Magic Mirror Privacy Policy

Effective date: October 15, 2026

This Privacy Policy explains how Project Magic Mirror, Inc. ("Magic Mirror," "we," "us") collects, uses, shares and retains personal information when you use the Magic Mirror mobile app, our website at projectmagicmirror.com, and the SkinCheck Expert Portal (together, the "Services").

Magic Mirror is a cosmetic and wellness app. It helps you track the appearance of your skin over time. It does not diagnose, treat, cure or prevent any disease or medical condition.

The Services are offered only in the United States, to people who are 18 or older.

In summary:

• We analyze the face photos you take in the app to describe your skin's appearance, including skin type, tone, perceived age and scores for skin concerns ("scan results").
• You decide whether to share a report with a skincare professional, and you can revoke that access.
• You can delete your data and your account.

What we don't do

• We do not sell your personal information.
• We do not use your health-related information for advertising.
• We do not use your face photos or facial geometry to identify you or to recognize faces.
• We do not use your identifiable information to train AI models without your consent.
• We do not use your photos or videos in our marketing without your separate, specific permission.
• We do not publish information about you individually. We publish only aggregated figures drawn from groups large enough that no individual can be identified. You may choose to share your own information, for example through SkinCheck or a ProofReel video.

1. Information we collect

Information you provide

• Account information: your name, email address and login credentials, or the account identifier we receive if you use Sign in with Apple or Sign in with Google.
• Date of birth, to confirm that you are 18 or older.
• Face photos that you take with the app's camera.
• Routine information: the products and treatments you use, why you use them, and any photos of product packaging you submit.
• Efficacy check-ins: your answers when the app asks whether a product was effective for you.
• Journal entries and Amber conversations: what you tell Amber, our AI assistant, about your skin and related matters, and Amber's responses. These may include health-related information that you choose to share.
• SkinCheck requests: the questions and other information you include when you share a report with an Expert.
• Communications you send us, such as support requests.

Information we generate from your data

• Scan results: skin type, skin tone, perceived age, eye age and scores for skin concerns, derived from your face photos.
• Summaries and trends of your scan results over time, and your Personal Skincare Efficacy Score.
• ProofReel videos, which we generate only at your request.

Information collected automatically

• Time zone: your device's time zone. We use it to send notifications at the right local time, and we display it in your notification settings. We do not request access to your device's location.
• Technical and crash data: device model, operating system, app version, crash logs and error data. We collect it through a crash-reporting service. The camera component supplied by the Skin Analysis Provider (see Section 2) also sends technical usage and error data, which never includes images, to that provider.
• We do not use advertising identifiers or advertising SDKs. We do not track you across apps or websites owned by other companies.

Information about Experts

If you are an esthetician or dermatologist (an "Expert") who registers on the SkinCheck Expert Portal, we collect your name, email address, professional details and account information. We also collect what you create in SkinCheck, including your comments, edits, recommendations and product links, and we show it to the user who shared the report. If you are billed through the portal, we also collect billing information.

2. How we analyze your face photos

By creating an account and accepting our Terms of Service and this Privacy Policy, you consent to the collection and analysis of your face photos as described in this Section.

• Capture. The app's camera uses a component supplied by our skin-analysis provider (the "Skin Analysis Provider"), currently HautAI OÜ, based in Estonia. The component computes a face mesh on your device to position the photo. The face mesh is held only in your device's memory and is discarded when the capture session ends. It is not stored on your device. It is not sent to us, to the Skin Analysis Provider or to anyone else.
• Analysis. Your photos are sent to the Skin Analysis Provider, which analyzes them on our behalf. It processes them in the European Union, currently on Google Cloud Platform in Belgium. It returns processed images and scan results to us, and we store them in the United States.
• Facial landmarks. To locate areas of skin, the Skin Analysis Provider computes facial landmarks. We do not receive them.
• Deletion by the Skin Analysis Provider. The Skin Analysis Provider deletes your photos, the facial landmarks and its analysis results within one hour after analysis. We keep our copies of the processed images and scan results as described in Section 5.
• No identification. We do not use your photos, the face mesh or facial landmarks to identify you or to recognize faces.
• No training. Your photos are not used to train the Skin Analysis Provider's AI models. Its terms permit that use only with your explicit consent. We do not request that consent, and it has confirmed that the use is not enabled for our account.
• What scan results are. The Skin Analysis Provider's AI models analyze visible features of your skin in your photos and generate the scan results. Scan results describe appearance only. They are not a medical assessment or diagnosis.

3. How we use information

We use personal information to:

• Provide the Services: run scans, show your scan results and trends, analyze the ingredients in your Routine, track whether products worked for you, generate ProofReel videos, and deliver SkinCheck reports to the Experts you choose.
• Personalize Amber: Amber uses your scan history, Routine, Journal entries and past conversations as context, so its responses reflect your history.
• Operate our business: manage accounts, provide support, send service messages, prevent fraud and abuse, keep the Services secure, and fix errors.
• Improve the Services, such as by fixing errors and understanding how features are used.
• Comply with law and enforce our Terms of Service.

