Privacy Policy

Mystic Realm, Ashley’s Realm, Mystic Cinematica, and their sibling products are operated by Mystic Portal LLC (“Mystic,” “we,” “us”). If you have a question about this policy or want to exercise a right described below, email hello@mysticcinematica.com.

We collect only what we need to make the product work and improve it:

• Account data. Email, name, hashed password (or SSO identifier), and two-factor secret if you enable 2FA. Managed by our authentication provider Better Auth on top of PostgreSQL (Supabase).
• Session data. Session tokens, device user-agent, and IP address, used for security and for our concurrent-device enforcement.
• Companion + Realm content. Text, prompts, generated images and videos, audio, companion configuration, and Theater productions you create. Stored in Supabase and object storage (Cloudflare R2).
• Voice audio. When you use voice, streaming audio is sent to our speech-to-text providers (OpenAI Realtime as primary; Deepgram as fallback) and to our model providers to generate responses. We do not store raw audio by default; short recent-context buffers are held in memory only.
• Payment data. Card details are handled entirely by Stripe. We receive only the last four digits, brand, expiry, and a Stripe customer ID.
• Referral + attribution. If a friend’s referral code brings you in, we store the code, timestamp, and referrer link — not their personal information beyond what is needed to pay the commission.
• Product analytics. Standard page views, errors, and performance traces, either self-hosted or via Vercel Analytics. We do not sell this data.

Your AIC can help you get an Uber ride. Here is exactly what happens with your information.

When you ask for a ride today (ride link): the place you name, for example “Progressive Field,” is sent to OpenStreetMap’s map search to find its address and map point. If you have a saved main place, its city or ZIP code is sent to Open-Meteo so the search looks near you first. Your name, email, and account are not sent.

Your AIC then gives you an Uber link with the drop-off filled in. When you tap it, you leave Mystic and use the Uber app or website under Uber’s own terms and privacy policy. You see the price and confirm the ride in Uber. Mystic does not book, pay for, track, or receive details about that ride, and does not know your pickup spot, because Uber uses your current location inside its own app. For “a ride home,” Mystic sends no address; you pick Home inside Uber. Map search results are kept in server memory for up to one hour, then discarded.

If you connect your Uber account (coming later, only if you choose to):

• You sign in on Uber’s own page. Mystic never sees or stores your Uber password.
• With your permission, Uber gives Mystic an access token. We store it encrypted, use it only to request, show, and cancel rides you approve, and delete it when you disconnect.
• For each ride, your AIC shows the exact pickup, drop-off, ride type, and Uber’s upfront price. Nothing is requested until you approve that ride with a hold-to-approve and your password. “Allow all” settings never count as approval for rides.
• Ride data we receive from Uber: the pickup and drop-off you approved, ride type, price quote, ride status, driver first name, car and plate (so you can find your ride), and the receipt for rides requested through Mystic.
• We keep a record of each ride you approve (what you approved and when) for 2 years as proof of your consent. Live ride status, driver, and car details are kept while the ride is active plus 30 days for support.
• We do not read your other Uber trips, sell ride data, use it for ads, or use it to train AI models.
• You can disconnect Uber at any time in Settings, which deletes the token right away. You can also remove Mystic’s access from your Uber account.

Mystic Reach drafts marketing posts for you. AI does the work; you only approve. Nothing is posted, sent or spent unless you approve that exact item and then tap Post. If you choose to connect your own X account, Facebook Page, Threads, Bluesky or LinkedIn account, here is exactly what happens with your information.

