MagiSend
MagiSend Legal Center • Policy & Compliance
Privacy & Google API User Data Policy

Privacy Policy & Data Protection

Last updated: October 30, 2026 • Publisher: Magicraft Solutions • Core Architecture: 100% Local-First Privacy

Plain Language Summary: Your Privacy is Absolute

1. Application Identity & Scope

This Privacy Policy applies to the MagiSend desktop application (for Windows and macOS) and associated licensing services operated by Magicraft Solutions (Surat, Gujarat, India, Contact: [email protected]).

MagiSend is desktop software designed to personalize Gujarati wedding invitations (કંકોતરી - Kankotri) with guest names and dispatch them directly to recipients via WhatsApp from the user's personal computer.

2. Local-First Privacy Architecture (Data That Stays on Your PC)

MagiSend is built on a strict local-first privacy manifesto. The following sensitive operational data is processed and stored exclusively on your local computer and is NEVER transmitted to, stored on, or analyzed by our servers:

  • Contact Lists & Spreadsheets: Your imported CSV and Excel spreadsheets containing guest names, telephone numbers, and custom message variables.
  • Invitation Documents: Your original PDF cards and all generated personalized PDF invitation cards.
  • WhatsApp Session Tokens: Your WhatsApp Web browser session files (LocalAuth session directory).
  • Diagnostics & Application Logs: Operational logs remain on your computer. When manually exported for technical support, all telephone numbers, names, and credentials are cryptographically redacted automatically.

3. Google API Services & OAuth User Data Policy

When you choose to authenticate or sign in to MagiSend using Google Sign-In, we request and access only the following limited user data from your Google Account:

  • Email Address: To verify your account identity, deliver passwordless verification OTPs, and issue transactional purchase receipts.
  • Display Name & Profile Picture: To personalize your account badge in the desktop app's Settings header.
  • Google User Identifier: A unique cryptographic ID string provided by Google OAuth to securely link your purchased Event Passes to your identity.

How Google User Data is Handled:

• Purpose of Collection: Strictly for user authentication, licensing verification, and active quota entitlement management in the MagiSend application.

• No Sale or Third-Party Sharing: Magicraft Solutions does not sell, rent, trade, or transfer Google user data to any third-party advertisers, data brokers, or marketing platforms under any circumstances.

• No Artificial Intelligence (AI) Training: Google user data is never used to train, fine-tune, develop, or improve artificial intelligence or machine learning models.

• Prohibited Content (AI NCII) Compliance: MagiSend does not utilize Google APIs or technologies to create, generate, host, process, or distribute Non-Consensual Intimate Imagery (NCII) or sexually explicit material.

4. Google API Limited Use Requirements

MagiSend's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

5. Minimal Information Processed by Our Licensing API

When you authenticate, activate a pass, or run a sending job, our stateless Cloudflare Worker API and Supabase database store strictly the minimal metadata required for access and billing:

  • Email Address: Used solely for account identification, transactional receipts, and security notices.
  • Transaction Records: Purchased plan tier, price, Razorpay payment reference, and timestamps.
  • Machine Hardware Hash: A salted SHA-256 cryptographic hash of your system GUID to enforce the 2-PC seat limit per pass without collecting hardware serial numbers or personal data.
  • Quota Reservation: An integer tally of recipients reserved and settled per run. No guest names or recipient phone numbers are ever held by our servers.

6. Third-Party Sub-Processors

We partner exclusively with SOC-2 and PCI-DSS compliant infrastructure partners:

  • • Razorpay Software Pvt. Ltd.: Payment processing for UPI, credit/debit cards, and net banking. We never receive or store card or banking details.
  • • Cloudflare Inc. & Supabase Inc.: Serverless edge compute runtime and encrypted PostgreSQL cloud storage.

7. User Control, Access Revocation & Account Erasure (DPDP Act 2023)

Under India's Digital Personal Data Protection Act (DPDP) 2023 and Google API developer requirements, you maintain full control over your personal data:

  • Revoking Google Access: You can disconnect and revoke MagiSend's access to your Google Account at any time via Google Account Permissions Settings.
  • Complete Account Erasure: To delete your MagiSend account and all associated licensing records, email [email protected] with the subject "Data Erasure Request". Our team will permanently purge your authentication account, device hashes, and active records within 7 business days, retaining only statutory tax invoices as mandated by Indian law.