Legal / Cookie and Advertising Notice
Last updated: October 10, 2026
AI Chat Media LLC, a New Jersey limited liability company, operates MirrorChats at https://www.mirrorchats.com. This notice explains our cookies, advertising pixels, website analytics, and advertising information sent directly from our servers. Our Privacy Policy explains our broader collection, use, disclosure, and retention of personal information and your privacy rights.
You can decline optional tracking or use “Do Not Sell or Share” in the footer or Settings → Privacy. For an existing account, use that choice while signed in for account-linked server advertising events as well. After changing the Settings choice, reload the page. Section 5 explains the current limits of browser choices, account choices, and Global Privacy Control.
Cookies and browser storage. Cookies are small files stored by a website or its providers in your browser. Similar browser storage can remember settings or choices. A first-party cookie is associated with the website you visit; a third-party cookie is associated with another provider. Some storage lasts for a browsing session, while persistent storage remains until it expires or is cleared.
Pixels and analytics. A pixel or script sends information when a page loads or an event occurs, such as signup or a purchase. Analytics can also use technical information from a request to distinguish visits without setting a cookie. A tool can process personal information even if it uses no cookies.
Direct server events. We also send some advertising information directly from our servers. These events can be linked to your account and can occur when an invoice is paid, even if you are not browsing the site. Blocking cookies or clearing browser storage does not by itself stop all server events.
Service tools. We use cookies and similar tools for login, security, settings, and privacy choices. These are separate from optional advertising and analytics. Declining optional tracking does not prevent ordinary account use. Blocking login or security cookies can interfere with requested features. The Privacy Policy describes payment, verification, hosting, and other service processing; those activities are not all cookies or advertising.
Payment security. Stripe browser tools also help detect fraud and support payments. They currently load on ordinary site pages before checkout and remain active after an advertising opt-out. The storage periods for the Stripe cookies appear in section 6.
The following tools operate when enabled under the choices in section 5. Event names describe what happened, such as a signup or payment; they do not mean that we send the content of your chat.
| Tool and purpose | Information and events |
|---|---|
| MirrorChats campaign attribution | The first-party acq cookie stores the advertising campaign a visitor arrived from for 30 days. In the EEA, UK, and Switzerland it is set only after consent; elsewhere it follows the advertising opt-out. |
| Meta Pixel Browser advertising and measurement | Page views on every page, page URL, referrer, and Meta browser identifier. Signup, checkout opening, and purchase events can include purchase type, value, currency, and an event reference. When you are signed in, advanced matching uses email and account identifiers hashed by Meta’s browser script. Automatic event collection is enabled. |
| Meta Conversions API Direct server advertising and measurement | Signup, purchase events for each paid invoice, and an EngagedChat event once at your fifteenth user message. Depending on the event, data can include hashed email and account identifiers, click and browser identifiers, IP address, browser and device information, page URL, event reference, purchase type, value, and currency. |
| Taboola Browser and server advertising and measurement | Browser page-view and purchase events, page and technical information, and revenue, currency, and order reference where applicable. Browser automatic interaction events can also occur. After a Taboola ad click, a direct server registration event sends the Taboola click identifier at signup. Taboola’s browser tools can contact advertising partners, including LiveIntent, to match advertising identifiers. |
| Vercel Web Analytics Website usage statistics | Page URLs, referrers, timestamps, approximate location, and browser and device information. Vercel distinguishes visits using a hash derived from the incoming request rather than a third-party analytics cookie. The visitor hash has a 24-hour period. This does not mean all analytics records are deleted after 24 hours. |
| Vercel Speed Insights Website performance measurement | Page URLs and routes, page speed and responsiveness measurements, event time, approximate country, and browser, device, and network information. This is separate from Web Analytics. A cookie-free tool can still receive a URL that contains personal information. |
Meta and Taboola can combine information received from us with other information to measure campaigns, build interests, and personalize advertising across websites or services. They also use information for their own purposes; they do not act solely on our instructions. Taboola’s advertiser terms describe its advertising processing as that of an independent controller. Using these providers does not remove our responsibility for the tracking we enable on MirrorChats.
Hashing changes an email address or account identifier into a coded value that can be matched with other records. It does not make that information anonymous. When you visit a chat page, the URL sent to Meta, Taboola, and Vercel Web Analytics can include the conversation identifier. Registration, purchases, and chat engagement linked to identifiers on an adult AI-companion service can reveal sensitive context, even without the words you type.
