Privacy policy.

magpie is run by one person. There is no data protection officer because none is required (Art. 37 GDPR, § 38 BDSG). Please send privacy questions to the address above.

magpie is a web app for managing projects, modules and electronic components. We process the data you enter so that the app works, and only for that. There is no advertising, no tracking, no analytics and no sale of data. That is also why there is no cookie banner: we only set cookies that sign-in needs (section 11).

Some features need services from other providers: the server (Hetzner, Germany), email (Resend, USA), bot protection for the demo (Cloudflare, USA) and the AI features (Google, USA). Details follow below; the most important point is section 6.

When you open any page, the server necessarily processes your IP address, the requested path and information about your browser. The web server in front of the app writes no access log. Application errors end up in a server log and may in rare cases contain an email address (for example when a mail could not be delivered). This log is used for troubleshooting only.

Fonts and images come from our own server. Opening the website loads nothing from Google Fonts, a CDN or any other third-party server.

Legal basis is Art. 6 (1) (f) GDPR: our legitimate interest in secure, working operation.

For an account we store your name, email address and a password. The password is stored only as an Argon2id hash, never in plain text. For each sign-in we store a session with IP address, browser identifier and expiry time, so that you can see under Settings › Sessions & devices where you are signed in and end sessions you don't recognise.

To slow down password guessing, we count requests to sign-in, sign-up and password reset per IP address in our database for a short time window.

When you choose a new password, we check whether it appears in known data breaches. Only the first 5 characters of a SHA-1 hash of the password go to the service “Have I Been Pwned”. Neither the password nor your identity can be derived from that.

If you sign in with Google, Google sends us your name, email address and, if available, your profile picture; Google learns that you sign in to magpie. Signing in with Google is optional.

Legal basis is Art. 6 (1) (b) GDPR (contract for using magpie); for the breach check, the request limit and the session overview also point (f) (protecting your account).

Projects, modules, parts, storage places, order lists, boards, uploaded images and PDF files and chats with the AI assistant: we store all of this in your workspace so you can work with it (Art. 6 (1) (b) GDPR). Members of the same workspace see the same data. Changes are logged (who, what, when, without content) so a team can trace who changed something (point f).

If you share a board by link, people with the link can view it read-only. Guests enter a name that the other viewers see. You can revoke the link at any time, and it expires anyway.

If you send feedback through the feedback button, we store your text together with your account, the workspace, its plan and your role in it. Unless you untick it before sending, we also store the page you wrote from, your browser identifier, window size and language. The dialog shows what is included before you send. Only the operator reads feedback, to improve the app (point f); members of your workspace don't see it. It is deleted together with your account.

Part scan, cart import, AI fill-in and the chat assistant use the language model Gemini by Google (Google LLC, USA; for users in the EEA Google Ireland Ltd.). Only when you explicitly trigger one of these features do we send to Google:

• for a scan: the photo you take or upload,
• for a cart import: the pasted text or screenshots,
• for the chat: your message with any attached images, the conversation so far and the workspace data the assistant looks up to answer (such as project or part names),
• for price research: only the name or type designation of the part,
• for the order inbox: the cleaned text of a forwarded or pasted order email, or the pasted screenshots (section 9).

Make sure nothing personal is in the picture: faces, address labels, documents. Screenshots of a cart or an order email and photos of a parcel label often show delivery address and order number. We don't store these images, but they go to Google for analysis. In the chat, only the file name, size and a short note by the AI about what the image showed (without names and addresses) remain.

What Google does with it: We use the paid Gemini API. Under Google's terms, prompts and responses are not used for training or to improve Google products. Google keeps them for 55 days to detect abuse. For price research Gemini uses Google Search; Google keeps those requests for 30 days.

Transfer to the USA: Google is certified under the EU-US Data Privacy Framework; the transfer is based on the European Commission's adequacy decision (Art. 45 GDPR).

Legal basis: Art. 6 (1) (b) GDPR. The AI features are part of the service you use and only run when you click. You can use magpie entirely without them.

Your own key: If your workspace stores its own Gemini key, requests run through your own Google account and its terms. We store the key encrypted (AES-256-GCM).

For every AI request we store a usage entry (type, model, number of tokens, duration, success) without content, to calculate your quota and keep costs in view (points b and f).

To identify a scanned part and find prices, we query the catalogues of electronics distributors (depending on setup Mouser, DigiKey, oemsecrets). Only the search term goes there (e.g. “ESP32-WROOM-32”), never the photo and nothing that points to you. Legal basis: Art. 6 (1) (b) GDPR.

We send confirmation, password and invitation emails through Resend (Resend, Inc., USA). Resend receives the recipient address and the content of the email. The transfer is based on standard contractual clauses (Art. 46 (2) (c) GDPR). If Resend reports that an email was permanently undeliverable or marked as spam, we note the address and don't send there again. We also count sent and received emails to stay within the provider's daily limit; the address is stored there only as a hash.

Legal basis: Art. 6 (1) (b) GDPR (emails that belong to using the service) and point (f) (deliverability).

Every workspace can use an order inbox: its own address to which you forward order and shipping emails from shops and carriers, by hand or with a filter in your mail program. magpie turns them into suggestions for orders and parcels. Instead of forwarding, you can also paste an email as text or screenshot; the same applies then.

