Trust & data
What Mirror™ looks at, where it goes, who can see it, and how to remove it. Written for the people deciding whether to bring Mirror to a team.
Every statement here was checked against Mirror’s code or the provider’s own published terms on October 16, 2026. Where we cannot say something yet, we say so.
Coaching belongs to the person
Each person sees their own analyses and scores. Their employer does not see them in Mirror.
The team view shows averages only
Team owners see team-wide averages once at least three other members have data. They never see one person’s results.
Not used to train AI
Anthropic, AssemblyAI and ElevenLabs may not use what Mirror sends them to train their models.
What Mirror looks at
Only what a person chooses to give it:
- Emails or messages they paste in to be analyzed.
- Meeting transcripts they paste or upload, or that come from their own Zoom cloud recordings if they connect Zoom. A transcript includes what the other people in the meeting said.
- Short voice recordings, for spoken reflections and for feedback on how they sound in a practice conversation.
- A few still photos from their webcam, for On-Camera Presence feedback. The photos are not stored.
- Personality or assessment reports they upload as PDFs.
- The profile and organization details they fill in, used to personalize coaching.
- If they connect their own Slack or Microsoft Teams account: messages they send to Mirror there (/mirror or a direct message in Slack, their one-to-one chat with Mirror in Teams) and their replies to Mirror’s weekly coaching note if they turn it on. Messages other people write in those conversations are ignored. Someone without a linked Mirror account is only told how to connect; nothing is sent to the AI.
Mirror saves the analysis it produces: the scores and the coaching, which may quote a few short lines. It does not save the full text of an analyzed email or meeting transcript. What a person writes or records in Mirror’s own tools — spoken reflections (kept as text), practice conversations and their debriefs, goals, uploaded reports — is kept in their account so they can come back to it. From Slack and Teams, Mirror keeps scores and short tips rather than the messages, except replies to the weekly coaching note, kept with that note and cleared 30 days after it was sent.
Mirror is for personal development. It does not make employment decisions, and our Terms (section 9.2) say not to rely on it alone for personnel decisions.
Who can see what
The person using Mirror
- Everything they have put into Mirror, and all of their own results.
Their team owner (Enterprise)
- The team’s average scores, which area is strongest and weakest, and whether the average is rising or falling month on month.
- The most-used feature, the top coaching themes, and a short AI-written summary of those averages.
- How many members used Mirror this week and last week (teams of three or more).
- Who has been invited to the team and whether they have joined.
- Their own scores, to compare against the team.
- Apart from the weekly count, each team figure appears only once at least three members other than the owner have data behind it.
- Any one person’s scores, analyses, emails, messages or transcripts.
- Which members are or are not using Mirror.
- Highest or lowest scores. They are not calculated, because in a small team they point at a person.
- Anything from voice or camera practice.
A coach the person invites or accepts
- Their scores over time, and a progress report only while the person is sharing it, with their name and email address.
- The text of their analyses, emails or transcripts.
- Anything after the person removes the coach, which they can do at any time from Settings.
Mirror administrators at The Unfair AI
- To run the service and answer support requests, a small number of administrators can open one person’s analysis list (the email subject or meeting title, the scores and the headline insight) and their development plans.
- Each time an administrator opens someone’s analyses through Mirror, Mirror records who opened them, what was opened and when. That record cannot be changed, and the person gets it in Download my data (without the administrator’s name).
- Changes an administrator makes to an account are written to an audit log: creating or deleting it, changing its role, or switching on Enterprise.
Your company’s Slack or Microsoft Teams
- Only if a person connects their own Slack or Teams account to Mirror: what Mirror sends them there (answers, scores and, if they turn it on, a weekly coaching note built from their own Mirror results) and what they write back are private messages in your company’s Slack or Teams. Slack or Microsoft keep them under your company’s settings for that tool, like any other private message.
- Anything from Mirror for a person who has not connected Slack or Teams.
Other Mirror users
- Nothing. The database itself refuses to return one person’s records to another account.
If someone leaves your team, their Mirror account and coaching stay theirs, and they drop out of the team figures.
Where data goes
Mirror is run by The Unfair AI LLC. These are the outside services that handle Mirror data, and what each one receives.
Supabase
Database, sign-in, file storage and Mirror’s server code.
Everything Mirror keeps. Stored in the United States (AWS us-west-2, Oregon).
Anthropic (Claude)
The AI that writes the analysis and coaching.
The emails, transcripts, messages and uploaded reports a person asks Mirror to look at, still photos from On-Camera Presence, and the profile details that personalize coaching. From Slack or Teams: the messages described under ‘What Mirror looks at’, and, for a person who turns on the weekly coaching note, a summary of their own recent scores, insights and plan.
AssemblyAI
Turns recorded speech into text.
Voice recordings, and Zoom audio when a meeting has no Zoom transcript. Mirror tells AssemblyAI to delete the audio and the transcript as soon as the text comes back.
ElevenLabs
Reads Mirror’s replies aloud when a person presses listen.