The advertising fields we deliberately configure exclude raw chat text, character memory, crisis flags, and health inferences. Automatic event collection also operates. Page URLs and linked events can still reveal sensitive information; excluding those fields does not make all advertising information anonymous or nonsensitive. The Privacy Policy explains sensitive-data processing and related rights. Accepting our Terms, acknowledging a policy, enabling adult content, or consenting to age verification does not replace a separate advertising or sensitive-data consent required by law.
We do not receive cash for personal information. Where the California Consumer Privacy Act applies, we treat the Meta and Taboola advertising disclosures as sales and sharing for advertising across services. Those disclosures include linked identifiers, internet activity, approximate location, purchase or engagement information, and related context or inferences, including sensitive context where revealed. Other state laws may classify these disclosures as sales or targeted advertising. Your applicable opt-out rights are explained in the Privacy Policy.
EEA, UK, and Switzerland. Our regional controls are configured to keep advertising pixels, Vercel Web Analytics, Vercel Speed Insights, and corresponding server advertising events off until acceptance. The banner’s Accept or Decline choice currently covers advertising and analytics together. Decline keeps these optional tools off. You can withdraw an earlier acceptance through the footer or Settings → Privacy, subject to the reload limitation below. For EEA and UK personal information, optional advertising and analytics processing relies on consent, as explained in the Privacy Policy. Withdrawal does not affect earlier lawful processing.
Other locations. These optional tools, including the acq campaign-attribution cookie, currently operate unless you opt out. This describes our current controls; it does not replace any consent required by law or limit your privacy rights. Continuing to browse does not itself give consent where consent is required. The same footer and account choices are available regardless of whether a particular US state privacy law applies. The advertising and analytics choice does not control login, security, or privacy-choice storage.
Do Not Sell or Share. The footer choice saves a browser opt-out and reloads the page. You can use it without an account. When you are signed in, this explicit choice is configured to apply to associated server advertising events for your account, including later Meta invoice events. The account choice is also available in Settings → Privacy. The current browser limitations below still apply.
Current withdrawal limitation. Changing the account choice in Settings saves the preference but does not immediately stop optional scripts already running on that page. Reload the page after changing it. Until that reload, the open page can continue to send advertising and analytics requests. This limitation does not reduce your right to withdraw consent or opt out. Contact us if the control does not work.
Global Privacy Control. Global Privacy Control (GPC) is a browser signal requesting an opt-out of covered advertising disclosures. Our browser controls check for GPC when the page initializes and keep advertising, Web Analytics, and Speed Insights off when the signal is detected. Reload after changing a browser signal. Server handling currently checks GPC only at signup. For an existing account, GPC alone does not stop every later server event; also use the signed-in “Do Not Sell or Share” choice. This technical limitation does not reduce a legal right to have the signal honored. Learn about GPC
Other browsers and devices. An account opt-out does not automatically turn off browser pixels in a browser without the local opt-out, even while that account is signed in. Make the browser choice on each browser or device too. Clearing cookies can remove that local choice. Browser settings and blocking tools provide additional controls but do not replace the account choice for server events. Other “Do Not Track” settings do not automatically apply these choices. For help managing browser storage, see Chrome, Edge, Firefox, or Safari.
Records outside your browser. The following periods concern advertising and analytics records, not cookie lifetimes. Account preferences and consent records are also separate from the browser-choice cookies.
| Information | Period or scope |
|---|---|
| Advertising click records | Meta ad-click identifiers are kept for 30 days in the meta_attr cookie and the account. The taboola_attr cookie also has a 30-day expiry. These click records are separate from other provider cookies and information already received by providers. |
| Meta advertising information | The retention period reported for information received by Meta is up to two years. This is separate from the 90-day Meta cookies and our 30-day click record. |
| Taboola advertising information | Taboola states that user information directly collected for serving ads is kept for up to 13 months after the last interaction, then de-identified. Opt-out information and de-identified or aggregated records can be kept longer. This is not a cookie-expiry schedule. |
| LiveIntent matching information | LiveIntent states that it keeps information identifying a computer or device for 180 days. Its policy also describes other criteria, including whether contact details remain current and a device remains active. Those criteria are separate from the approximately 400-day lidid cookie lifetime. |
| Vercel analytics visitor hash | The Web Analytics visitor hash uses a 24-hour period. This is separate from other analytics records and Speed Insights measurements. Runtime logs used for hosting and operations have a one-day period under our current settings. |
Browser cookies. The table identifies each cookie, its provider, domain, purpose, and browser lifetime. The cookies listed use the path “/”, which covers pages within their domain. “First party” means the cookie is associated with MirrorChats; “third party” means it is associated with another provider. The service cookies support login, security, or privacy choices and remain enabled under our current controls. Stripe payment-security cookies also remain enabled, as described in section 2. Advertising cookies are optional and follow the choices and current limitations in section 5.
