Privacy Policy

Privacy at a glance

• AI features use external services. Your prompts, conversation context, selected files, images, audio, video, and connected-app content may contain personal information and may be sent to third-party AI providers to carry out your request.
• Magica does not train AI models on your data. We do not train or fine-tune AI models. Your inputs, outputs, files, conversations, and connected-app content are not used by Magica for model training. See our no-training commitment and provider practices.
• Disclosure is not consent. Reading this policy, creating an account, accepting general terms, or granting a device permission does not by itself give permission to share personal data with third-party AI. See AI sharing and explicit permission.
• You have choices. You can choose what to submit, disconnect integrations, manage device permissions, and request access, correction, or deletion. Some features need particular information to work; unrelated features must not be conditioned on optional permissions.
• We do not sell your personal information. We use service providers to operate the Services, not to sell user data to data brokers.

1. Who we are and what this policy covers

GalaxyAI Inc is the responsible company for the processing described here. This policy covers Magica on the web, iOS, Android, and our API and integration surfaces. Features, permissions, and providers can differ by platform and by the feature you use.

If you use a team or organization account, your organization may also determine how workspace information is used and who can access it. Contact your organization about its own policies. Third-party services you connect or visit have their own privacy notices; this does not remove our responsibility for personal information we share with them.

2. Information we collect

2.1 Information you provide or authorize

We process workspace content you submit to provide the requested features. That content can include personal information about you or other people. Please share only information needed for your task and only material you are authorized to provide. Personal information inside a document or workspace is still personal information; this policy applies to our processing of it. Magica does not use it to train AI models.

For account registration, we ask for an email address and, if you do not use a third-party login, a password. Business or customer profiles may include your contact information, time zone, location, company, and team information to set up your account and power the Services. We may retain copies of communications you send by email, in support requests, in survey responses, or in public forums. Transaction records can include the product purchased, purchase price, and the date and location of the transaction.

2.2 Information collected automatically

We collect technical and usage information when you interact with the Services, including:

• Browser and operating-system information, device and app version, language, and time zone.
• IP address, approximate location derived from it, request timestamps, and security logs.
• Features used, usage and credit records, performance measurements, and error or crash reports.
• Cookies and similar technologies used for sessions, preferences, analytics, and, where applicable, marketing measurement.

The device and mobile-analytics information described above includes:

• Hardware model and manufacturer, screen size and resolution, and operating-system version.
• Unique device identifiers, such as Android ID or Apple's Identifier for Vendors, plus mobile carrier and network information.
• Performance and memory usage, installed app version, device language, and time zone.
• Referring website, access dates and times, and records of actions taken in the Services, including who performed an action and when.
• App launch count and usage frequency, feature usage, and navigation paths within the app.
• Crash reports and app errors, load and response times, battery usage related to our app, and network-request successes and failures.

Technical records may include account or device identifiers and are not necessarily anonymous. We use them for service operation, security, troubleshooting, billing, and improvement. Precise device location is different from approximate IP-based location and requires the relevant device permission when a feature requests it.

2.3 Information from other sources

When you choose a third-party sign-in service, such as Google, Apple, or Facebook, we receive the account information it provides, such as your email, authentication details, and profile information. When you connect another service, the information available depends on the permissions you grant, the provider's controls, and the task you request. Payment processors and app stores also provide transaction and subscription information.

3. How and why we use information

We process information to:

1. Provide accounts, AI responses, content generation, connected actions, and other requested features.
2. Store and retrieve your tasks, files, preferences, and relevant context, including personalization or memory where those features are used.
3. Manage subscriptions, usage, payments, and customer support.
4. Detect abuse, fraud, and security incidents, troubleshoot failures, and maintain service reliability.
5. Understand service usage and improve functionality and performance.
6. Send service notices and, subject to applicable permission requirements, marketing communications that you can opt out of.
7. Meet legal obligations, resolve disputes, and protect legal rights.

These purposes include verifying user information; providing automatic upgrades and new versions; developing features and making the Services easier to use; fighting spam and malicious, deceptive, fraudulent, or illegal activity; and monitoring, debugging, repairing, and preventing problems. Protecting users and the public may require declining a transaction or terminating Services. Personalization includes remembering preferences, providing relevant content, and facilitating social sharing.

Communications may include feedback requests, product tips and updates by email, payment-verification texts, and offers or promotions by phone where permitted. You can opt out of marketing communications at any time; important account and service updates may still be sent.

Improving functionality and performance means improving the operation of the Services, not training or fine-tuning AI models on your data. Our no-training commitment in section 6.4 applies to every purpose described in this policy.

