Privacy policy

Magic Guardian shows you where your time goes on your devices and puts obstacles in front of what you said brings you no value. To do that it records what you use. This policy explains what it records, why, who processes it for us, and the choices you have, including how to have your account and history deleted. It covers this website, the web app at my.magicguardian.app, our browser extension, our Mac helper and our Android app.

Who we are

Magic Guardian is provided by The Software Station (Pty) Ltd, a company registered in South Africa (registration number 2019/073147/07) at Somerset Links Office Park, Ground Floor, Gleneagles Building, Somerset West, 7130, Cape Town, South Africa.

In this policy, "Magic Guardian", "we" and "us" mean The Software Station (Pty) Ltd. Write to support@magicguardian.app about Magic Guardian or anything in this policy.

The Software Station (Pty) Ltd is the responsible party (the controller) for the information described in this policy. You can reach our Information Officer at support@magicguardian.app.

Your account

You sign in on our sign-in service at auth.magicguardian.app, with a code sent to your email address, a passkey, Google or Apple. We keep your email address and the identifier the sign-in service gives your account. If you sign in with Google, Google tells us your email address and name. If you sign in with Apple, Apple tells us your email address, or a private relay address if you choose to hide it, and your name if you choose to share it. Passwords and passkeys stay with the sign-in service and never reach Magic Guardian.

Each device you connect gets its own key from us, and we keep its name (such as "Vivaldi on Mac"), its kind, when you connected it and when it last reported.

What your devices record

Your devices record only while you use them, and pause when you are idle, when the screen is locked and when the computer sleeps. They send what they recorded to our server, which keeps it with your account.

• The browser extension records the site in front and for how long: the page address in full, including anything after a question mark, and the page title. On YouTube it also records the video's title and channel, how you got to it (search, a feed, a link or autoplay) and its kind of content, such as educational or entertainment, as YouTube describes it. Chromium browsers don't run extensions in private windows unless you allow it.
• The Mac helper records the app in front and for how long, with its window title if you allow it in macOS's Accessibility settings.
• The Android app records the app in front and for how long. It also counts how often you pick up and unlock your phone, and keeps that count on the phone.
• Obstacles. When Magic Guardian puts an obstacle in front of something, it records which one, what you did (turned back, went through, used an override) and, for an Intention, what you typed it was for and for how long.

From these we keep a daily total of time and opens for each app and site, so the day's picture and your budgets work across every device.

What we don't collect

Magic Guardian does not read the contents of pages, messages or documents, does not record keystrokes, take screenshots or record the screen, and does not collect your location, contacts or photos.

Your rules and settings

We keep the rules you set, how much each app or site is worth to you, what Focus and Lockdown cover and when they run, your time zone, the emergency overrides you use, and changes waiting for their 24 hours. These make Magic Guardian work the same on every device.

Google Calendar, if you connect it

You can connect your Google Calendar so your meetings appear on your day and Magic Guardian can put at least a pause in front of things you said bring no value while you are in a meeting. Access is read-only. We read the start and end times and titles of your events, and whether you declined them, and keep only meetings: no attendees, descriptions or locations, and we hold meetings only briefly to show them. We keep Google's access key encrypted, and the email address of the Google account you connected, so the web app can show which calendar it is. You can disconnect at any time in the web app, and we then delete the key, that address and the meetings we held.

Magic Guardian's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use calendar information only to show your meetings and apply the meeting rule, never for advertising, and we don't send it to Anthropic or anyone else beyond the providers below.

Label suggestions

To save you labelling every new app and site by hand, Magic Guardian asks Claude, an AI model made by Anthropic, to suggest whether each one is valuable, neutral or of no value. We send only names and titles: the app or site name, a few page or video titles, and YouTube channel names, along with labels you have given before. We never send page addresses, your account's email address or your name. Titles are sent as they are, though, so if a page or video title contains a name or other personal details, that text goes with it. You confirm or change each suggestion, and nothing is labelled without you.

