Mirror Path is a personal-development RPG that turns daily growth into a tracked journey — stats, classes, ranks, parties, guilds, journals, goals. To make any of that work we have to store some of your data. This page explains what, why, and what control you have over it.
We wrote this in plain English. If something is unclear, email us — the address is at the bottom.
Who runs Mirror Path: Mirror Path RPG is developed and operated by Steven Cruz as an independent developer (the "we" / "us" in this policy). It is not affiliated with any larger company.
Data Controller: For the purposes of GDPR and similar laws, the developer of Mirror Path acts as the data controller of the personal data described in this policy and decides how that data is processed. Sub-processors are listed in section 4. To exercise your rights as a data subject, see section 10 or contact us using the address in section 17.
You give us this information directly when you sign up and use the app. We do not buy data about you from third parties.
| Category | Examples |
|---|---|
| Account | Email address, password (hashed by Firebase Auth — we never see it), unique user ID |
| Profile | Display name, profile photo, short bio, current Day, Level, XP |
| Stats | The 11 trackable stats (HP, MANA, END, STR, AGI, WIS, COU, SPI, FOC, CHA, WRK, LCK), historical snapshots, and your daily activity log |
| Goals & tasks | Goal titles, task descriptions, durations, daily targets, check-in logs |
| Journal | Journal entries, folders, visualization entries — text you write yourself |
| Health | Optional health-day logs, period tracking, custom potion formulas (these are stored owner-only — see section 7) |
| Social | Party membership, guild membership, party/guild messages, direct messages, duo partners, notes you share with duos |
| Game data | Card collection, gifted cards received, battle records (duels, party battles, card battles), forged-card vault |
| Inner Guide chats | Messages you send to the Inner Guide AI feature (see section 6) |
| Push subscription | If you opt in to notifications, your browser's push subscription token (stored owner-only) |
| Bug reports | If you submit one: your report text, the page you were on, app version, browser user-agent |
| Beta feedback | If you submit a check-in: your responses |
| Tier redemptions | Codes you redeem and the resulting tier/access flags on your account |
What we don't collect:
We use what we collect for these purposes only:
We do not use your data to train Mirror Path-owned AI models, and we do not knowingly permit our AI sub-processors to train on your Inner Guide API inputs or outputs. We do not profile you for advertising or build behavioral marketing audiences.
We do not sell your data. The only parties that touch your data are the service providers ("sub-processors") we use to run the app:
| Provider | What they do |
|---|---|
| Google / Firebase | Authentication, Firestore database, Cloud Functions, Hosting, Storage. Your data lives on Google Cloud infrastructure (US region, us-central1). |
| Anthropic | Powers the Inner Guide AI feature. When you message the Guide, your messages and your Day count are sent to Anthropic's Claude API. Per Anthropic's API terms, they don't train on API inputs. |
| Resend | Delivers transactional emails to the developer (bug reports, account-deletion requests). Your message content is included in those emails. |
Sub-processor safeguards. Each provider above is bound by their own Data Processing Addendum or equivalent contract terms. We rely on the standard contractual safeguards offered by these providers — including the European Commission's Standard Contractual Clauses where applicable — for any data transferred outside your jurisdiction. We do not add new sub-processors lightly; if we add a new one in the future, this section will be updated and a notice posted in the app per section 16.
We may also disclose your information if:
Visible to all authenticated users:
Visible only to members of the same group:
Private by app permissions and security rules. GM accounts are not intended or permitted to access this data through the app:
The Inner Guide is a reflective conversation feature that uses Anthropic's Claude API (model: claude-haiku-4-5). Here's what actually happens when you send a message:
What this means for you: the Inner Guide is good for working through prompts, but it isn't anonymous and it isn't persistent. Don't share things you wouldn't share over an internet API call. If you want a permanent reflective record, use the Journal — those entries stay private to you on Firestore.
If you choose to use the Health, Period, or Custom Potions features, that data is stored in privacy-scoped Firestore subcollections. Access is restricted by system architecture and Firestore security rules so that, in normal operation, only you can read it — GM accounts cannot read it through the app. The developer does not routinely access this data. Direct database access would require deliberate administrative action and would only be used for support, security, legal compliance, or with your permission.