| Cookie name | Provider and domain | Purpose and category | Browser lifetime |
|---|---|---|---|
| __Host-next-auth.csrf-token | MirrorChats www.mirrorchats.com First party | Service security. Stores a security token to protect sign-in requests against forgery. | Session |
| __Secure-next-auth.callback-url | MirrorChats www.mirrorchats.com First party | Service login. Remembers the page to return to after signing in. | Session |
| __Secure-next-auth.session-token | MirrorChats www.mirrorchats.com First party | Service login. Stores a session token that keeps you signed in. | About 30 days; renews during signed-in use. |
| __Secure-next-auth.pkce.code_verifier | MirrorChats www.mirrorchats.com First party | Service security. Protects a Google sign-in in progress against interception. | About 15 minutes. |
| __Secure-next-auth.state | MirrorChats www.mirrorchats.com First party | Service security. Ties a Google sign-in response to the request that started it. | About 15 minutes. |
| mc_media | MirrorChats .mirrorchats.com First party | Service security. Holds a browser token that media links are bound to, so a copied link to a private photo or video does not open in another browser. Set for every visitor. | 30 days; renews during use. |
| age_gate | MirrorChats www.mirrorchats.com First party | Service eligibility. Set when a date of birth under 18 is entered at signup; the signup form stays closed while it exists. | 24 hours. |
| mc_dns | MirrorChats www.mirrorchats.com First party | Privacy choice. Remembers your browser’s advertising opt-out. | 180 days from saving your choice; a new choice resets it. |
| mc_consent | MirrorChats www.mirrorchats.com First party | Privacy choice. Remembers acceptance or refusal of optional tracking. | 180 days from saving your choice; a new choice resets it. |
| __stripe_sid | Stripe .www.mirrorchats.com First party | Payment security. Stores a browser identifier used to assess transaction fraud risk. | About 30 minutes; renews during site use. |
| __stripe_mid | Stripe .www.mirrorchats.com First party | Payment security. Stores a browser identifier used to assess transaction fraud risk. | About 365 days; renews during site use. |
| acq | MirrorChats mirrorchats.com First party | Optional advertising. Stores the advertising campaign a visitor arrived from. Consent required in the EEA, UK, and Switzerland; opt-out elsewhere. | 30 days |
| meta_attr | MirrorChats www.mirrorchats.com First party | Optional advertising. Stores a Meta ad-click identifier to link an ad click with signup or payment events. | 30 days from capturing the click; a new capture resets it. |
| taboola_attr | MirrorChats www.mirrorchats.com First party | Optional advertising. Stores a Taboola ad-click identifier for registration attribution. | 30 days from capturing the click; a new capture resets it. |
| _fbp | Meta .mirrorchats.com First party | Optional advertising. Identifies browser activity for advertising and campaign measurement. | About 90 days; renews during use. |
| fr | Meta .facebook.com Third party | Optional advertising. Stores a provider identifier for advertising and campaign measurement. | About 90 days. |
| t_gid | Taboola .taboola.com Third party | Optional advertising. Stores an identifier for attribution, reporting, and personalized advertising. | About 365 days; renews during use. |
| t_pt_gid | Taboola .taboola.com Third party | Optional advertising. Stores a site-partitioned identifier for attribution, reporting, and personalized advertising. | About 365 days; renews during use. |
| lidid | LiveIntent .liadm.com Third party | Optional advertising. Matches advertising identifiers through the Taboola–LiveIntent request chain. | About 400 days. |
A session cookie has no fixed expiry date; browser session restoration can keep it longer than a single window. Persistent periods are approximate, and a browser may remove a cookie sooner. Where renewal is shown, the expiry period starts again during use or from a new saved choice or captured click. The meta_attr and taboola_attr attribution cookies are set when the relevant ad-click identifier is captured. The acq cookie stores the advertising campaign a visitor arrived from. In the EEA, UK, and Switzerland it is set only after consent; elsewhere it follows the same opt-out as our other advertising tools. A partitioned cookie is kept separately for this site by the browser. Cookie expiry does not erase records already received by providers.
