Privacy Policy

1. Data We Collect from Creators

• Email address: for authentication and notifications
• Name (optional): for display purposes
• Payment information: processed by Stripe; we store only the payment method type and last four digits
• Usage data: cycle creation, link management, export activity (for audit logging)

2. Data We Collect from Respondents

• Feedback content: encrypted at rest in our database
• IP hash: a SHA-256 one-way hash with an application-level salt, used solely for abuse prevention and never shown to anyone
• Encrypted IP log: a copy of the submitting IP address, encrypted at rest, kept for 30 days solely so we can comply with valid legal process (for example, a court order about threats). It is never used for product features, never shown to Creators, and is automatically purged
• Device check hash: a one-way hash computed in your browser from coarse device characteristics (screen size, platform, timezone), used only to enforce one response per person per cycle. It cannot identify you, and it is never shown to Creators
• Content hash: a one-way hash of your response text, used only to detect duplicate submissions within a cycle
• Session cookie: feedback pages set one strictly necessary, anonymous session cookie for security (form protection, optional access codes, and rate limiting). It contains no identity, is not used for tracking, and expires after 2 hours

3. What We Explicitly DO NOT Do to Respondents

The abuse-prevention data described in section 2 exists so one person cannot flood a cycle with fake responses. None of it can be used, by us or by Creators, to work out who wrote a given response.

4. How We Handle IP Addresses

Feedback submissions never store your IP address in readable form. Two things exist:

• A one-way hash (SHA-256 with an application-level salt) attached to the submission, used only for abuse detection. It is not reversible, never visible to Creators, and deleted 30 days after the feedback cycle ends.
• An encrypted log entry kept separately for 30 days after submission, decryptable only by the application. Its sole purpose is compliance with valid legal process. It is never used by any product feature and is purged automatically.

5. Encryption

All feedback content is encrypted at rest using Laravel's encryption (AES-256-CBC). Even in the event of a database breach, feedback content would not be readable without the application's encryption key.

6. Third-Party Services

• Stripe: payment processing for Creators (see Stripe's Privacy Policy)
• Resend: email delivery
• OpenAI and Anthropic: every submission is checked by AI content moderation before the Creator can see it. The text of your response is processed transiently by these providers under API terms that do not permit its use for model training. No identifying information accompanies it, because we do not have any
• Cloudflare: network infrastructure and denial-of-service protection in front of the site
• Bunny Fonts: privacy-focused, GDPR-compliant font delivery (no logging of personal data)

We never sell or share feedback content or respondent data with any third party for marketing or any purpose other than the processing described above.

6b. Moderation and Limited Administrative Access

Feedback is visible in the Creator's private dashboard. In addition, strictly limited SideMirror administrative access exists for safety: content rejected or flagged by AI moderation, and submissions a Creator reports, can be reviewed by our administrator to handle abuse, threats, or appeals. This access is used only for safety and abuse review, never for curiosity or marketing.

7. Data Retention

• Creator accounts: retained until account deletion
• Feedback content: retained as long as the Creator's account is active
• IP hashes and device check hashes: deleted 30 days after the feedback cycle ends
• Abuse signals: deleted 30 days after the feedback cycle ends
• Encrypted IP log: purged 30 days after submission
• Magic links: deleted 1 hour after expiry

8. Your Rights

Creators can: export all feedback data (CSV), delete their account and all associated data, and request information about stored data.

9. GDPR Compliance (European Users)

If you are located in the European Economic Area (EEA), you have the following rights under the General Data Protection Regulation:

• Right of access: Request a copy of all personal data we hold about you
• Right to rectification: Request correction of inaccurate personal data
• Right to erasure: Request deletion of your personal data ("right to be forgotten")
• Right to data portability: Receive your data in a machine-readable format (CSV export)
• Right to restrict processing: Request that we limit how we use your data
• Right to object: Object to processing of your personal data

Our legal basis for processing Creator data is contractual necessity (providing the service you signed up for). For Respondent IP hashes, our legal basis is legitimate interest (abuse prevention).

To exercise any of these rights, email [email protected]. We will respond within 30 days.

10. CCPA Compliance (California Users)

If you are a California resident, the California Consumer Privacy Act grants you the following rights:

• Right to know: What personal information we collect, use, and share
• Right to delete: Request deletion of your personal information
• Right to opt-out: We do not sell personal information to third parties
• Right to non-discrimination: We will not treat you differently for exercising your rights

We do not sell, rent, or share personal information with third parties for their marketing purposes.

11. Contact

For privacy questions or data requests: [email protected]