Privacy policy

Last updated 12 October 2026

Magici is a journal app that keeps your entries, photos and videos in your own Google Drive. This page explains what Magici can see, what it stores, and what it doesn't.

The short version

• Your photos, videos and voice recordings live in a Magici folder in your Google Drive. They never go through our servers.
• The words you write are stored on our server, encrypted, so the app can load them quickly. A readable copy of every entry is also saved in your Drive.
• Magici can only see the files it created. It can't see anything else in your Drive.
• We keep a record of who has signed up: your name, email address and Google account ID.
• We don't sell your data, show ads, or use your journal to train AI.

Your journal

Photos, videos and voice recordings go from your device straight to your Google Drive. Magici asks Google for the drive.file permission only, which lets it create and read the files and folders it made, and nothing else in your Drive. Large photos are saved at up to 2048 pixels on their longest side, as a JPEG, which also leaves out the location stored inside the photo file. Videos larger than 1080p are converted to 1080p on your device before upload, unless you choose to keep the original.

Each entry's title, text and location are sent to our server and stored encrypted, with a key that is unique to you. The date and time, the tags you add, the type and size of each photo, video or recording and its length, and their Google Drive file IDs are stored without encryption, so your journal can be listed in order and filtered by tag. Your photos, videos and recordings themselves are never stored on our server.

A readable copy of every entry (entry.json) is also saved in the entry's folder in your Drive, so your journal is still yours if you stop using Magici.

While you write, Magici keeps an unsaved copy of the moment, with any photos, videos or recordings you added, in your browser on that device, so nothing is lost if the page closes or saving fails. It never leaves the device, and it's removed when the moment is saved, when you discard it, or when you sign out.

To load your timeline quickly, Magici also keeps small copies of your photos (thumbnails, up to 100 MB) in your browser on that device. They never leave it, you can clear them on the Account page, and they're removed when you sign out.

Dates and locations are read from your photos' and videos' metadata on your device. You can remove the location before saving.

Magici uses your microphone only while you record a voice note, after your browser asks you to allow it. The recording is saved to your Drive. Nothing is listened to or transcribed.

What we store

When you sign in, we store:

• your Google account ID, email address and name
• when you first signed in and when you last used Magici
• whether your account is active
• your journal entries, encrypted as described above

We use this to run the service, count how many people use Magici, and block abuse. It's stored in a database hosted in Sydney, Australia. Nobody at Magici reads your entries, except where you ask us to for support or the law requires it.

If something breaks in the app, your browser sends us a short error report so we can fix it: what went wrong, where in the app, the page (without any search words) and your browser type. It never includes your journal. Reports are kept in our server logs for a short time.

Staying signed in

To keep you signed in, our server receives a token from Google that lets it get short lived access to your Magici files in Drive. That token is encrypted and kept in a cookie in your browser, not in our database. Short lived access tokens are held briefly in server memory. Signing out revokes the token with Google and removes the cookie.

Your browser also remembers your name, email and profile picture so it can show "Continue as" next time. Signing out clears this.

Services we use

• Google for sign in and Drive storage.
• Cloudflare hosts the website. Like any web host it handles your IP address and requests. We also use Cloudflare Web Analytics to count visits and see which pages are used. It doesn't use cookies, doesn't track you across sites, and never sees what's in your journal.
• Google Cloud runs our server, in Sydney, Australia. Requests are logged for security and troubleshooting.
• Neon hosts the database described above, including your encrypted entries, in Sydney, Australia.
• The contact form: what you write, your name and email are emailed to us through Cloudflare, and Cloudflare Turnstile checks you're not a bot. In the Magici apps there's no Turnstile check; your sign in is used instead, and the email address you're signed in with is added to the message.
• Links you paste: our server fetches the page's title and preview image so it can show a card, and the image is saved in your Drive. YouTube, Vimeo, Spotify, Apple Music, TikTok and Instagram only receive anything when you tap play on one of their links; until then nothing loads from them.
• GIPHY, only when you search for a GIF. Your search words and IP address go to GIPHY. A GIF you pick is saved into your Drive.
• OpenFreeMap draws the map when you open the Map view. Your browser asks it for the map pictures of the areas you look at, so it sees your IP address and those areas, like any map site. Your moments and their pins never go to OpenFreeMap; they're drawn in your browser. Map data is © OpenStreetMap contributors.
• Geoapify turns the location in your photos, or your current location when you ask for it, into a place name, and finds places when you search for one. Our server sends it the coordinates (rounded to about 10 metres) or your search words, and nothing else: no name, account or journal text. The place name is saved with the moment, encrypted. Place data is © OpenStreetMap contributors.
• Push services (Apple, Google, Mozilla or Microsoft, depending on your browser) deliver the daily reminder, only if you turn it on. They get the reminder text, like "You have a memory from 2 years ago", and never your journal text. Turning the reminder off, or signing out, removes it.

Google user data

Magici's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We only use Google user data to provide Magici's features to you. We don't transfer it to others except to run the service as described here, to comply with the law, or as part of a merger or sale with notice to you.

Deleting your data

• Your account and everything stored on our server: choose Delete account in the settings menu. It happens straight away and can't be undone. Your account and every entry are removed, your encryption key is destroyed so no copy left in a backup can be read, and Magici's access to your Google account is revoked. You can also email us and we'll do it for you.
• Your photos, videos, recordings and the Drive copy of your entries: these are in the Magici folder in your Google Drive. They're yours, so they stay unless you remove them. When deleting your account you can choose to move the folder to the Drive trash, where Google keeps it for 30 days. You can also delete the folder in Drive yourself at any time.
• Magici's access only: sign out, or remove Magici at myaccount.google.com/connections.

Children

Magici isn't meant for children under 13, and we don't knowingly collect their information.

Changes

If we change this policy we'll update the date above, and tell you in the app if the change is significant.

Contact

Use the contact form, or email support@magici.app.