Privacy Policy

Last updated: November 7, 2026.

This policy explains, plainly, what data O poder do espelho collects, why it collects it, who it shares it with, and what you can do about it. It covers the app and everything running on our server.

O poder do espelho is operated from Brazil and is the controller of this data under the Brazilian General Data Protection Law (Law 13.709/2018). The contact channel is at the bottom of this page.

What we collect

When you create your account

• Name and email: they identify you and are how we reach you.
• Password: stored only as an irreversible scrambled fingerprint (Argon2id). Not even we can read your password.
• Chosen language: sets the language of the app and its content.

When you use the app

• Your goals: name, description, target date, your biggest win, your biggest challenge, and the time ranges when you want to be reminded.
• Your phrases: the affirmations you practice, written by you or generated from your goal.
• Your photos: the images you attach to a goal.
• Your practice: when you practiced, for how long, and how many phrases — this is what becomes points, level, and streak.
• Your practice preferences: seconds per phrase, image opacity and interval, chosen music, and volume.

Automatically, so the app works

• A device label and the session: they keep you signed in and let you end one specific session.
• IP address: used in two ways. To block brute-force attacks we keep a failed sign-in attempt for at most 15 minutes, and it is erased as soon as it leaves that window. And it is recorded at three moments that must be provable: when the account is created, when the password is reset, and when the account is deleted.
• Technical logs: errors and server calls. The text of your phrases, your password, your email, and your tokens are stripped from these logs before they are written.

To grant your access

• Email and subscription status: this is what tells us whether your email has access to the app.

What we do NOT collect

• We do not record camera images or video. During practice, the front camera acts as a mirror: the image appears on your device's screen and is never sent, recorded, or stored anywhere. It exists while the screen is open and is gone when you leave.
• We do not record audio. The app does not ask for microphone access.
• We do not access your location, your calendar, your contacts, or any photo in your gallery other than the one you choose to upload.
• We use no advertising trackers, and we do not sell or rent your data.

Why we use each thing

To keep your account and your access we use your name, email, password, and session. To make the app work — goals, phrases, practice, points — we use what you create inside it. To grant your access we use your email and your subscription status. To send the password reset link we use your email. All of this is what the law calls performance of the contract: without this data, the app does not work.

To block break-in attempts we use the IP address, and to understand how the product is used we use counts that identify no one. Those two rest on legitimate interest, and you may object at any time through the contact at the bottom of this page.

Who we share with

We share the minimum necessary, and only with those who make the app work. This is the entire list.

Artificial intelligence provider (OpenRouter)

When you ask to generate the phrases for your goal, we send the text you wrote in that goal — the name, the description, your biggest win, your biggest challenge, and the target date — to a language model provider, which returns the finished phrases.

That text can be deeply personal, which is why we say so here in plain words instead of burying it under a generic line about "service providers". We do not send your name or your email along with it — the provider receives the goal text and nothing that says whose it is.

If you would rather this did not happen, write your phrases by hand instead of asking for them to be generated. The app works the same, and in that case no text of yours goes to the artificial intelligence.

Voice provider (ElevenLabs)

To narrate, we send the text of your phrases to the speech synthesis service, which returns the audio. Only the phrase text goes, with no name, no email, and nothing tying the phrase back to you.

Email delivery service (Resend)

When you request a password reset, your email address is handed to the service that sends the message.

Our server

The application, the database, your photos, and the audio of your phrases live on a server we rent and administer.

Beyond these, no one else receives your data.

Data that leaves Brazil

Some of the services above are operated by companies outside the country. In practice: your goal text crosses the border when you ask for phrases to be generated, your phrase text crosses when you ask for narration, and your email address crosses when you ask for a password reset.

Brazilian law permits this transfer when it is necessary to perform the contract with you, which is exactly the case here. We choose providers bound by confidentiality, and we send the minimum: never your name, never your email alongside your text.

How long we keep it

• For as long as your account exists: name, email, goals, phrases, photos, practice, and preferences.
• Failed sign-in attempts: 15 minutes at most.
• Audit trail: preserved for integrity. It records what our team did in the admin panel and the three account moments listed above — not what you did inside the app.

Deleting your account

You delete your account from the app itself, under Profile → Delete my account. We ask for your password and one confirmation, because it cannot be undone.

The moment you confirm:

• your goals are deleted from the database, along with the description, biggest win, and biggest challenge you wrote;
• your phrases are deleted;
• your photos and the audio of your phrases are marked for removal and leave storage on the next sweep, within 7 days at most;
• your practice preferences are deleted;
• every session of yours is dropped, on every device;
• your name is replaced by a generic marker, your email is replaced by an address that does not exist and cannot receive mail, and your password stops working forever.

What remains, and why:

• The numbers from your practice — how many times, how many minutes, how many points. They stay attached to an identifier that from then on leads to no person at all; this is what the law calls anonymized data, and it is what lets us know whether the product is being used without knowing by whom.
• The audit trail, recording that the deletion happened.

If you would rather we did this for you, just ask through the contact at the bottom of this page.

Your rights

The law gives you the right to:

• know whether we process data about you, and what it is;
• correct data that is incomplete or wrong;
• request a copy of your data;
• request that it be erased;
• know who we share it with;
• withdraw consent where consent is the basis for processing;
• object to processing you consider improper.

To exercise any of these, write to the contact at the bottom of this page. We answer within 15 days.

Minimum age

O poder do espelho is for people 18 and over. We do not knowingly collect data from children or teenagers. If we find that an account belongs to a minor, it is closed and the data erased. If you are a parent or guardian and believe this happened, tell us.

Security

• Everything the app and the server say to each other is encrypted (HTTPS).
• Passwords are stored scrambled with Argon2id, never as text.
• The keys of the services we use are stored encrypted in the database (AES-256-GCM).
• The database separates data by person, and it is the database itself that enforces this, not just the application: one account cannot reach another account's rows even if the application asks.
• Your photos and audio are served through short-lived signed links, valid for one hour and tied to your account.
• The metadata in the photos you upload — including the location cameras sometimes record alongside them — is discarded on the server before the image is stored.

No system is impenetrable. If an incident happens that could put you at risk, we will tell you and the Brazilian data protection authority, as the law requires.

Changes to this policy

If it changes in any meaningful way, we will tell you in the app before the change takes effect, and the date at the top will be updated.

Questions about this page or about your data: [email protected]

O poder do espelho