Only the words Mirror wrote (a letter or a reflection reply). Never the person’s own recordings. The audio is kept in that person’s private storage so it can be replayed.
Zoom
Optional. Only for a person who connects their own account.
Mirror receives that person’s own cloud recordings or transcripts. Disconnecting stops Mirror looking at anything new.
Slack and Microsoft Teams
Optional. Only for a person who connects their own account.
Mirror receives the messages described under ‘What Mirror looks at’, and posts its answers, scores and any weekly coaching note to that person privately there, so Slack or Microsoft receive those. Connecting Slack gives Mirror the workspace’s name and ID and the person’s Slack ID; connecting Teams gives the organization’s name and ID and the person’s Microsoft ID, not their mailbox, calendar, other chats or files. Disconnecting stops Mirror looking at anything new from that person and stops the weekly note.
Google and Microsoft sign-in
Optional ways to sign in.
Basic sign-in details only. Signing in this way does not give Mirror access to a mailbox or calendar.
Vercel
Hosts the Mirror website.
Ordinary web requests. Visitor analytics run only if the visitor accepts cookies.
Sentry
Tells us when something breaks.
Error reports, on every visit, without personal identifiers by default. Only for someone who accepts cookies: performance measurements, and a replay of the screen where an error happened, with all text hidden and images blocked.
Rehearsal Studio, another Unfair AI product, receives a situation only when a person chooses “Rehearse it out loud” and confirms. The details are in section 7.6 of our Privacy Policy.
AI training and what providers keep
- Anthropic may not train its models on what Mirror sends it (Commercial Terms, section B). It deletes API inputs and outputs within 30 days, unless they are flagged under its usage policy or the law requires longer (Anthropic’s retention policy). Mirror uses Anthropic’s standard terms; it does not have a zero-retention agreement.
- AssemblyAI gets audio only long enough to turn it into text, and may not use it to train its models. Mirror then tells AssemblyAI to delete the audio and the transcript, whether the transcription worked or not. As a backstop, we’ve set Mirror’s AssemblyAI account to delete anything left within a day.
- ElevenLabs gets only the words Mirror wrote, to read them aloud. We’ve turned off the ElevenLabs setting that would let it use them to improve its models.
- The Unfair AI does not use anyone’s content to train AI models, and does not sell personal information or share it for marketing (Privacy Policy, section 3).
Keeping and deleting data
- A person’s data stays in their account until they delete it. Any single analysis can be deleted at any time.
- Download my data (Settings → Account) gives a person a copy of everything Mirror holds about them, including links to their files.
- Delete account (Settings → Account) removes the account, its records and its stored files, deletes Mirror’s keys to any connected Zoom, Slack or Teams account (Zoom and Slack are also asked to cancel access; Microsoft has no way to do that for Teams), and cancels a paid plan at once. Messages Mirror already posted in Slack or Teams stay there, under your company’s settings for that tool. An owner whose team still has other members can’t delete their account this way; ask us.
- In Slack or Teams, typing “stop” turns the weekly coaching note off. Disconnecting Slack or Teams in Settings → Integrations stops Mirror looking at new messages from that person.
- Shared progress-report links switch themselves off after 30 days.
How long copies stay in our hosting provider’s backups after a deletion: ask us.
Security basics
- Encrypted in transit (HTTPS) and encrypted at rest with AES-256 by our database provider (Supabase security).
- Row-level security: the database itself checks every request, so a signed-in person can read only their own records.
- Two-step sign-in with an authenticator app, which anyone can switch on in Settings → Security & Privacy. Once it is on, the code is asked for at every sign-in, and again before downloading or deleting an account.
- Sign-in tokens for connected Zoom, Slack and Teams accounts are encrypted (AES-256-GCM).
- In the Mirror app, AI features refuse anyone who is not signed in, and in Slack and Teams, anyone who has not linked their Mirror account.
- Mirror accepts a Slack or Teams message only when Slack’s signature or Microsoft’s signed token on it checks out.
- Administrator changes to accounts are recorded in an audit log.
- Every time an administrator opens someone’s analyses through Mirror, it is recorded, and the record cannot be changed.
Where data is stored
Mirror’s database and files are in the United States: Amazon Web Services us-west-2 (Oregon), through Supabase. The providers listed above process data in their own locations. For a particular provider’s region, ask us.
What we don’t have yet
- A SOC 2 report or any other security certification for Mirror itself. (Our database provider, Supabase, holds SOC 2 Type 2; that is theirs, not ours.)
- Single sign-on through your company’s identity provider (SAML). Sign-in is by email, Google or Microsoft.
- A zero-data-retention agreement with our AI providers.
Need a security questionnaire answered or a data processing agreement for your company? Ask us.
Questions?
Email support@theunfairai.com. The legal detail is in Mirror’s Privacy Policy and Terms of Service, and in The Unfair AI’s Suite Privacy Policy and Suite Terms. This page explains them in plain language; it does not change them.