gets one gift per event. While a claim is going through, it also keeps that hash with the claim, so that two claims cannot use one email address at the same time and an unfinished claim can be finished with the same email address. To limit how many requests and wrong codes come from one place, it keeps hashes of IP addresses, and for each claim it keeps a hash of the IP address, to look into misuse. These hashes are made with secret keys.

How long. The codes, the records of claims and the hashes of email addresses a gift was sent to are deleted 12 months after claiming closes for the event, apart from counts. The hash kept with a claim while it is going through is deleted when the claim is finished, and within 30 days at most. A claim whose result is still not known 29 days after it was made is closed, its code used up and its result unknown; its hash is then kept with those of email addresses a gift was sent to, and deleted with them. Hashes of IP addresses are deleted within a day when they are kept to limit requests, and within 30 days when they are kept for a claim. Copies in our database backups expire within 35 days of a deletion.

Logs. The claim service's logs are deleted within 30 days. They leave out your IP address, the code and your email address, and they are set to mask anything that looks like an email address or a code.

Analytics on this page. Google Analytics is not loaded on the gift claim page. PostHog is used there only after "OK", and is then told only that the page was opened, the result of each code check (for example, that a code was not found), that a claim was made and for which event, and that "Get the app" was opened and which app store button was pressed, each with general facts about the visit like those in Section 4. It is not sent the code, your email address or anything else you type, it sets no cookie, and it keeps nothing on your device. With no answer, or with "No thanks", the page does not start PostHog at all.

10. Who Receives Information

Amazon Web Services, which hosts this website and the claim service (Section 9).

Google (Google Analytics) and PostHog, for the analytics in Section 4, only as your cookie choice allows.

The provider of our email service, for the messages you send us.

Cloudflare, for the human check on the gift claim page (Section 9).

Genomii Lab Ltd. and the MirrorMii app's service, for the gifts claimed on the gift claim page (Section 9).

Apple, Google and the Genii quiz site, for what Section 6 describes, when you follow our links to them.

Authorities, where the law requires us to disclose information.

A buyer or successor, if our business or this website changes hands, who must protect the information as this policy does.

We do not sell information about you.

11. Your Choices and Rights

Analytics. Use "Cookie choices" to change your answer, or block cookies and site data in your browser. Because analytics data is not tied to your name or email address, we usually cannot pick out one visitor's data; your cookie choice is the way to control it. Google also offers a browser add-on that turns Google Analytics off.

Emails you send us. You can ask us for a copy of our correspondence with you, or ask us to correct or delete it. Write to privacy@mirrormii.ai. We answer within 30 days.

Gift claims. The rights set out in the app's Privacy Policy apply to the records of a gift claim (Section 9). If you write to us about a claim, include the reference number the gift claim page showed you, and do not send your full code.

Complaints. You can complain to the privacy regulator where you live, such as the Office of the Privacy Commissioner of Canada or the Office of the Information and Privacy Commissioner for British Columbia, at any time; you do not have to contact us first. Depending on where you live, you may have further rights; tell us which one you want to use and we will apply it as the law there requires.

12. Children

This website is for a general audience. Apart from the email address the gift claim page asks for (Section 9), it does not ask anyone for personal details. Who may use the MirrorMii app, and from what age, is set out in the app's own documents.

13. Security

This website is served over HTTPS, and plain HTTP requests are sent on to HTTPS. No way of sending or storing information is free of risk, but we work to protect what we hold.

14. Changes to This Policy

When we change this policy, we update the effective date at the top. When a change affects how we handle your information, we also put a short summary of what changed at the top of this page. You can ask us for an earlier version at privacy@mirrormii.ai.

15. Contact

For questions, requests or complaints about this policy or your information: privacy@mirrormii.ai or contact@mirrormii.ai. Miia Labs Ltd., Vancouver, British Columbia, Canada.