MAGECLY

MAGECLY Privacy Policy

Last updated: 13 October 2026.

1. Who is responsible

MARKO PRODUKCIJA, MB operates MAGECLY and is the controller of personal data used to provide the service.

This policy describes the MAGECLY application, account, subscription and support services, and these legal-information pages. It does not describe unrelated services you choose to open through external links.

2. Your creative work stays on your device

Projects, imported photos, logos, fonts, presets and Brand settings are stored on your device. Signing in does not upload those files to MAGECLY or synchronize them between devices. We do not receive a server copy of your creative work through the editor and do not use it to train AI models.

You choose what to import, export or share. Exporting to Photos, Files, email, cloud storage or another app makes that service responsible for its own handling of the exported copy. Your device's backup service may separately include application data, depending on your settings. A browser preview stores work in that browser; clearing its data may remove that work.

3. Information processed online

Accounts. When you register or sign in, Supabase processes your email address, account identifier, authentication and session information, and account timestamps. Email/password authentication uses password verification data; your password is not sent to RevenueCat. Apple or Google sign-in can provide a provider identifier, email address and profile information such as your name, according to the provider and your choices. Apple may supply a private relay email address. Social sign-in providers also process information under their own privacy notices.

Subscriptions. Apple handles App Store billing. RevenueCat processes your MAGECLY account identifier, store transaction and product identifiers, purchase history, subscription status, renewals, refunds, expiry and access entitlements. Technical request information can include IP address, app/SDK version, platform, locale and currency. This lets us display plans, verify and restore access, investigate payment problems and understand subscription performance. We do not receive your full payment-card number. Our app does not set your email or name as RevenueCat customer attributes and disables automatic device-identifier collection.

MAGECLY collections. The app includes MAGECLY stickers and can download published MAGECLY collections. Collection requests can include technical connection information such as IP address. Sticker searches and category filters run on your device; their search text and sticker selections are not sent to a sticker provider. Your projects and imported photos are not included in collection requests. The current version does not offer a third-party sticker or meme service.

Support. We receive your email address and whatever you choose to send us. The in-app support form opens an email draft; it does not send it automatically. App version and system details are included only if you enable that option. Projects, photos, passwords and account tokens are not automatically attached. Our email service is provided through Hostinger.

Optional usage statistics. With your permission, the iOS app sends selected usage events to PostHog, such as app opens, screens visited, project creation, exports and subscription-screen actions. Events include a randomly generated installation identifier, event time, app version, platform and limited feature/status information. When you sign in, this activity can be linked to your MAGECLY account identifier; it is not anonymous. We do not include your name, email address, project contents, photos or search text in these events. We use PostHog's EU ingestion service, disable IP-based location enrichment and do not enable session recordings or automatic screen-content capture. The service still receives the network connection needed to deliver an event, including its source IP address. You can decline statistics or change your choice in Settings without losing app access. Withdrawing permission stops future collection through this feature and clears its unsent local queue; it does not automatically delete events already received.

Error diagnostics. The app sends limited error and crash reports to Sentry to help us find and fix faults. These reports contain technical information such as error type, time, app version/build, code stack locations and diagnostic identifiers. Our filters omit error-message contents, account profiles, project contents, photos, authentication tokens, request bodies and full local file paths. We do not enable session replay, screenshots or interaction breadcrumbs. Diagnostic reports may be saved on the device and sent after a restart. Sentry also receives technical connection information when a report is delivered. This operational error reporting is separate from optional usage statistics.

In-app feedback. If you submit the separate feedback form, we store the message, category, optional rating, app version, submission time and your account identifier in Supabase. Authorized administrators can review it and record follow-up notes. We also store prompt status to limit repeated requests for feedback. You may dismiss the request or choose not to be asked again. This form sends your feedback when you submit it; the email-support draft described above is a separate option.

Service emails. Supabase and Hostinger SMTP deliver account-related emails and notices about the start, approaching end and expiry of your free period. We use your account email address, access dates and subscription status to decide which notice is relevant. A private delivery queue records the recipient, notice type, attempt times and sending status to prevent duplicates and investigate failures. An SMTP acceptance record does not prove inbox delivery. These notices do not use email-open tracking pixels or tracked redirect links, and registering does not subscribe you to marketing emails.