We do not use information collected for one purpose for a new purpose without further consent, unless applicable law expressly permits it. General service-improvement language does not replace any explicit permission required for third-party AI sharing, tracking, or a new use of personal data.

4. Mobile permissions and Apple-specific protections

4.1 Device permissions

Our mobile apps may request permissions in connection with the feature you choose:

The following additional details explain mobile permissions and their purposes. Names and availability vary by operating system, app version, and feature:

• INTERNET: Network access connects the app to our servers, syncs data, and provides real-time updates and online features. It is necessary for those online functions and may not have a separate device permission prompt.
• READ_EXTERNAL_STORAGE / WRITE_EXTERNAL_STORAGE, or the platform's corresponding file and media access: Upload files and documents; download or save reports and documents for offline access; temporarily store data for performance; back up settings and preferences; and process files for the feature you request.
• CAMERA: Capture or scan documents, upload images, and provide camera input for video-conference features where offered. Camera access is active only when you explicitly use the relevant feature.
• LOCATION: Approximate or precise location supports location-dependent functions, such as finding nearby resources or improving location-based recommendations. Precise device location requires your explicit permission, which you can disable in device settings.
• RECORD_AUDIO: Voice commands, dictation, voice notes and recordings, audio input for conferences or meetings where offered, and other voice-enabled features. Audio is recorded only when you actively use the relevant feature.
• NOTIFICATIONS: Account notices, service updates, and other relevant information. You can disable notifications in device settings.

Declining a permission can prevent the specific function that needs it, such as recording with the microphone. We do not condition access to unrelated functionality on enabling optional notifications, location, or tracking, or offer rewards for enabling those permissions.

A device permission is not permission for third-party AI sharing. For example, permission to select a photo or use the microphone does not itself authorize sending that content to an external AI provider. The separate disclosure and permission requirements in section 6.3 still apply.

4.2 Analytics and tracking

Analytics and crash-reporting services help us diagnose failures and understand performance. Their data may include identifiers and technical information; aggregation is not a blanket guarantee of anonymity.

• Analytics services: Third-party tools, such as Firebase Analytics and Crashlytics, help measure traffic, usage trends, screens visited, actions taken, app performance, and crashes. We generally use aggregated analytics to understand trends; underlying technical records can still contain identifiers.
• File access and storage: We access only files and media that you specifically select for upload or that are necessary for app functionality. We do not scan or collect information about other files on your device without your explicit selection.
• Crash reporting: Crash reports and error logs help us identify and fix problems. They may include technical information about your device at the time of a crash, but do not contain personal content from your device.
• Cached data: We may temporarily store app resources, temporary files, and limited user data securely on your device to improve performance and enable offline functionality.
• Mobile identifiers: We or our third-party partners may use Apple's IDFA or Google's Advertising ID for purposes described in this policy, subject to applicable platform requirements and permissions. You can manage applicable identifier, advertising, location, and notification settings on your device.

On Apple platforms, any tracking covered by Apple's App Tracking Transparency framework requires permission through the system's App Tracking Transparency prompt before that tracking occurs. This includes access to the advertising identifier where applicable. AI-sharing permission, acceptance of this policy, and other device permissions do not replace that authorization. You can manage tracking permission in your device's privacy settings. We do not condition app functionality or benefits on allowing tracking.

4.3 Restricted uses of Apple-platform data

The following restrictions apply to data obtained through Apple-platform features and APIs:

• We do not secretly build user profiles or attempt to re-identify people from data represented as anonymous, aggregated, or otherwise non-identifiable, or reconstruct profiles from Apple-provided API data.
• We do not use Contacts, Photos, or other device-data APIs to build contact databases for our own use or for sale or distribution. We do not collect an inventory of other installed apps for analytics, advertising, or marketing.
• Any contact-based communication must be initiated by you for individually selected recipients. Before sending, you must be shown the message and sender identity; recipients must not be preselected or selected through a bulk "Select All" action.
• Information obtained from HomeKit, HealthKit, clinical health records, movement-disorder or ClassKit APIs, or depth and facial-mapping tools must not be used for marketing, advertising, or use-based data mining, including by third parties.
• Where Apple Pay is used, information acquired through it may be shared only to facilitate or improve delivery of goods and services.

These restrictions describe how such data must be treated if a relevant feature is offered; they do not mean that Magica requests access to every API listed here. The App Store and other distribution platforms also apply their own terms and privacy policies.

Our mobile applications are distributed through third-party stores, including Apple's App Store and Google's Play Store. Downloading and using the apps may also be subject to those stores' terms, conditions, and privacy policies. We encourage you to review them.