Who receives the email: Resend (section 8) receives forwarded emails for us; we fetch subject, sender, text and HTML from there. We never fetch attachments: invoices carry addresses and customer numbers, and only the text is analysed. We never open links in the email; at most we read them, for example to recognise a tracking number in a tracking link.

What we store and for how long: We keep subject, sender address and content of the email for at most 7 days so you can review a suggestion and repeat an analysis; then we delete them. If the email is not an order email (advertising, newsletters, account emails), we delete the content immediately after the analysis. Rejected emails (inbox paused, old address, too large) are stored without content from the start. What stays permanently is only what results from it and what you confirm in the app: shop, order and tracking number, items, prices, status and, for parcels ready for pickup, the pickup point with its number (such as “Packstation 112”) and the pickup deadline. No address, no phone number, no pickup code. In addition there is one log entry per email (time, sender domain, result).

Protection against too much: If many emails arrive in a short time from senders that don't look like a shop or carrier (for example because a whole mailbox is forwarded by mistake), magpie pauses the order inbox and deletes these emails immediately. Emails to an unknown address are discarded without fetching their content.

Analysis by AI: We recognise many emails without AI (structured data from shops, carrier emails, known tracking number formats). For the rest the text goes to Gemini (section 6). Before that we black out address blocks, phone numbers and email addresses. This is not perfect, and a greeting with your name (“Hi Kim”) stays in the text. Pasted screenshots go to Gemini unredacted for transcription; we don't store them. We also check the result for anything that looks like an address or phone number.

Legal basis: Art. 6 (1) (b) GDPR. The order inbox is a feature you set up yourself and trigger with every forward. If an email contains information about other people (such as a contact person at the shop), we rely on point (f): our legitimate interest is to analyse the email for you; the short retention and the redaction limit the intrusion. Please only forward emails about your own orders.

If you join the waitlist at the end of the home page, we store your email address, the language of the page, the link you came from and the times of signup and confirmation. We don't store your IP address; it is only counted briefly in memory to slow down mass signups.

Your signup only counts once you confirm it with the link in the confirmation email (double opt-in). We delete unconfirmed signups after 30 days. We only write to you when it is your turn for access. Legal basis is your consent (Art. 6 (1) (a) GDPR); you can withdraw it at any time with the unsubscribe link in every email or by writing to us. Unsubscribing deletes the entry completely.

You can also vote for planned features on the home page, without an account. Your first vote sets a cookie with a random value, valid for one year, so that each browser counts once per feature and you can take your vote back. We only store a checksum of that value, the feature and the time of the vote, and nothing that connects the vote to you. Your IP address is only counted briefly in memory to slow down mass votes. Legal basis is our legitimate interest in knowing which features are wanted (Art. 6 (1) (f) GDPR). There is no fixed deletion date for votes; we delete them once we no longer need the vote.

We only set technically necessary cookies: a session cookie after sign-in, a session cookie for the demo while it runs and, when you open a shared board as a guest, a guest cookie for that link. If you vote for a planned feature on the home page, a cookie with a random value remembers your vote (see the waitlist section). Your browser also remembers some display settings in local storage (such as the last view you chose). None of this is used to recognise you beyond magpie. Legal basis: § 25 (2) no. 2 TDDDG, Art. 6 (1) (b) GDPR.

The website, the app and the database run on servers of Hetzner Online GmbH (Industriestr. 25, 91710 Gunzenhausen, Germany) in the Nuremberg data centre. Uploaded files are stored there too.

As long as your account exists. You can delete it yourself at any time under Settings › Your data; we then immediately remove your account, sessions and all workspaces in which you are the only member, including uploaded files. In workspaces with other members, shared content stays for the team; log entries then show “deleted user”. A workspace owner can empty or delete a workspace at any time. The list of recently scanned, not yet saved parts is limited to a few entries; we delete the content of forwarded emails after 7 days at the latest (section 9). Statutory retention obligations (for example for invoices) remain unaffected.

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You can withdraw consent at any time with effect for the future (Art. 7 (3)).

Much of this works without us: under Settings › Your data you download all data of the active workspace as a ZIP and delete your account yourself. For everything else, an email to info@magpie.parts is enough.

You can also complain to a data protection supervisory authority (Art. 77 GDPR), for example the one where you live.

The AI makes suggestions (part name, price, technical data) that you check before anything is saved. It makes no decisions with legal effect for you (Art. 22 GDPR).

You start the demo without an account, email address or password. We create a throwaway account with its own example workspace. It contains only made-up example data and what you enter yourself during the 15 minutes. When the time is up, we automatically delete the account, workspace and uploaded files. During the demo we set a technically necessary session cookie. If you use the AI features in the demo, section 6 applies.

Before the start, Cloudflare Turnstile (Cloudflare, Inc., USA) checks that you are human. Cloudflare processes your IP address and characteristics of your browser. Without this check, bots could start the demo en masse and drive up our costs. The app also counts starts per IP address in its database to limit them (section 4). Legal basis is our legitimate interest in protection against abuse (Art. 6 (1) (f) GDPR). Transfer basis for Cloudflare (DPF or SCC) still to be checked