Magwizzy
Privacy Policy
Last updated: November 6, 2026
Magwizzy lets you make a personalised printed magazine from photos and answers you provide. Magwizzy is operated by Cache Brands LLC. This policy covers the Magwizzy website (magwizzy.com) and the Magwizzy Android app. The Android app loads the Magwizzy website. It does not run a separate account system.
For a privacy question or a deletion request, email support@magwizzy.com. This page does not publish a postal address or a company registration number.
Account and sign-in
You can make a magazine without an account. Until you sign in, that magazine is tied to a long-lived cookie named mag_owner. The cookie lasts 90 days by default, and that period is refreshed when Magwizzy saves or loads a magazine for that browser. We store a hash of the cookie, not the cookie itself.
Email account. If you create an account with email, we store the name you enter, your email address, and an argon2id hash of your password. We do not store the password itself. When outgoing email is configured, we can send a confirmation link (the token expires after 7 days) and a password-reset link (the token expires after 1 hour).
Google sign-in. On magwizzy.com, when Google sign-in is turned on, you can sign in with Google. We ask Google for the openid, email, and profile scopes. We store the Google account identifier, name, email, and profile-picture address Google returns for that sign-in. A verified Google email can be linked to an existing email account for the same address. The Android app does not show a Google button. Google sign-in is not offered inside the app’s embedded view.
Facebook sign-in. On magwizzy.com, when Facebook sign-in is turned on, we store the Facebook identifier, name, email, and profile-picture address returned for that login. The Android app does not show a Facebook button.
Session. A signed-in session uses an HttpOnly cookie named mag_customer. It lasts 30 days by default. We store a hash of the session token, together with the IP address and user agent of the sign-in. Expired session rows are deleted. Signing out deletes that session. The account itself keeps your first name. Who a magazine is for, the occasion, and the recipient’s name are stored with that magazine, not as a standing profile.
Photos, answers, and magazine files
We store the photographs you choose and upload, including a copy sized for print and a smaller copy for display, along with the file name and pixel size. We also store your answers, stories, cover title and wording, edits, template choice, and the magazine text and print files made from them (interior and cover PDFs, and preview images). We use this to build, save, preview, edit, print, and deliver the magazine, and to show it when you come back. Upload only photos and personal details you are allowed to share.
On the website, “Pick from Google Photos” (when Google sign-in is configured) asks Google for permission to read items you select in Google’s photo picker. The access token is kept in server memory until it expires. It is not written into the account database. We then download the photos you selected and store them like any other upload.
The Android app opens the system photo picker. You choose the photos. The app does not ask for a permission that would let it read your whole photo library, and it does not scan the library on its own. A foreground task copies the photos you picked into the app cache and shows a notification titled “Getting your photos for Magwizzy”, with a count of how many are done. A second task uploads those copies to your magazine on magwizzy.com and shows a notification titled “Uploading photos”, again with a count. Both can keep going after you leave the app. Android can pause or stop that work, including after a time limit on newer Android versions, and a force-stop ends it. A photo is saved only once Magwizzy has stored it. Those notifications do not include a cancel button. A cached copy is removed after the page has read it, and the upload’s job files are removed after that upload finishes or is permanently refused. If the network fails, the upload is retried later. Closing the picker without choosing a photo copies nothing.
Orders, shipping, and phone number
The order form collects your first and last name, email, phone number (the form asks for it because the carrier needs it), street address, optional apartment, city, state or region, postal code, and country (United States, Canada, the United Kingdom, or Australia), plus the number of copies and a shipping method. We store those details with the order.
As you type a street address, the text is sent to our server, which asks Photon (photon.komoot.io, using OpenStreetMap data) for suggestions. Your IP address is used on our server only to limit how often those lookups run. We do not send a GPS location, and the Android app does not request a location permission.
