Privacy Policy

This policy explains what personal data Pin Magic, operated by Muhammad Ali Qureshi, Bahawalpur, Punjab, Pakistan ("we", "us"), collects when you use pin-magic.com, the Pin Magic Studio, the Pin Magic browser extension and our free Pinterest tools (together, the "Service"), why we collect it, and the choices you have. We have tried to keep it plain. If something is unclear, write to support@pin-magic.com.

1. The short version

• We collect little: your name, email address and account status, the messages and payment screenshots you send us, a random device ID, plus basic technical data needed to run the site.
• Your pins, photos, fonts and Studio library are processed in your own browser. We do not read your blog posts or WordPress dashboard.
• We do not sell your personal data and we do not run advertising cookies.
• We use Google Analytics to count visits and understand which pages are useful. You can opt out (see section 7).
• You can ask us to access, correct or delete your data at any time.

2. Data we collect

Account data

When you sign up we collect your email address and, if you give it, your name. We also keep account fields we need to run your plan: your account status (for example pending, active or disabled), the package you have (Studio, Extension, or both), and the dates it was created, activated and expires. If you sign in with Google, we receive your name and email from Google. We never see your Google password.

Passwords

If you sign up with a password, it is handled by our authentication provider and stored in hashed form. We cannot read it.

Contact form, support emails and newsletter

If you use the contact form (name, email, topic and message) or email us, we keep your message and our reply so we can help you and follow up. If you subscribe in the footer, we keep your email address, the page you subscribed on, the date and the consent text you saw, so we can send you Pin tips by email.

Device ID

To enforce one account on one device, the extension and the Studio create a random device ID the first time you use them. It is tied to your account on our server so we can block use on a second device. It does not identify you personally. It stays for as long as your account exists, and changes if we reset your device at your request.

Payment information and screenshots

Payments are made by manual bank or wallet transfer, so we never receive or store card numbers. When you pay, you upload a screenshot of the transfer. The screenshot can show your name, account or phone number and the amount. We use it only to verify the payment, and store it in a private storage area that only you and the site owner can open. We also keep a record of the payment (plan, amount, reference code and status) so we can activate and support your account.

Technical data

Like any website, our servers and hosting provider receive your IP address, browser type, device type and the pages you request. This is used to deliver the site, keep it secure and fix problems.

Website analytics

We use Google Analytics 4 to measure how the site is used: pages viewed, how visitors arrive (for example from Pinterest or search), approximate location (country or city), device and browser type, and basic interactions such as scrolls and outbound clicks. Google Analytics uses cookies and a random identifier to tell visits apart. We use this data only to understand and improve the site. We do not use it for advertising, and we do not combine it with your account details. Analytics is loaded through Cloudflare Zaraz.

Live demo limit

The homepage demo allows one free preview per browser every 24 hours, and up to 5 previews per network address every 24 hours (several people can share one address, for example on mobile data). To apply that limit we store a one-way hash (a scrambled code) of your IP address with a timestamp. We do not store the IP address itself for this purpose, and we use the hash only for the limit. The hash is deleted after 7 days. Your browser also stores a small note in local storage for the same reason.

3. Data that stays in your browser

The Pin Magic Studio runs in your browser. The following are processed on your device and are not uploaded to our servers as part of normal use:

• The blog links you paste and the text and photos the Studio reads from them.
• Photos you upload, fonts you add, and pin designs you create and export.
• Your Studio library and settings, which are saved in your browser's local storage.

Clearing your browser data removes them, so export what you want to keep. When you paste a link, the Studio may fetch that page through the Pin Magic extension, a site's public WordPress or RSS feed, or an image proxy service so photos can be loaded (see section 6).

4. The browser extension

The extension runs on your computer. It can read the page you are on in order to work, for example a WordPress post editor you open, an Instagram post you choose to capture, or a page you paste into the Studio. It uses your browser's storage to save its settings. The extension talks to pin-magic.com so you can use it with your account and the Studio. It does not send your WordPress content, drafts or site logins to us. If you use its image feature with Google Flow, your prompts and images go to Google under your own Google account and Google's terms.

The extension asks for broad browser permissions because it has to work on whichever blog or page you choose. It only acts when you use it. You can remove it at any time from your browser's extensions page.

To check your access, the extension keeps a private connection token (not your password) and the random device ID. It sends them to our server only to check that your account is active and that it is the one device bound to your account. The connection is made when you press "Connect extension" on your dashboard, and it is used only for this access check. Before the extension reads a website for the Studio, it asks you to allow that website, and you can remove that permission for any site in the extension settings.