Page analytics and error reports

• Page analytics. On this website and in the web app we count page views and how long a page stays open, with your browser and device type, screen size and the page that referred you. In the web app, query strings are removed from the addresses we count. PostHog, which runs these counts for us in the EU, sets a random identifier in your browser so repeat visits are counted once, and receives your IP address. It never receives your account or email address.
• Error reports. When something goes wrong on this website, in the web app or on our server, an error report goes to Sentry, in the EU. It describes what failed and where, with your browser type and the version of the app.
• Technical logs. Our servers keep operational logs so we can keep Magic Guardian secure and find and fix faults.

How we use it

• To show you where your time went, across your devices.
• To apply your rules, modes and obstacles on every device you connect.
• To suggest labels and when Focus would help, from your own numbers.
• To answer your messages.
• To keep Magic Guardian secure and to find and fix faults.
• To understand which pages are used, so we can improve Magic Guardian.
• To meet our legal obligations.

We rely on what you ask us to do when you connect a device or a calendar and set your rules, and on our legitimate interest in running a secure, working service. Your history is yours: we do not show it to anyone else, we do not sell personal information, we do not use it for advertising, and we do not send marketing email.

Who processes it for us

We use the following service providers. Each processes information only to provide its service to us.

• Amazon Web Services: hosting our server, this website, our sign-in service and the sign-in emails, in Ireland.
• MongoDB Atlas: our database, hosted on Amazon Web Services.
• Anthropic: the label suggestions described above.
• Google: sign-in with Google if you choose it, and Google Calendar if you connect it.
• Apple: sign-in with Apple if you choose it.
• Cloudflare: our domain's DNS.
• PostHog: the page counts described above, in the EU.
• Sentry: error reports, in the EU.

We may also disclose information where the law requires it, or to protect the rights and safety of people using Magic Guardian.

Where we keep it

Our server, database and sign-in service are hosted in the European Union, in Ireland. Our team works from South Africa and can access information when running and supporting Magic Guardian. Some providers above, including Anthropic, may process information in other countries, including the United States, while they handle it for us. Where information leaves the country it was collected in, it is protected by the providers' data-protection terms.

How long we keep it

We keep your account, your rules and settings, your connected devices and your daily totals until you delete your account. We keep the detailed records your devices send (each stretch of time, its page or window title and address) for now as well; we are deciding how long to keep them before only the daily totals remain, and will update this policy when we do. Label suggestions are kept with your account so the same thing isn't suggested twice. When you unlink a device, it stops recording and its key stops working; what it already sent stays in your history. We keep emails for as long as we need them to help you, and for a reasonable period afterwards as a record. Our database backups expire on a rolling schedule.

Deleting your account

To delete your account and everything we keep with it, email support@magicguardian.app with the subject "Delete my account" from the email address on your account. If you signed in with Apple and chose to hide your email, write from any address and include the relay address Apple made for Magic Guardian. We may ask you to confirm the request comes from you. We then delete your account, your sign-in, your devices, your rules and settings, your history and daily totals, your label suggestions and any calendar connection. Backups expire on their rolling schedule and are not edited.

Children

Magic Guardian is for people aged 18 or over, or younger people with the consent of a parent or guardian. We have not yet built anything for parents to set rules for a child's devices. If you believe a child has created an account without that consent, email us and we will delete it.

Security

Information is encrypted when it travels over the internet and when it is stored. Access is limited to the people and systems that need it. No system is perfectly secure; if you believe you have found a vulnerability, email support@magicguardian.app.

Your rights

You can ask us what we hold about you, ask us to correct or delete it, object to how we use it, or withdraw a choice you made, such as connecting your calendar. Write to support@magicguardian.app and we will respond. You can also complain to South Africa's Information Regulator. If you live in the United Kingdom you can complain to the Information Commissioner's Office, and in the European Union to your local data-protection authority.

Changes to this policy

If we change this policy, we will update it here and change the date at the top. If a change significantly affects how we use your information, we will tell you in the web app before it takes effect. See also our terms of service.