Privacy Policy
Last updated: October 11, 2026
Mirror Mail (“we”, “us”) turns an email designed in Figma into an editable template in your email platform. This policy explains what personal information we collect when you use mirrormail.app, the Mirror Mail Figma plugin and your Klaviyo connection; how we use and share it; how long we keep it; and your choices.
In short
- We never access your Klaviyo profiles, lists, segments or metrics: only your account's name, templates and images.
- Mirror Mail never sends or schedules email. It only creates templates.
- We don't sell your personal information, and our site runs no analytics or advertising trackers.
- You can disconnect Figma or Klaviyo at any time, and delete your account and everything in it from Settings.
Who we are
Unclosed Labs LLC, a Wyoming, USA limited liability company, operates Mirror Mail and is responsible for the personal information described here (its “controller”, in GDPR terms). When Mirror Mail processes your designs and your Klaviyo content on your instructions, it does so on your behalf, as your service provider. Contact us at support@mirrormail.app.
What we collect
- Account information. Your email address, and your password stored only as a one-way (bcrypt) hash. If you use Continue with Google, Google tells us your email address, whether Google has verified it, your Google account ID, and your name and profile picture; we store only the email address and the Google account ID. We also record when your address was verified and when you signed up, and a workspace that holds your work.
- Designs you send from Figma. When you press Export in the plugin, it reads only the frame you selected: its layers and their names, text, styles, sizes and positions, links, and its images, plus pictures (renders) of the parts Mirror Mail can't rebuild and a small thumbnail. We store these as a capture in your workspace. The plugin reads nothing else in your Figma file.
- Plugin connection. Connecting the plugin gives it a token, stored in Figma's storage on your computer with your account's email address and workspace name, so the plugin can show which account it sends to; we store only a one-way hash of the token, with when it was last used. The plugin also saves, inside your Figma file, an ID for the file, the Export type you choose for each email frame and, when you set one, a layer's HTML or Image override.
- Klaviyo connection. Your Klaviyo account ID and name, and the private API key you paste or the access and refresh tokens Klaviyo issues to Mirror Mail, stored encrypted, with the permissions granted.
- Exports. For each template Mirror Mail creates: its name and Klaviyo ID, its status, any error, notes on what had to change, and Klaviyo's rendered HTML of it, used to check the template came out as designed. We also keep the Klaviyo IDs and addresses of images we've uploaded, so each is uploaded once.
- Billing. If you subscribe to a paid plan, you pay on Stripe's own pages: Mirror Mail never sees or stores your card details. Stripe receives your email address and your workspace's name, and we keep your Stripe customer ID and, for each subscription, its plan, billing period, status and renewal or end date.
- Application logs. Technical records of how the service runs (errors, request paths, response codes and timings), which may include account, workspace or Klaviyo IDs. They don't include IP addresses. To limit repeated attempts, a request's IP address is kept in our database for about a day (see How long we keep it).
Mirror Mail asks Klaviyo only for the permissions accounts:read, templates:read, templates:write and images:write. None of them covers profiles, lists, segments, campaigns or sending.
Cookies
Mirror Mail sets only its own cookies, each needed for the service to work. No third-party cookies are set on our site.
| Name | Purpose | Lasts |
|---|---|---|
__mirrormail_session | Keeps you logged in. | 30 days |
__mirrormail_google_state | Protects Continue with Google against forgery. | 10 minutes |
__mirrormail_oauth_state | Protects the Klaviyo connection step against forgery. | 10 minutes |
How we use information
- To provide Mirror Mail: your account, your Figma and Klaviyo connections, and the templates you ask it to build.
- To answer your support requests.
- To keep the service and your account secure and prevent abuse.
- To meet our legal obligations.
We don't use your designs or Klaviyo content for any other purpose, and we don't use them to train AI models.
If you're in the European Economic Area or the United Kingdom, our legal bases are performing our contract with you (providing the service), our legitimate interests (security and abuse prevention), and complying with legal obligations.