5. Sensitive information and legal bases

5.1 Sensitive content

Please avoid submitting unnecessary sensitive information, such as health records, government identifiers, financial credentials, or information about another person's private life. Images and recordings may reveal faces, voices, and other sensitive characteristics. Face- or voice-related features can involve sensitive or biometric information depending on the processing and applicable law. Do not upload another person's face, voice, or personal information without the rights and permission needed for that use.

We do not intentionally request unnecessary sensitive personal information, including racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, genetic data, biometric data used to uniquely identify a person, health information, or information about a person's sex life or sexual orientation. If you choose to store sensitive information in the Services, you remain responsible for the permissions and regulatory requirements applicable to your submission and use of it. Workspace owners are responsible for information they and their members choose to provide; this does not remove our responsibilities for processing it.

We cannot promise that a prompt or attachment contains no personal or sensitive information. If you submit it, it is processed as content under this policy and any applicable feature-specific notice; it is not excluded merely because it is inside a file.

5.2 Legal bases

Where European or similar data-protection laws apply, processing may rely on performance of our agreement with you, compliance with legal obligations, protection of your or another person's vital interests where applicable, legitimate interests where permitted, or your consent. Contractual purposes include administering your account, providing access, and charging for paid services. Legitimate interests can include providing and updating the Services, security, communications, permitted advertising measurement, understanding user retention and attrition, preventing problems, and personalization. The applicable basis depends on the purpose and circumstances. Where consent is required, you may withdraw it. A contractual or legitimate-interest basis does not replace the explicit permission required by Apple's rules for third-party AI sharing or tracking, or override Magica's no-training commitment.

6. Sharing information

6.1 Service providers and other recipients

We share information with providers that support hosting, storage, authentication, payments, AI processing, integrations, support, analytics, and security. They need information to carry out their respective functions. We use contractual and other safeguards appropriate to the service and applicable law. Providers may use authorized subprocessors to deliver the service, subject to contractual safeguards and applicable consent requirements, not unrestricted sharing.

Recipient categories include cloud providers, data analytics services, data storage providers, ad networks, finance and accounting tools, payment processors, performance-monitoring tools, social networks, website hosting providers, sales and marketing tools, testing tools, and mobile app development and distribution platforms. Vendors, contractors, and agents processing information on our behalf are subject to contracts designed to safeguard personal information and limit processing to our instructions. Any permitted onward processing must remain subject to applicable safeguards; it is not permission for unrestricted use or disclosure.

We may also disclose information when required by law, to protect rights and safety where legally permitted, in connection with a business transfer subject to applicable protections, or at your direction. Workspace members or administrators may access information according to the workspace's permissions. Content you choose to publish or share may be accessible to its recipients or the public.

• Legal and regulatory requests: Disclosures may be made in response to a subpoena, court order, or other governmental request, subject to applicable law.
• Rights, property, and emergencies: We may disclose information when we believe in good faith it is reasonably necessary to protect Magica, other people, or the public, including responding without delay to an imminent danger of death or serious physical injury where legally permitted.
• Business transfers: Information may transfer in a merger, asset sale, acquisition, closure, or bankruptcy. This policy continues to apply to that information, and a recipient may use it only consistently with this policy and applicable law.
• Your consent or direction: We may disclose information when you authorize or instruct us to do so, subject to the specific permission requirements in this policy.
• Aggregate statistics: We may share aggregated or de-identified information only where it can no longer reasonably identify you, for example aggregate service-usage statistics. This does not permit re-identification or model training by Magica.

We do not sell your personal information to data brokers. Sharing app-collected data is limited to purposes permitted by applicable law and platform rules, including providing or improving app functionality and permitted advertising with the required consent. No general sharing clause authorizes disclosure that requires permission we have not obtained.

Our commitment remains that we do not and will never sell our users' data. We are not a data broker and do not sell your information to companies that want to send you unsolicited marketing emails.

Team and workspace access: Joining a team or workspace can give its administrator access to your account information according to that workspace's permissions. Ask the team owner for details. Magica personnel access team data only for a security concern for that team and only with its consent. This is distinct from the automated processing needed to fulfill your requests and disclosures required by law.

6.2 Third-party AI providers: what is shared and why

Magica uses external AI services, not just on-device processing. Depending on the feature, model, and processing route, recipients can include the providers below. Not every request goes to every provider.

The information sent can also include relevant saved context, extracted file text, connected-service results, and technical request metadata. A file URL may allow a provider to retrieve the file itself. If you include your name, email, or other personal information in content, that information may be part of the request; account-related information is not automatically removed from prompts.

