Project Mirage

GDPR overview

The privacy policy carries a dedicated section for European users. It names the legal bases it relies on article by article: contract performance under Art. 6(1)(b), legitimate interests under Art. 6(1)(f), consent under Art. 6(1)(a) and legal obligation under Art. 6(1)(c). It lists eight data subject rights, including the right to complain to a supervisory authority, and states that transfers outside the EEA and the UK rely on the European Commission's Standard Contractual Clauses or another approved mechanism. Breach notification is described as 72 hours to the authority where required, plus notice to affected users and an internal breach register. Two gaps remain: no Article 27 representative in the European Union is designated, no data protection officer is named, and no security certification such as SOC 2 or ISO 27001 is claimed. The policy was last updated on 15 May 2026.

Who owns the data?

The controllers are Aina Computers, Inc. in the United States and Aina Computer Private Limited in India, together presented as Project Mirage. They collect the email you leave on the site, non-identifiable product usage such as key interactions, performance metrics and crash logs, and — only if you grant it — calendar events and permission to send email on your behalf. Google Sign-In adds your name, email and profile picture. The privacy policy states that personal data is never sold, rented or traded, and that the content of actions performed through macOS accessibility and automation permissions is neither stored nor logged. Four named subprocessors handle parts of the data: Stripe, Mixpanel, Anthropic and Google.

Reuse rights

Nothing in the terms of service claims a licence over what you create: your macros, scripts and marketplace uploads are not covered by any ownership or licensing clause on the published pages, although you do indemnify the company for anything you post or submit. You can share your own scripts on the Dune Marketplace and install other people's freely, since the marketplace is built around that exchange. On the personal data side, you can ask for access, correction, deletion, restriction, portability in a machine-readable format, or object to processing, and Indian users get the equivalent DPDP rights plus a nomination right; requests go to team@projectmirage.ai with a stated 30-day response. Data received through Google APIs is limited to the features you ask for and is explicitly not used to train general AI or machine learning models.

Data retention & training

Hosting summary

The company is headquartered in the United States and runs a subsidiary in India, and the privacy policy states that personal data may be transferred to and processed in either country. No data centre, hosting provider or cloud region is named. For users in the European Economic Area and the United Kingdom, transfers rely on the European Commission's Standard Contractual Clauses or another approved mechanism. For users in India, Aina Computer Private Limited acts as Data Fiduciary under the DPDP Act, and transfers to the United States parent are made subject to any restrictions notified by the Indian government. All four named subprocessors are United States companies: Stripe, Mixpanel, Anthropic and Google. One technical caveat: the domain resolves to an anycast address on a content delivery network node in Amsterdam, which describes how the website is served and says nothing about where user data is stored.