Payment uses Stripe Checkout. That checkout collects a shipping address for the payment, and the checkout session is limited to United States addresses. Card details are entered on Stripe’s page. If the address Stripe returns differs from the address we quoted, we keep both and hold the order for a shipping check before it is printed.
Payments
Stripe processes the payment, including its own fraud checks, under Stripe’s terms. In this application we do not receive or store the full card number or the card security code.
After payment we store Stripe’s checkout session id, payment intent id, payment status, amounts (magazine, shipping, tax, and total), currency, and the shipping address Stripe collected. From the charge, when Stripe returns them, we also store the card brand, last four digits, a card fingerprint, the card’s issuing country, the billing country, and Stripe Radar’s risk level and score. We use those facts to record the order, to compare billing country and shipping country, and to hold a paid order for a person to review before it is sent to the printer. A held order is not sent to print until it is approved. We can refund the payment through Stripe. Staff mail about a held order can include the order, the shipping address, and those limited card facts. That mail goes to Magwizzy administrators.
Magazine text and photo thumbnails
Answers, names, stories, cover wording, and the other text needed to draft or revise the magazine are sent to the language-model provider configured for Magwizzy. The software can use OpenAI or xAI. If no provider key is configured, replies are produced on our server and that external call is not made. When the vision option is turned on, up to 12 small JPEG thumbnails of photos you have already added can be sent with a “photos are ready” update so the assistant can suggest a cover photo. Writing the articles uses your answers and related text. The print-resolution photo files are not sent to the model for that writing step.
When an OpenAI key is present and moderation is not switched off, text that will be printed, and customer text checked against a narrow illegal-content rule, can be sent to OpenAI’s moderation endpoint. A local word list also runs on our server and does not leave it.
The assistant’s conversation transcript is kept in server memory and dropped after 6 hours without use. Token counts and an estimated cost for that session can be saved and attached to an order. The saved magazine is separate and is not deleted by that 6-hour timer. This policy does not state whether a model provider later uses the text or thumbnails to train a model. That provider’s own terms cover its processing.
Outgoing email is sent through Resend when a Resend API key is configured. If email is instead configured with an SMTP server, the same messages are sent through that server. The provider receives the recipient address, subject, and message so it can deliver the email. A message can include your name, order number, amounts, shipping address, tracking details, a link back to the magazine, and a time-limited link to a cover preview.
The customer messages are: an email-confirmation link, a password-reset link, an order receipt after Stripe marks the order paid, a note when printing starts, a shipped message when we have tracking, and one message when the magazine has been delivered. We also send reminders about an unpaid submitted order (at most two, and not once the order is more than 7 days old) and one reminder about an unfinished magazine that has an account email. Reminder emails include an unsubscribe link. Unsubscribing stores that address and stops further reminders. Order receipts, shipping and delivery messages, and password emails still send. We do not run a separate advertising or newsletter list.
App notifications
The Android app asks for notification permission after you submit a magazine, not when you first open it. If you have already allowed notifications, the app registers again on a later launch without asking. If you allow them, and Android push is enabled on the server, the app sends us a Firebase Cloud Messaging token. We store that token with the guest id and, when you are signed in, the account id.
We use the token to send a payment-received message, a shipped message, checkout reminders, and a reminder that an unfinished magazine is still saved. Tapping a message can open that magazine. If Firebase reports the token is no longer registered, we delete it. Android’s notification settings control whether messages are shown. The photo-copy and upload notifications described above are shown by the app on the phone. They are not sent through Firebase.
Diagnostics
If the app screen restarts shortly after an unclean exit, or a selected photo fails to open, the app can send a short report to Magwizzy. The report can include an event name, how many files failed and how many were in the batch, a file type and size, a short error string, the user agent, Chrome and Android version strings, and, from the app, whether the screen crashed or was killed, a process priority, available and total memory, and a low-memory flag. The report does not include the photograph. We write it to the server log and append it to a diagnostic file that is rotated when the file grows past about 2 megabytes. The product does not delete that file on a calendar schedule. The request can include your existing sign-in cookie. The saved line does not record your account id.