However: this data is still stored on Google Cloud infrastructure and is subject to whatever legal requests Google receives. If you live in a jurisdiction where reproductive-health data carries legal risk, please weigh that before logging period data here.
Mirror Path is not a medical app, is not HIPAA-covered, and is not a substitute for a doctor. Health features are personal trackers, nothing more.
Mirror Path is intended for users 13 and older. We do not knowingly collect data from children under 13.
If you are between 13 and 16 and live in the European Economic Area, the United Kingdom, or another jurisdiction with a higher digital-age-of-consent threshold, please get a parent or guardian's permission before signing up.
If you believe a child under 13 has created an account, email us at admin@mp-update.com and we will delete the account.
We keep your data for as long as your account is active. When you request deletion (see section 11), here's what happens:
Backups are typically purged within 30 days of the deletion request.
You have the following rights regarding your data, regardless of where you live:
If you're in the EU/EEA, UK, or California, you have additional rights under GDPR or CCPA respectively (see section 14).
You can request permanent deletion of your account at any time. The fastest path:
We process deletions within 30 days. Submitting this form sends an email to the developer with your request.
We use Google's Firebase platform for authentication, storage, and hosting. Specifically:
No system is perfectly secure, and we do not represent that ours is. If you discover a vulnerability, please report it privately to admin@mp-update.com rather than posting publicly.
If we discover a security incident that materially affects user data, we will notify affected users and relevant authorities when required by applicable law. Notice will be sent without undue delay — including, where applicable, within GDPR Article 33's 72-hour window for notifying supervisory authorities — and will describe, to the extent then known, the nature of the incident, the categories of data affected, the likely consequences, and the steps we have taken or recommend you take in response.
Push notifications are opt-in. The first time you turn them on, your browser asks for permission. If you grant it, your browser generates a push subscription that is stored at users/{your-uid}/private/profile — readable only by you. The Cloud Function uses that subscription to deliver notifications via the Web Push standard.
You can revoke push permission at any time from your browser settings, or by toggling notifications off inside the app.
Mirror Path uses essential browser storage — including local storage, session storage, IndexedDB, Firebase Auth persistence, and service-worker cache — to keep you signed in, sync app data, support offline behavior, and improve performance. We do not use advertising cookies, tracking pixels, or third-party behavioral analytics cookies.
| What we use | Why |
|---|---|
| Firebase Auth persistence | Keeps you signed in between visits so you don't have to re-enter your password every time. Stored as a token in browser local storage by the Firebase SDK. |
| Local storage | Caches non-sensitive UI preferences (e.g. last-viewed tab, music track choice, beta-checkin completion flag) so the app remembers your layout. |
| Session storage | Holds short-lived state for in-progress flows (e.g. GM-initiated card-give targets) that should not survive a tab close. |
| Service Worker cache | Stores app shell files (HTML, icons, manifest) so the app loads quickly and works offline. Your personal data is never written to the SW cache. |
| Inner Guide conversation buffer | The current Inner Guide conversation is held in browser memory only and discarded when you close or sign out — see section 6. |
Because these technologies are used solely for essential service functionality and not advertising or cross-site tracking, Mirror Path currently does not use a separate marketing-cookie consent banner. You can clear all of this at any time from your browser settings (clearing site data for the Mirror Path domain).
Mirror Path is operated from the United States. Data is stored on Google Cloud servers in the us-central1 region. By using the app, you consent to your data being processed in the United States.
If you are in the EU/EEA or UK: we process your data on the legal basis of (a) contract — to provide the app you signed up for — and (b) legitimate interest, where applicable. You have the rights described in GDPR Articles 15–22, including access, rectification, erasure, restriction, and portability. You also have the right to lodge a complaint with your national data-protection authority.
If you are a California resident: the CCPA/CPRA gives you the right to know, the right to delete, the right to correct, the right to portability, and the right to opt out of "sale" or "sharing" of personal information. We do not sell or share personal information for cross-context behavioral advertising. To exercise any of these rights, email us.
If we make material changes to this policy, we'll update the "Last Updated" date at the top of this page and post a notice in the app. Continued use of the app after the change means you accept the new policy.
Minor wording or formatting changes don't trigger a notice — only changes that affect what we collect, how we use it, or your rights.
Privacy questions, deletion requests, complaints:
We'll respond within 30 days to any verified request.