{
  "id": "grey-mirror-trust-metadata",
  "product": "The Grey Mirror",
  "publisher": "JustLayMe",
  "url": "https://thegreymirror.com/trust",
  "version": "2026-08-02.1",
  "lastReviewed": "2026-08-02",
  "owner": "JustLayMe Trust Team",
  "reviewer": "Grey Mirror Policy Review",
  "contact": {
    "support": "support@justlay.me",
    "privacy": "privacy@justlay.me",
    "securityMetadata": "https://justlay.me/.well-known/security.txt"
  },
  "hosting": {
    "primaryOriginRegion": "United States",
    "primaryOrigin": "Privately operated application and ML origin",
    "edgeProvider": "Cloudflare",
    "exactPhysicalLocationPublished": false,
    "note": "Street-level origin details are withheld to reduce physical and network targeting risk."
  },
  "retention": {
    "rawGreyMirrorUploads": {
      "publicStaticAccess": false,
      "temporaryProcessingCopy": "Kept until the user deletes the report.",
      "ownerOnlyOriginalArchive": "Kept until the user deletes the report or account.",
      "note": "Grey Mirror uploads are not served through public static upload paths. Original-upload archives use owner-only filesystem permissions and are removed when the user deletes the report or account."
    },
    "completedAndFailedJobRows": {
      "defaultCleanupTarget": null,
      "implementation": "No automatic deletion; removed by user report or account deletion"
    },
    "cachedNormalizedMessageFiles": {
      "defaultCleanupTarget": null,
      "implementation": "No automatic deletion; removed by user report or account deletion"
    },
    "archivedChunkUploadFolders": {
      "defaultCleanupTarget": "PT24H",
      "implementation": "Automated pruning of temporary transfer pieces; the assembled upload is kept"
    },
    "temporaryExportDeliveryFiles": {
      "defaultCleanupTarget": "PT30M",
      "implementation": "Timed delivery-file cleanup"
    },
    "completedJobViewAccessCaches": {
      "defaultCleanupTarget": "PT15S",
      "implementation": "In-memory cache expiry"
    },
    "backupExpiry": {
      "status": "not_publicly_committed",
      "note": "The exact encrypted-backup expiry schedule is not publicly committed. Signed deletion receipts disclose that backup rotation and mandatory security records may outlast active-system deletion."
    },
    "policy": "No automatic deletion. Data stays until the user deletes the report or the account."
  },
  "privacyRights": {
    "requestEmail": "privacy@justlay.me",
    "workflowStatus": "authenticated_export_and_deletion_routes_implemented",
    "authenticatedRoutes": {
      "export": "/api/privacy/export-my-data",
      "greyMirrorDeletion": "/api/privacy/delete-my-data",
      "accountDeletion": "/api/privacy/user-deletion"
    },
    "workflowStates": [
      "received",
      "verifying_identity",
      "queued",
      "executing",
      "backup_pending",
      "completed",
      "rejected",
      "legal_hold"
    ],
    "receiptFields": [
      "requestId",
      "analysisJobIds",
      "deletionScope",
      "executedAt",
      "systemSignature",
      "backupExpiryNote"
    ]
  },
  "processors": [
    {
      "name": "Cloudflare",
      "purpose": "DNS, TLS termination, edge security, proxying, and tunnel transport",
      "dataBoundary": "Request network metadata and encrypted application traffic in transit"
    },
    {
      "name": "Stripe",
      "purpose": "Payment processing, receipts, and dispute handling",
      "dataBoundary": "Billing and transaction data; raw relationship message threads are not required"
    },
    {
      "name": "Brevo",
      "purpose": "Transactional email delivery",
      "dataBoundary": "Email address and service-message content; raw relationship threads are not included by design"
    },
    {
      "name": "Google",
      "purpose": "Optional account authentication",
      "dataBoundary": "Identity fields supplied during sign-in only"
    },
    {
      "name": "DeepSeek API",
      "purpose": "Narrative report prose for the currently configured public-compatible provider",
      "dataBoundary": "Derived report facts only; the complete raw transcript and evidence excerpts are withheld by default"
    }
  ],
  "analytics": {
    "default": "enabled_without_identifier",
    "storage": "daily_aggregates_only",
    "retentionDays": 90,
    "optOutUrl": "https://thegreymirror.com/privacy#analytics-choices",
    "honorsGpc": true,
    "honorsDnt": true,
    "rawMessageContentAllowed": false,
    "identifiersAllowed": false,
    "thirdPartyBehavioralAnalytics": false,
    "microsoftClarity": "not_used_on_justlayme",
    "cloudflareBrowserAnalytics": "disabled",
    "zarazTracking": "disabled",
    "necessaryRecordsBoundary": "Operational, security, authentication, fraud, billing, and availability records remain separate from aggregate analytics."
  },
  "trainingDataPolicy": {
    "publicStatement": "Uploaded relationship content is used only to generate the requested report and to operate, secure, debug, and support the service. It is not used to train or fine-tune model weights. Public external narrative providers receive derived report facts rather than complete raw transcripts or evidence excerpts by default.",
    "status": "implemented_product_boundary"
  },
  "relationshipRecord": {
    "sameUserComparisonOnly": true,
    "crossUserRelationshipMemory": false,
    "relationshipKeyRawNamesExposed": false,
    "evidenceBackedClaims": true,
    "previewRawMessageText": false,
    "note": "Rerun comparison is scoped to the authenticated user and a hashed compatible relationship key."
  },
  "modelLimitations": [
    "Not therapy, medical advice, legal advice, crisis response, or emergency assessment.",
    "Cannot infer motive, safety, or future behavior with certainty.",
    "Scores depend on uploaded content quality, participant attribution, timestamps, and available context.",
    "Low-confidence evidence should degrade report claims instead of overclaiming."
  ],
  "versionHistory": [
    {
      "version": "2026-08-02.1",
      "date": "2026-08-02",
      "changes": [
        "Replaced third-party analytics with first-party daily aggregates that contain no identifiers or raw relationship content.",
        "Published the 90-day aggregate retention limit and public opt-out URL.",
        "Documented Global Privacy Control, Do Not Track, browser storage failure, and account opt-out behavior.",
        "Limited Google processing to optional account authentication."
      ]
    },
    {
      "version": "2026-07-16.1",
      "date": "2026-07-16",
      "changes": [
        "Published the verified processor inventory and hosting region.",
        "Documented implemented privacy routes and signed deletion receipts.",
        "Added 24-hour original-upload archive expiry and public-provider transcript boundaries.",
        "Changed analytics disclosure to consent-first and documented that Clarity is not used on JustLayMe."
      ]
    },
    {
      "version": "2026-05-06.1",
      "date": "2026-05-06",
      "changes": [
        "Added relationship record privacy boundaries.",
        "Added evidence-backed claim and preview raw-message-text metadata."
      ]
    },
    {
      "version": "2026-05-04.1",
      "date": "2026-05-04",
      "changes": [
        "Added machine-readable retention metadata.",
        "Added DSAR workflow target states and deletion receipt target fields.",
        "Added subprocessor inventory status and training-data policy statement."
      ]
    }
  ]
}