5. How we use your data

• To create and manage your account and activate your package.
• To provide the Studio, the extension and the free tools.
• To verify your payment and activate your account.
• To respond to contact messages and support requests and send service messages such as activation, expiry and important changes.
• To send Pin tips by email to people who subscribed (unsubscribe at any time).
• To keep the Service secure, prevent abuse and apply the demo limit.
• To meet legal, tax and accounting duties.

If you are in the European Economic Area or the UK, our legal bases are: performing our contract with you (running your account and plan), our legitimate interests (security, preventing abuse and improving the Service), legal obligation (accounting records) and your consent where we ask for it. We do not make decisions about you by automated means that have legal or similarly significant effects.

6. Who we share data with

We do not sell personal data. We share it only with providers that help us run the Service, and only what they need:

• Supabase, which provides our login, database and private file storage (account data, device binding, contact messages, subscribers and payment screenshots).
• Resend, an email delivery service. It delivers the notification emails we receive from the contact form and the subscribe form, and service emails.
• Our hosting and content delivery providers (including Cloudflare), which serve the website and receive standard technical data.
• Google Analytics (Google), which receives visit and device data from the website for analytics. See how Google uses data from sites that use its services.
• Your bank or wallet (such as SadaPay or NayaPay), which handles the transfer you make to us. They have their own privacy policies.
• Google, only if you choose to sign in with Google (Google gives us your name and email, processed through Supabase) or use Google Flow through the extension.
• An image proxy service such as images.weserv.nl, which may receive the address of a public photo when the Studio cannot load it directly.

We may also disclose data if the law requires it, to protect our rights and users, or as part of a sale or reorganisation of the business (we would tell you if your data were affected).

7. Cookies and similar technologies

We use only what the Service needs: a login session so you stay signed in, and local storage in your browser for your Studio library, settings, device ID and the demo limit. We also use Google Analytics cookies (_ga and _ga_*, up to 2 years) for website analytics. We do not use advertising or retargeting cookies. You can opt out of Google Analytics with the Google Analytics opt-out browser add-on or by blocking cookies in your browser settings. See our Cookies page for the full list. You can clear or block cookies and local storage in your browser settings, but the Service may then not work properly.

8. How long we keep data

• Account data: while your account exists. To delete your account, write to us from your registered email. We delete your profile and device binding within 30 days.
• Contact messages: 12 months, then deleted. Support emails are kept for the same period unless we need them longer to resolve a dispute.
• Newsletter subscribers: until you unsubscribe. To unsubscribe, email support@pin-magic.com and we remove you within 7 days.
• Payment screenshots: deleted 12 months after the payment is approved. We keep our own accounting record of payments separately, as tax and accounting rules require.
• Device ID: for as long as your account exists, until reset or deleted with the account.
• Demo limit hashes: only as long as needed for the 24-hour limit, and deleted after 7 days.
• Backups: may keep copies for a short period before they are overwritten.

9. Security

We use encrypted connections (HTTPS), access controls and a managed database with row-level security so each user can only reach their own account data. No system is perfectly secure, so please use a strong, unique password. If a breach affects you, we will tell you and the authorities where the law requires.

10. International transfers

Our providers may process data in countries other than yours, including the United States and the European Union. Where required, we rely on safeguards such as standard contractual clauses or equivalent provider commitments.

11. Your rights

Depending on where you live, you may have the right to:

• access the personal data we hold about you and get a copy;
• correct data that is wrong or incomplete;
• delete your data;
• restrict or object to some processing;
• receive your data in a portable format;
• withdraw consent at any time, where processing is based on consent.

Email support@pin-magic.com from your registered account email and we will reply within 30 days. We may need to confirm it is you. If you are in the EEA or UK, you can also complain to your local data protection authority. California residents can ask what we collect and request deletion; we do not sell or share personal data for advertising.

12. Children

The Service is for businesses, bloggers and creators and is not directed to children under 13 (or under 16 where local law sets that age). We do not knowingly collect their data. If you think a child has given us data, contact us and we will delete it.

13. Links to other websites

The Service may link to or work with other sites and tools, such as Pinterest, WordPress, Instagram and Google. Pin Magic is not affiliated with or endorsed by them. We do not control their privacy practices, so please read their policies.

14. Changes to this policy

We may update this policy as the Service changes. We will change the date at the top and, for material changes, tell you by email or on the site. Using the Service after a change means you accept the updated policy.

15. Contact

Questions or requests: support@pin-magic.com, or use our Contact page. See also our Terms of Service, Refund Policy and Cookies.