Privacy Policy

Data MagicLess Handles

• Connected inbox identity: Gmail account identifiers and email addresses returned by Composio.
• Login email artifacts: likely OTP values, magic-link URLs, password-reset URLs, sender, subject, timestamp, confidence, and source account metadata.
• Page context: the current page origin, page title, and short sanitized login-form hints such as field labels and headings.
• Product feedback: feedback text and contact email only when you submit feedback.
• Diagnostics: short-lived status records with hosts, confidence buckets, and hashed URL fingerprints.

Data MagicLess Does Not Collect

• Raw page HTML.
• Cookies.
• Passwords.
• Form values already typed into pages.
• Browsing history beyond the page where MagicLess is invoked.
• Raw email bodies stored long-term.
• Advertising identifiers.

How Data Is Used

MagicLess uses connected Gmail access only to find fresh login artifacts and return the smallest useful result to the extension. The extension shows a Fill/Open action on the matching page. MagicLess does not submit forms automatically.

MagicLess does not sell user data, share user data for advertising, or use user data for credit, lending, employment, or eligibility decisions.

Storage And Retention

• OTPs and login links are short-lived. Backend login events expire after about 10 minutes.
• The extension removes cached login events after they are consumed or become stale.
• Diagnostics are session-only and expire automatically.
• Connected account records live in Composio until removed through MagicLess settings or the connected provider.

Processors

MagicLess uses:

• Composio for Gmail account connection and Gmail API access.
• Vercel for hosting the MagicLess backend.
• Redis-compatible durable storage for short-lived login events and push subscriptions when event delivery is enabled.
• Resend for QA emails and product feedback emails.

Contact

Questions or removal requests: nikita@sendblue.com