AI training. We do not use your identifiable information to train AI models without your consent.

Aggregated insights. We may publish de-identified, aggregated insights, such as the share of users with a given skin tone who rated a product effective. We publish only figures drawn from groups large enough that no individual can be identified.

No advertising use. We do not use your face photos, scan results, Journal entries, Amber conversations or other health-related information for advertising.

4. How we share information

We do not sell your personal information. We do not share it for cross-context behavioral advertising.

Service providers. We share information with providers that process it on our behalf, under contracts that limit their use of it.

Our AI model provider does not use information sent through its API to train its models by default. We configure our AI routing service so that it does not log prompts and routes requests only to providers that do not retain them. We may change our service providers from time to time. The table above lists our current providers, and we update it when they change. Any new provider will be bound by contract to use your information only to provide services to us.

To look up ingredients for products not in our database, we may consult brands' public websites. We send no personal information to those websites.

Experts you choose. If you share a SkinCheck report, the Expert you select can view it through a link on our platform. The report may include your photos, scan results, Routine and the questions you ask the Expert. Images are retrieved from our servers; we do not send them by email or text. You can revoke the Expert's access at any time. Experts are independent of Magic Mirror. Information an Expert records or keeps is subject to the Expert's own practices and obligations.

Product links. If a report contains a product link and you click it, the retailer or affiliate network receives the click. We do not pass any report content with it.

Content you share. You decide whether to save or post a ProofReel video. Once you share it, the recipient's or platform's terms apply.

Other disclosures. We may disclose information to comply with law or legal process; to protect the rights, safety or property of Magic Mirror, our users or others; in connection with a merger, financing, acquisition or sale of assets, subject to this Policy; or with your consent.

5. Retention and deletion

We keep personal information only as long as we need it for the purposes described in this Policy.

Deleting your account. When you delete your account, we delete your personal information from our systems. The Skin Analysis Provider will already have deleted your photos and its analysis results within one hour of each scan. We also revoke the Sign in with Apple token if you used it. Copies in our backups are restricted and are deleted when those backups expire, within five weeks.

We may keep information longer where the law requires it, or to resolve disputes and enforce our agreements. We may also delete accounts that breach our Terms of Service, or that we reasonably believe are automated or fake.

6. Your choices and rights

You may ask us to:

• give you access to, or a copy of, your personal information;
• correct inaccurate information;
• delete your information or your account;
• withdraw a consent you have given.

You can delete photos, entries and your account in the app. For other requests, email compliance@projectmagicmirror.com. We will verify your identity before acting on a request. If we deny your request, you may appeal by replying to our decision; we will respond to the appeal in writing. We will not discriminate against you for exercising your rights.

You can also choose not to use Amber or SkinCheck, and you can revoke an Expert's access to a report at any time.

Consumer health data. Some state laws, including in Washington, Nevada and Connecticut, give you specific rights over consumer health data. In this Policy, that means information that identifies you and relates to your physical health, which may include face photos, scan results, Routine information, Journal entries and Amber conversations.

• We collect it from you and generate it from what you provide, for the purposes in Section 3.
• We collect it with your consent, which you give when you accept our Terms of Service and this Privacy Policy. We share it only as described in Section 4 or with your consent.
• We do not sell it.
• You may confirm whether we hold it, access it, ask us to delete it, withdraw consent, and see a list of the third parties with which we share it, by emailing compliance@projectmagicmirror.com.

Facial geometry. The face mesh is computed on your device. It is not stored, and it does not leave your device. The Skin Analysis Provider computes facial landmarks during analysis and deletes them, with your photos and its analysis results, within one hour after analysis. We do not receive or store facial landmarks. You consent to this processing when you accept our Terms of Service and this Privacy Policy.

7. Security

We use administrative, technical and physical safeguards designed to protect personal information, including encryption in transit and at rest, and access controls. No system is completely secure. If a breach affects your information, we will notify you as required by law.

8. Where we process information

We store information in the United States. Our Skin Analysis Provider analyzes face photos in the European Union. Some of our service providers may process information in other countries, under contracts that require them to protect it.

9. Age requirement

The Services are for people 18 or older. The app asks for your date of birth and does not allow anyone under 18 to continue. If we learn that we have collected information from someone under 18, we will delete it.

10. Changes to this Policy

We will post any changes here and update the effective date. If we make a material change, we will notify you in the app or by email before it takes effect.

11. Contact us

Project Magic Mirror, Inc.

1 Rockefeller Plaza, Suite 200, New York, NY 10020

compliance@projectmagicmirror.com