Operation and security. Servers providing authentication, content, subscriptions, email and web pages process request and security logs, such as IP address, timestamps, response status and device/browser information. These support delivery, fault investigation and abuse prevention. RevenueCat subscription reporting is part of the purchase service; it is not anonymous merely because it uses an account ID.

Device permissions control access to selected media and export destinations. You can change permissions in system settings; this may prevent the associated feature from working. A device permission is not a blanket agreement to unrelated processing.

5. Recipients and international processing

We use Supabase for accounts, server functions, feedback and operational records; RevenueCat for subscription management; PostHog for optional usage statistics; Sentry for error diagnostics; and Hostinger for website hosting and email. Apple provides distribution, payment and optional sign-in services; Google provides optional sign-in. Authorized personnel and advisers may receive information necessary to resolve support, security or legal matters. We may disclose information when required by law or to establish or defend a legal claim.

We do not sell personal data or use it for cross-app targeted advertising. Our providers may process information outside Lithuania and the European Economic Area, including in the United States. Transfers requiring GDPR safeguards must be covered by an applicable adequacy decision or appropriate safeguards, such as the European Commission's Standard Contractual Clauses. Contact us for information about the safeguards relevant to your data and how to obtain a copy. The providers' processing terms include the Supabase DPA and RevenueCat DPA.

6. Retention and deletion

Local creative files remain until you remove them or the application/browser storage is erased. Signing out or deleting your MAGECLY account does not itself remove local projects. Copies you exported or placed in device backups must be managed separately.

Account information is kept while your account is active. The in-app account-deletion action removes the authentication account and linked feedback, prompt-state and service-email queue records. It does not recall emails already sent, erase Apple transaction history or automatically delete RevenueCat subscription records. Contact us to request deletion of associated personal data held outside the account system.

For linked PostHog activity, account deletion registers a separate removal request. Processing starts after an eight-day buffer for delayed offline events; the app's unsent usage-event queue has a seven-day maximum age. PostHog removal is asynchronous, so accepting a request is not the same as completing it. We check provider status and investigate failed or overdue requests. Account identifiers are cleared from completed removal requests; status receipts are retained for 30 days after completion. Activity that was never linked to your account cannot automatically be located through account deletion. Contact us if you need help with such a request; we may need an identifier to locate the records.

Usage statistics already received and diagnostic reports are kept according to the relevant project's configured retention period while needed for product analysis or fault investigation, or until an applicable deletion request is completed. Diagnostic reports are not tagged with your MAGECLY account identifier and are not automatically located by account deletion. Feedback and delivery records are retained while needed for follow-up, reliable sending and abuse prevention, subject to the account-deletion process above.

Purchase records are retained while needed to administer active access, restores, refunds or disputes. Records subject to a specific legal retention duty are restricted to that purpose and retained for the applicable statutory period. Support correspondence is retained while the matter is open and for the period necessary to handle related follow-up or claims. Security logs and provider backups follow the relevant service's retention cycle; a copy may remain in a backup until it is overwritten or expires. A legal hold may delay deletion of the affected records, but does not justify retaining unrelated information.

Deleting a MAGECLY account does not cancel an Apple subscription. Manage cancellation separately in your Apple subscription settings. We cannot delete information that Apple or another provider must retain as an independent controller.

7. Your privacy rights

Subject to the conditions and exceptions in applicable law, you may ask for access, correction, erasure, restriction, and a portable copy of data you provided, or object to processing based on legitimate interests. You can withdraw any consent you gave. Contact info@magecly.com; we may need proportionate information to verify that the request is yours. We normally respond within one month and will explain any lawful extension.

You may complain to the Lithuanian State Data Protection Inspectorate or the competent authority in your place of residence or work. You do not have to contact us first.

8. Children, storage and security

MAGECLY is a general creative tool, not a service specifically directed at children. If you believe a child has provided information without the authorization required by applicable law, contact us so we can investigate and take appropriate action.

The app uses protected system storage for native sign-in sessions and browser storage for web-preview sessions. The legal pages supplied with this policy do not add analytics, advertising cookies or third-party fonts. Hosting services still process the network requests needed to deliver them. Optional tracking added to the website would require a separate assessment and notice before activation.

We use access controls and encrypted network connections for supported online services. No system can guarantee absolute security. Do not send passwords or private keys to support.

9. Changes

We will update this policy when our actual processing changes and give additional notice where appropriate. A privacy-policy update does not replace consent where new processing requires it. The date above identifies the version.