We also use IP addresses to limit repeated sign-in, checkout, address lookup, and similar requests. This app does not include a separate product-analytics or advertising SDK.
Who else receives information
We do not sell your personal data.
- Lulu. When a magazine is sent to print, Lulu receives the print-ready interior and cover files, the title, the quantity, the shipping method, and the recipient name, phone number, and delivery address, so it can print the magazine and hand it to the carrier. The email address on that print job, which Lulu and the carrier use for job questions and delivery notices, is the Magwizzy store address, not yours. Your receipt, printing, and shipped messages come from Magwizzy. The carrier receives the name, phone number, and address it needs to deliver the package.
- Stripe. Stripe processes the checkout, refunds, and the fraud signals described above.
- Resend, or the configured SMTP service. They deliver the emails described above.
- OpenAI or xAI. The configured provider receives the magazine text, and the thumbnails, described above. OpenAI can also receive text for the moderation check when that check is on.
- Google. Google handles sign-in on the website, the Photos picker when you use it, and Firebase Cloud Messaging when you allow Android notifications.
- Facebook. Facebook handles sign-in on the website when that option is turned on.
- Photon / OpenStreetMap. Photon receives the address text you type, so we can offer suggestions.
- Hosting and file storage. Magazine files and the database are stored on the server that runs Magwizzy, or in an S3-compatible bucket when that storage is configured. Lulu downloads print files through a time-limited link.
We may disclose information when the law requires it, or when we need it to investigate fraud, a security incident, or a dispute about an order. We do not publish a country list for each provider. Where a provider keeps a copy depends on that provider.
How we use information
We use it to run accounts and sessions; save and show your magazine; generate and fit text from your answers; place the photos you selected; take payment and review an order that meets the hold rules before printing; send the magazine to print; email you about the order and the reminders above; send the app notifications above; answer support and deletion mail; and diagnose upload and crash failures. We do not use it for third-party advertising.
How long we keep it
Accounts, uploaded photos, drafts, answers, generated magazine files, orders, and notification tokens stay stored so the account and the magazine remain available. The product does not give them an automatic deletion date.
These shorter lifetimes are what the software does today:
- A sign-in session lasts 30 days by default. The expired session row, including the IP address and user agent stored on it, is then removed.
- The guest magazine cookie lasts 90 days by default, refreshed when a magazine is saved or loaded. That expiry does not by itself delete a magazine already saved on the server.
- An unfinished Google or Facebook sign-in is discarded after 15 minutes.
- A password-reset token expires after 1 hour. An email-confirmation token expires after 7 days.
- The in-memory assistant transcript is dropped after 6 hours without use.
- A short-lived progress record for a print build stays in memory for about 15 minutes.
- A Google Photos picker token stays in memory only until it expires.
- Reminder emails are not sent for an order or draft older than 7 days. That limit is about sending the reminder, not about deleting the magazine.
- Diagnostic reports are rotated when the file passes about 2 megabytes, not on a date.
We do not state a backup expiry. How to ask for deletion is on the delete your account and data page.
Your choices
You can remove photos and edit text in the magazine with the controls on the site and in the app. You can refuse Android notifications, or turn them off later in Android settings. You can unsubscribe from reminder emails with the link in those emails. Signing out, or uninstalling the app, does not delete the account or the magazine saved on the server.
To ask us to delete the account and its data, use magwizzy.com/data-deletion, the “Delete account & data” link in the account menu (the ··· menu), or email support@magwizzy.com.
Security
The website is served over HTTPS, and the Android app loads it over HTTPS. The requests this software makes to Stripe, Lulu, Resend, the model providers, Google, Facebook, and Photon use HTTPS. We do not claim that stored copies are encrypted at rest, and we do not claim end-to-end encryption. Do not email a password or a full card number.
Changes
When this policy changes, we will update the date at the top. Questions: support@magwizzy.com.