A model's brand is not always the company hosting it. Routing services and fallback processing can involve additional recipients. The applicable sharing notice must identify the recipients and purposes covered by your permission, including routed processing, before personal data is sent. Adding a provider or changing a purpose outside that permission requires an updated disclosure and renewed permission where required.

6.3 AI sharing and explicit permission

In our iOS app, we ask for your explicit permission through a separate AI data-sharing prompt before sending personal data to third-party AI providers. This is separate from accepting general terms or granting device permissions.

The disclosure and permission process must explain:

1. What is sent: the relevant text, context, files, media, or connected-service information.
2. Who receives it: the third-party AI service and any relevant routing or hosting recipients.
3. Why it is sent: the requested AI function and how the information will be used.
4. Your choice: a clear affirmative action to allow sharing and a way to decline it before transmission.

Creating an account, continued use, a preselected control, or merely opening this policy is not that affirmative permission. An operating-system camera, photo, microphone, or tracking permission is not a substitute either. If you decline AI sharing, the request requiring that sharing must not be sent; features that do not require it remain available. Other platforms are also subject to applicable notice and consent requirements.

You may withdraw consent for future consent-based processing by contacting [email protected]. Stop submitting new AI requests while a withdrawal request is being handled. Disconnect connected services to stop future access through those integrations. Withdrawing consent does not undo processing already lawfully performed; deletion requests and legally required retention are handled separately as described below.

6.4 No model training by Magica and provider retention

Magica does not train or fine-tune AI models. We do not use your data to train or fine-tune models, whether for Magica or for another party. This applies to personal and account information, prompts, conversation history, generated responses and other outputs, uploaded documents, images, audio and video, connected-service content, feedback, and data derived from that information. It also applies to aggregated, de-identified, or anonymized versions of your data. Using the Services does not opt you into model training by Magica, and you do not need to opt out of it.

We process content to fulfill your requests, generate responses, and provide features such as conversation context, saved memory, and file search. Storing or retrieving your content, creating searchable representations of it, or including it in a request to an existing model is not model training. None of the service-improvement, analytics, personalization, or retention provisions in this policy permits Magica to use your data for model training.

Third-party providers have separate practices. Our no-training commitment describes Magica's own activities; it is not a blanket statement that every external provider offers identical training or retention terms. Provider retention, abuse-monitoring, and training terms depend on the service, account arrangement, and feature. The links in section 6.2 provide provider privacy information; applicable service agreements may contain additional protections. Permission to fulfill an AI request does not itself authorize a separate use of personal information to train general-purpose models.

No training does not mean no storage. We do not promise that every provider deletes content immediately, retains it for a fixed number of days, or offers zero retention. Magica's retention and deletion practices are described in section 7. Contact us if you need details about a particular provider or feature before sending sensitive content.

6.5 Connected apps and external websites

When you authorize an integration, the connected service and integration infrastructure, such as Composio, may process the information needed to retrieve content or perform actions. Retrieved content can become AI context for your task, so connecting an app does not replace the AI-sharing permission described above. You can disconnect integrations in the Services and revoke access with the connected provider.

If you follow an external link or independently give data to another service, that service's privacy policy applies to its own processing. Review permissions and recipients before authorizing a connection or publishing content.

7. Retention, deletion, and your choices

We keep personal information for as long as needed for the purposes described here, including providing the Services, security, legal obligations, resolving disputes, and enforcing agreements. Retention depends on the information and purpose, not one universal deadline. Provider-held copies may follow different contractual or legal retention requirements.

We generally discard information when it is no longer needed for the purposes for which we collected and used it and we are not legally required to keep it.

• Access and correction: Update available account information in the Services or contact us to request access or correction.
• Account and content deletion: You can delete your account and information yourself using the in-app deletion controls described in our documentation, or contact us for help. Deletion may involve verification and handling organization, billing, security, or legal obligations. Deleting a chat, disconnecting an integration, and deleting an account are different actions.
• Consent withdrawal: Contact us to withdraw consent for future processing based on consent. This does not affect processing already lawfully carried out.
• Integrations: Disconnect services you no longer want to use and revoke provider access where appropriate. Disconnecting does not automatically erase content already retrieved or copies already shared.
• Marketing: Use the unsubscribe link in promotional email, manage notification preferences in your account settings, or contact us. Essential account and service notices may still be sent.
• Device controls: Manage camera, microphone, photo, location, notification, and tracking permissions in device settings.