Service providers
We share personal information only with these providers, each only as needed for the purpose shown.
| Provider | Purpose | Information involved |
|---|---|---|
| Fly.io | Hosting the app and its PostgreSQL database, in Ashburn, Virginia, USA. | Everything Mirror Mail stores, except the files below. |
| Cloudflare (R2) | Storing the images and renders sent from the plugin, in North America. | Your designs' images, renders and thumbnails. |
| Klaviyo | The platform you connect Mirror Mail to. | The templates and images Mirror Mail creates on your behalf. |
| Continue with Google. | Sign-in details. | |
| Stripe | Payments, subscriptions and invoices for paid plans. | Your email address, workspace name and subscription, and the payment details you enter on Stripe's pages. |
| Figma | The plugin runs inside Figma. | Figma's own policy covers your use of Figma. |
We may also disclose information when the law requires it, to protect the rights and safety of our users or others, or to a successor if our business is sold or merged, in which case this policy continues to apply.
Where your data is stored
Mirror Mail's servers, database and file storage are in the United States. If you use Mirror Mail from outside the United States, your information is transferred to and processed there, where data protection laws may differ from yours. Where the law requires it, we rely on safeguards such as the European Commission's Standard Contractual Clauses offered by our providers.
How long we keep it
| Information | Kept for |
|---|---|
| Account information | Until your account is deleted. |
| Captures, with their images and renders | Until your account is deleted, or you ask us to delete them. An image no capture uses any more is deleted within about a day. |
| A send that doesn't finish uploading | Deleted within minutes. |
| Export records | As long as the capture they belong to. |
| Plugin connection | Until you sign out in the plugin or disconnect it in Settings, leave the team, or your account is deleted; the token then stops working. |
| Klaviyo connection and credentials | Until you disconnect Klaviyo in Settings, or your account is deleted. |
| Login sessions (when you logged in, and when the session ends) | Until you log out, or your next login after it expires (30 days). |
| Sign-in and connection handshakes | 10 minutes. |
| Attempt counts for rate limits (an IP address, and the email address a login tried) | A day after the last attempt. |
| Billing records | Until your account is deleted. Stripe keeps payments and invoices as tax and accounting law requires. |
| Application logs | A short rolling period, set by Fly.io. |
| Database backups | Fly.io's managed backups, for a limited rolling period. Deleted data can remain in backups until they expire. |
Security
- Klaviyo keys and tokens encrypted at rest with AES-256-GCM.
- All traffic encrypted in transit with TLS, and browsers told to always use HTTPS (HSTS).
- Passwords stored only as bcrypt hashes; plugin tokens only as one-way hashes.
- Signed, HTTP-only session cookies, and protection against cross-site request forgery.
- Rate limits on sign-in and other sensitive actions.
- Least-privilege Klaviyo access: only the four permissions above.
No system is perfectly secure, but we work to protect your information and will notify you and the authorities of a breach where the law requires it.
Your rights and choices
Wherever you live, you can disconnect the plugin and Klaviyo from Settings at any time, and you can ask us for a copy of your information, to correct it, or to delete it.
EEA and UK residents have the right to access, correct, delete and receive a portable copy of their personal information; to restrict or object to its processing; and to complain to their local data protection authority.
California residents have the right to know what personal information we collect and how we use and disclose it, to delete it and to correct it. We don't sell or share personal information for advertising. We won't treat you differently for exercising these rights, and you may use an authorized agent.
To exercise any of these rights, email support@mirrormail.app from the address on your account. We may need to verify your identity first, and we'll respond within the time the law requires (generally within one month).
Deleting your account
Delete your account yourself in Settings › Delete account, or email support@mirrormail.app from the address on your account and we'll do it. That deletes your account and your workspace with its captures, images, renders and export records, and its Klaviyo connections (revoking Mirror Mail's access where you connected with Klaviyo), and cancels any subscription at once. If you're a member of someone else's team, what you made there stays with the team, and only your account goes; a team's owner removes its members first. Templates and images already in your Klaviyo account stay there, and a private API key you pasted stays valid until you delete it in Klaviyo.
Children
Mirror Mail is a business tool and isn't directed to children under 16. We don't knowingly collect their personal information; if you believe we have, contact us and we'll delete it.
Changes to this policy
If we change this policy, we'll update the date above. If a change is material, we'll also tell you in the app before it takes effect.
Contact
Questions or requests about this policy or your information: Unclosed Labs LLC, support@mirrormail.app.