Privacy policy

Who operates this service

Magma operates the console at app.magma.tm. Contact contact@magma.tm for privacy questions and requests about your information. This notice describes the current project and Google Analytics connection features.

Information we use

Magma uses your email address to send sign-in codes and associate your account with a workspace. We store workspace and project details you provide, session information and security records such as IP address, browser information and abuse-prevention counters. Your browser keeps essential session cookies and temporary sign-in or draft state so sign-in, retries and navigation work.

If you connect Google Analytics, Magma receives your Google account identifier and email, authorization tokens, and the names and identifiers of accessible Analytics accounts and properties. We use these to distinguish your connections, let you select a property for each project and check that access still works.

Google's permission screen requests read-only Analytics access. This release uses account and property metadata; it does not fetch Analytics reports or metrics. Your Google password is not collected.

How information is used and shared

We use information to provide the service you request, secure accounts, prevent misuse and handle support or privacy requests. Connections and project selections belong to the workspace. A connected Google identity can differ from your Magma sign-in email.

Google data is used for the connection features you request. It is not sold, used for advertising or used to train general-purpose AI models. This release does not send your Google data to an AI service. Magma follows the Google API Services User Data Policy, including its Limited Use requirements.

Railway hosts the application, Supabase stores application data, Resend delivers sign-in emails, and Google authorizes the connector and supplies Analytics metadata. These services process information needed for their roles. The current Supabase database is in Frankfurt; other services may process information in other locations. Contact us for details about the processing locations and transfers relevant to you.

Storage, disconnection and deletion

Google authorization tokens are encrypted on Magma's server and kept while the connection is needed. Disconnecting in Magma immediately removes that connection's tokens from the live database and stops its workspace access. Account/property metadata and saved selections remain so you can see disconnected choices and reconnect. Disconnecting does not erase all retained information.

Workspace and project information stays while it is needed to provide your workspace and recover saved choices. Unlinking affects one project's selection. Deleting a project removes its live record and links; minimal identifiers remain to prevent repeated old requests from recreating it. Contact us to request erasure of eligible retained account, workspace or connector information.

Expired temporary sign-in and authorization records are periodically cleaned up. Database abuse-prevention counters are periodically removed after 30 days without use. Stopping sign-in does not currently erase a workspace automatically; request deletion if you no longer want it retained.

Recovery backups can contain information already erased from the live database until those backup copies expire. They are for disaster recovery and are not part of ordinary console access. Their lifecycle depends on the hosting recovery window; contact us for the applicable details. A restoration must preserve completed deletion requests before normal service resumes.

Removing Magma's broader permission in your Google Account is a separate action that can affect other connections or workspaces using that grant. Magma does not silently perform that broader revocation when you disconnect locally.

Security and your choices

Magma uses server-side access checks, encrypted Google tokens and encrypted network connections. Only people authorized to operate or support the service should access information needed for that purpose. No system can guarantee absolute security.

Depending on applicable law, you may request access, correction, deletion, restriction, objection or portability, and may complain to the relevant data-protection authority. Send requests to contact@magma.tm. We verify your identity and authority proportionately and normally respond within one calendar month, explaining any lawful extension or specific information that must be retained. We do not need your Google password or tokens to process a privacy request.

Changes to this notice

We update this notice when the service's data practices change. Material new uses of Google data require an updated disclosure and any authorization required by Google's policies before that new use begins.