Uninstalling the mobile app does not delete your server-side account, previously submitted content, or a provider's retained copies, and does not automatically cancel a subscription. Contact [email protected] for help with privacy requests. We may need to verify your identity and authority over the information before acting.

Uninstalling stops further collection by that installed mobile app. Device settings can also limit collection, such as by disabling location or notifications. You can ask us to stop using your account and information; requests may take time to investigate and facilitate and are subject to applicable retention obligations. If information is associated with an organization you currently belong to or previously belonged to, that organization's policy may govern how long it uses the information it controls. Disconnect integrations to revoke future access; this does not automatically delete copies already obtained.

8. Children's privacy

The Services are not directed to children under 13, or under 16 in the European Union. We do not knowingly collect personal information from children under those ages. If you are a parent or guardian and believe a child has provided information without your consent, contact us. If we learn that we collected information from a child under the relevant age without parental consent, we will take steps to remove that information from our servers.

9. Regional privacy rights

Depending on where you live and applicable law, you may have rights to access, correct, delete, or obtain a portable copy of personal information; restrict or object to processing; withdraw consent; or opt out of certain advertising or sharing practices. California residents may also have rights under the California Consumer Privacy Act (CCPA) and other state laws to know the categories of information collected, used, and disclosed, delete information, opt out of its sale, and exercise applicable rights without unlawful discrimination. We do not sell your personal information.

Contact us using section 16 to exercise a right. Rights can be subject to legal exceptions. You may also complain to the relevant data-protection authority where applicable.

10. International processing

Magica's U.S. operations. Magica is operated by GalaxyAI Inc, a U.S.-based company. Magica's own data storage and processing take place in the United States. If you use the Services from outside the United States, your personal information is transferred to, stored, and processed in the United States to provide the Services.

Third-party processing. Our service providers, including third-party AI providers and authorized subprocessors, may process information in the United States or other countries where they operate. The locations depend on the feature, provider, and applicable service arrangements. This policy does not promise that every third-party operation is confined to the United States. Data-protection laws in those countries may differ from the laws in your country of residence.

Cross-border safeguards. We take steps required by applicable law for cross-border processing, including contractual and other appropriate safeguards where required. International transfers remain subject to the purposes, sharing restrictions, and applicable permission requirements described in this policy; this section does not authorize additional uses or replace explicit AI-sharing consent. Contact [email protected] for information about the processing locations and safeguards applicable to a particular feature, transfer, or provider arrangement.

11. Cookies and similar technologies

Cookies and similar technologies support sign-in, preferences, service operation, analytics, and, where applicable, marketing measurement. Browser controls can remove or restrict cookies, although blocking essential cookies can affect functionality. Where consent is required for non-essential technologies, those technologies require that consent. Browser cookie settings do not replace Apple's App Tracking Transparency permission or third-party AI-sharing permission.

Most browsers accept cookies by default. You can normally change browser settings to remove or reject them, although this may affect the availability or functionality of the Services.

12. Security

We use technical and organizational measures intended to protect personal information, including access controls, encryption, authentication tools, and protections for data transmission and storage. Our data-protection protocols are designed to prevent unauthorized access, use, disclosure, alteration, or destruction. We monitor the Services for potential vulnerabilities and attacks. No online service or security measure is infallible. Please protect your account credentials and avoid submitting information unnecessary for the task.

13. Responsible company

GalaxyAI Inc, USA is responsible for the processing described in this policy. For information controlled by your employer or another organization, contact that organization as well as us where appropriate.

14. Changes to this policy

We may update this policy and will revise the date above. Where required, we will provide additional notice of material changes. An updated policy or continued use of the Services is not a substitute for fresh permission when a new purpose or disclosure requires it.

We encourage you to check this page periodically. We record changes in the change log below and may provide additional notice through a blog statement, email, or our mobile applications. Further use of the Services is subject to the updated policy, but is not treated as consent where a separate affirmative choice is required.

October 6, 2026 update: Clarified AI processing and recipients, Magica's no-model-training commitment, explicit-permission requirements, Apple-platform restrictions, content handling, retention, and privacy controls. Retained the existing collection, mobile-permission, analytics, security, and account-control disclosures while clarifying workspace processing and authorized subprocessors. Explained Magica's U.S. storage and processing separately from third-party processing locations and cross-border safeguards.

15. Translations

This policy was written in English. If a translation differs, the English version controls to the extent permitted by applicable law.

16. Contact us

For questions, privacy requests, or consent withdrawal, contact:

GalaxyAI Inc

8 The Green STE A, Dover, DE 19901, USA

Email: [email protected]