Trust & Privacy

Before You Upload: Grey Mirror Privacy, Safety and Trust

Read how Grey Mirror handles private conversations, consent, deletion and AI limitations before you upload your text history. Find the policies and help here.

How does JustLayMe handle an uploaded conversation?

An uploaded message history contains the other person’s words as well as your own, so the handling matters more here than for an ordinary file upload. Retention, deletion controls, and what is measured are documented rather than summarised. First-party analytics use coarse aggregate counts. Google Analytics and Microsoft Clarity require explicit browser opt-in on eligible public pages, can be turned off in Settings, and collection is disabled on upload and report surfaces.

  • Deletion is user-triggered, and the retention and deletion specifics are documented on the privacy and deletion page rather than left to a policy sentence.
  • If you would rather not upload identifying details at all, Mirror Veil redacts names, numbers and emails locally in your browser first, with no upload and no server involved.
  • Analysis reads the text and timestamps in the export you provide. It does not connect to any messaging account and cannot reach anything you have not exported yourself.
  • Findings carry stated confidence, and missing media, deleted messages or conversations that moved to another app are named as gaps rather than filled in.
  • First-party browser analytics are coarse daily aggregate counts on an allowlisted set of event names, with no message content, filenames, user ids or full URLs. Third-party analytics are enabled by default on eligible public pages, can be turned off in Settings, and stay blocked from sensitive routes.

Grey Mirror does not delete data on a timer. Uploads, processed messages, and reports stay in the account until the user deletes them; deleting a report removes its messages, analysis files, and stored original upload. Signed-in users can delete reports or their account at any time. The exact encrypted-backup expiry schedule is not publicly committed.

Cloudflare handles edge transport and security, Stripe handles billing, Brevo handles transactional email, and Google supports optional sign-in and privacy-limited analytics with a Settings opt-out. The currently configured DeepSeek API prose step receives derived report facts, not the complete raw transcript or evidence excerpts, by default. Contact privacy@justlay.me.

Machine-readable trust and data-handling metadata

Retention, deletion and subprocessor details are published in a structured form as well as in prose.

Start here

More from Grey Mirror

Related Guides

Choose what to inspect

A trust claim should lead somewhere verifiable

Visual guide updated

  1. How it works

    The methodology explains what the analysis measures and how evidence supports the output.

  2. What is stored

    Privacy, security and deletion pages explain the handling of supplied conversation data.

  3. Where it stops

    Limitations and consent guidance describe conclusions a text history cannot justify.

Conceptual reading guide. This diagram explains what to inspect; it is not a customer report, diagnostic test or measured relationship score.
Use this guide on the question you came with

Open all three branches before uploading. Trust comes from inspectable facts and explicit limits, not from an unsupported clinician endorsement.