Privacy Policy

The Magi Wand is a design community. The website is operated by [legal name of the operator — to be confirmed]([legal form of the operator — to be confirmed]). Address: [public contact address — to be confirmed]. Contact: [general contact email — to be confirmed].

For the personal data described here, the operator decides why and how it is processed (in Indian data-protection terms, the “data fiduciary”).

India’s Digital Personal Data Protection Act, 2023 and Rules, 2025 are being brought into force in stages; most obligations on organisations are scheduled to apply from May 2027. We aim to follow their principles now. This notice does not claim that we meet every obligation of any law, and it does not replace legal advice.

We do not currently ask for phone numbers, government IDs, financial details or sensitive categories of data, and the site does not currently accept file uploads. If that changes, we will update this notice before collecting the new data.

We use your data to create and run your account, authenticate you, keep the service secure, let staff review role applications, and contact you about your account. You provide the data in order to use these features. Where we need your specific consent for something optional, we will ask for it separately and you will be able to withdraw it. Creating an account is not treated as consent to unrelated uses.

Your profile is private by default. A profile can be shown publicly only if the member turns that on, and when it is on, everything in that profile (name, headline, bio, location, skills and similar fields) is visible to anyone, including people who are not signed in. Your email address is not part of the profile. The screen to turn public visibility on is not available yet.

You can sign in with email and password, an emailed sign-in link, or Google. If you choose Google, we ask Google only for your basic profile and email (the “openid”, “email” and “profile” scopes). We receive your name, email address and profile photo link. We do not request access to your Google contacts, Drive, calendar or other Google data. Google’s own privacy policy governs what Google does with your sign-in activity.

• Supabase – authentication, database and sending of authentication emails.
• Vercel – hosting of the website; processes request data such as IP addresses in server logs.
• Google – only if you choose Google sign-in.
• Hostinger – the mail service through which authentication emails are sent, and our domain services.

These providers act on our behalf under their own terms. Some may process data on servers outside India. The hosting regions we use are [to be confirmed]; we do not claim that your data stays in India. We do not sell personal data, and we do not currently share member data with partners or advertisers. If we ever want to share member data with a partner, we will explain the purpose and ask for your permission separately first, unless the law requires otherwise.

The site uses only the cookies needed to keep you signed in (set by our authentication system). We do not currently use analytics, advertising or tracking cookies. If we add them, we will update this notice and request consent where required.

We keep account and profile data while your account exists. We have not yet set fixed retention periods for every category, including backups, server logs and audit records, and we will not state a period we have not defined. Audit records of staff actions may be kept after an account is removed, with the link to the person removed where possible.

You can ask us to:

• tell you what personal data we hold about you and how we use it;
• correct or complete inaccurate data;
• delete your account and personal data, subject to anything the law requires us to keep;
• withdraw any consent you gave for a specific optional purpose;
• nominate someone to exercise these rights for you if you die or become unable to.

There are no self-service screens for these requests yet. Email [privacy and grievance email — to be confirmed] from the address on your account and we will handle the request manually. We may need to verify your identity first. We will respond within [response time — to be confirmed].

The Magi Wand is intended for people aged 18 or over. We do not knowingly collect personal data from anyone under 18. If you believe a child has created an account, contact us and we will review and remove it.

We use access controls enforced in the database, so members can read only their own private records and staff access depends on assigned permissions, and we rely on the security measures of our providers. No online service can guarantee absolute security. If a personal-data breach affecting you occurs, we will notify those affected and the authorities as the law requires.

Contact [name or role of the person who handles complaints — to be confirmed] at [privacy and grievance email — to be confirmed]. If you are not satisfied with our response, you may have the right to complain to the Data Protection Board of India once that mechanism applies to you.

We will update this notice when our practices change and show the new date at the top. For material changes we will give notice through the site or by email.