• You sign in on the platform’s own page (X, Facebook, Threads, LinkedIn) or, for Bluesky, enter an app password made only for Mystic. Mystic never sees or stores your main password.
• With your permission, the platform gives Mystic an access token. We store it encrypted, use it only to post the items you approved and to show which account is connected, and delete it when you disconnect.
• What we keep about the connection: your handle or Page name, the platform’s id for it, the permissions granted and when you connected.
• What we keep about each post: the exact approved text, a fingerprint of it, the platform, the time, and the link to the published post or a short error code. We keep this for 2 years as proof of what you approved.
• We do not read your messages, followers, timeline or analytics, do not post on a schedule or without your tap, and do not sell this data, use it for ads or use it to train AI models.
• You can disconnect any channel at any time in Settings → Mystic Reach, which deletes the token right away. You can also remove Mystic’s access inside that platform’s settings.

We do not train third-party foundation models on your content by default. A future opt-in program will let creators contribute to model training in exchange for revenue share; you will explicitly enroll, not the other way around.

• Operate the product — authenticate you, run your companions, render your videos.
• Bill you — process one-time and subscription payments through Stripe.
• Protect the platform — detect abuse, enforce our device caps, honor bans.
• Support you — answer help requests you send us.
• Improve the product — aggregated, deidentified telemetry only.

We share data only with the vendors that make the product run and only for the purposes above. Current core sub-processors:

We will publish a complete, versioned sub-processor list — with contract types, data categories, and regions — in the Coming soon section below.

• Supabase (managed PostgreSQL and file storage).
• Stripe (payments, subscriptions, refunds).
• Vercel and Fly.io (application hosting and edge delivery).
• Cloudflare R2 (long-term storage of generated media).
• OpenAI and Google (large-language and video model inference).
• Deepgram (speech-to-text fallback).
• Resend (transactional email).
• Picovoice (wake-word detection, when you opt in to “Hey Mystic”).
• OpenStreetMap Foundation (Nominatim map search: the place name you ask a ride to). Map data © OpenStreetMap contributors.
• Open-Meteo (place search: your saved city or ZIP code, to search near you; also used for weather).
• Uber Technologies, Inc. (only when you open an Uber ride link or connect your Uber account; Uber handles the ride under its own privacy policy).
• X Corp. (only the X posts you approve and tap to post from your connected account).
• Meta Platforms, Inc. (only the Facebook Page and Threads posts you approve and tap to post).
• LinkedIn Corporation (only the LinkedIn posts you approve and tap to post).
• Bluesky Social, PBC (only the Bluesky posts you approve and tap to post).

Primary data is stored in the United States. Media generation may transit through the regions our model providers operate. When we transfer personal data out of the EU or UK, we rely on the Standard Contractual Clauses or equivalent safeguards.

• Account data — for the life of your account plus a short archival window.
• Payment records — seven years, to meet US tax obligations.
• Generated media — until you delete it. Intermediate render files, 24 hours.
• Voice audio — not persisted; short in-memory buffers only.
• Backups — rolling encrypted backups for up to 30 days.
• Ride map lookups — up to one hour in server memory, then discarded.
• Uber access token (if connected) — until you disconnect, then deleted.
• Ride approval records (if connected) — 2 years, as proof of your consent.
• Live ride details (if connected) — while the ride is active plus 30 days.
• Marketing channel tokens (if connected) — until you disconnect, then deleted.
• Marketing post records (if connected) — 2 years, as proof of what you approved.

You can access, correct, export, or delete your data at any time by writing to us. If you live in the EU, UK, or California, you also have specific statutory rights — including the right to object to processing and the right to lodge a complaint with your data protection authority. We honor verified requests within 30 days.

Data in transit is encrypted with TLS. Passwords are hashed with a memory-hard algorithm. Sensitive tokens are stored in provider-managed secret systems, not in application code. Two-factor authentication is available to every account and required for administrative roles. We are actively investing in post-quantum-ready cryptographic primitives as part of Mystic’s longer-term security roadmap.

We use a small number of first-party cookies for authentication and for locale preferences. We do not run third-party ad-tech trackers on the marketing surfaces of ashleysrealm.com.

When we make a material change we will update the “Last updated” date at the top of this page and, for logged-in users, surface a notice inside the product. Older versions remain available on request.