Local storage. These entries are stored at https://www.mirrorchats.com rather than in a third-party cookie domain. Local storage has no browser-enforced expiry and can remain until you clear it or the site or provider removes it. The optional advertising entries follow the choices and current limitations in section 5. In the last key name, “*” stands for a site-specific numeric prefix, not a literal asterisk.
| Storage key | Provider and scope | Purpose and category | Browser lifetime |
|---|---|---|---|
| nextauth.message | MirrorChats First-party origin | Service login. Shares authentication events between tabs. | No fixed browser expiry. |
| ai_notice:[conversation] | MirrorChats First-party origin | Service notices. Records when the "AI character, not a human" notice was last shown in a chat, so it repeats at the required interval. | No fixed browser expiry. |
| ai_notice_open:[conversation] | MirrorChats First-party origin (session storage) | Service notices. Records that a chat was opened in this tab session for the same notice. | Cleared when the tab closes. |
| mc_sensitive_prompt_dismissed | MirrorChats First-party origin (session storage) | Service notices. Remembers that the sensitive-information consent prompt was dismissed in this tab session. | Cleared when the tab closes. |
| pastDueBannerDismissed | MirrorChats First-party origin (session storage) | Service notices. Remembers that the failed-payment banner was dismissed in this tab session. | Cleared when the tab closes. |
| verifyEmailBannerDismissed | MirrorChats First-party origin (session storage) | Service notices. Remembers that the verify-your-email banner was dismissed in this tab session. | Cleared when the tab closes. |
| av_return | MirrorChats First-party origin (session storage) | Service navigation. Remembers the page to return to after age verification. | Cleared when the tab closes. |
| lastExternalReferrer | Meta First-party origin | Optional advertising. Stores the referring website for advertising attribution. | No fixed browser expiry. |
| lastExternalReferrerTime | Meta First-party origin | Optional advertising. Stores the time associated with the saved referrer. | No fixed browser expiry. |
| eng_mt | Taboola First-party origin | Optional advertising. Stores interaction measurements, including visit time, scroll depth, and session depth. | No fixed browser expiry. |
| taboola global:user-id | Taboola First-party origin | Optional advertising. Stores an identifier for attribution, reporting, and personalized advertising. | No fixed browser expiry. |
| *:session-data | Taboola First-party origin | Optional advertising. Stores session state for the site-specific Taboola implementation. | No fixed browser expiry. |
These periods describe different records. The 180-day browser choice does not establish the retention of consent evidence or account preferences, and cookie expiry does not erase information already received by a provider. The Privacy Policy covers related service records. For provider details and contact information, see Meta’s Privacy Policy, Taboola’s Privacy Policy and Cookie Policy, LiveIntent’s Privacy Policy, Vercel’s Web Analytics and Speed Insights privacy information, and Stripe’s cookie information.
After withdrawal or opt-out. These choices apply to future tracking, with the current limits in section 5. Existing advertising cookies and browser storage may remain after opting out. Their presence alone does not mean a new event was sent. You can remove them through your browser settings. A browser choice does not itself recall information already received by advertising providers.
Erasure following withdrawal. Where applicable law requires it, withdrawing tracking consent also requires us to delete information collected under that consent and notify recipients. You do not need to make a separate deletion request for those duties to arise. An applicable legal exception may permit retention of particular records. A sale or sharing opt-out does not by itself require every earlier record to be erased. Withdrawal does not affect earlier lawful processing.
Account deletion and further requests. Ordinary account deletion does not currently send erasure directions to advertising providers. You can make a broader deletion request or seek help with withdrawal through section 7. Provider retention does not remove any deletion right that applies.
Marketing and character emails. These have a separate account toggle and, where provided, an unsubscribe link. Marketing email is opt-in for EEA, UK, and Swiss recipients. Turning it off does not stop necessary account, billing, security, or legal notices. A tracking choice does not automatically change your email choice.
Requests and help. Email support@mirrorchats.com or use our privacy request and reporting form if a control does not work, you cannot access your account, or you want to exercise a privacy right. You do not need to create an account. The Privacy Policy explains requests, authorized agents, appeals, response periods, and regional rights. Where California law provides a right to limit sensitive-information use or disclosure, you can email us with “Limit Sensitive Information.” Nevada residents can use the same address with “Nevada Sale Opt-Out” for their separate online-privacy sale request.
We do not penalize you for exercising a privacy right. Declining optional advertising does not prevent ordinary use of your account. Our EU and UK representative details appear in section 15 of the Privacy Policy; you can also use the representative contact portal.
AI Chat Media LLC
971 US Highway 202 N, Ste N
Branchburg, NJ 08876, USA
Email: support@mirrorchats.com
We update the date above when this notice changes and provide notice of material changes as required. Where a changed purpose or use requires consent, we request it separately before that processing. Posting an updated notice or continued use does not provide that consent.
Other MirrorChats legal documents