Privacy Policy

1. Introduction

Magimica is a private planning and follow-through service operated by Perboc Inc., Québec enterprise number 1177319895, at 5441 rue Waverly, Montréal, Québec H2T 2X8, Canada ("Perboc", "we", "us" or "our"). Perboc is responsible for personal information handled through Magimica. This Privacy Policy explains what we collect, why we use it, which providers are involved, how long information is kept, and your choices and rights.

Magimica is designed to collect information needed to provide and protect the service, not to publish your objectives or build an advertising profile. Your objectives and missions are private to your authenticated account unless a future sharing feature clearly tells you otherwise.

2. What we collect

When you create an account, we collect your email address, a securely hashed password, locale, timezone, email-verification state, account timestamps and a record of your acceptance of the Terms. We never store your password in readable form.

As you use Magimica, we store the objectives, missions, target and start dates, dependencies, time estimates, difficulty ratings, points, completion times, actual time, status, completion history, review metrics and planning choices you create. We also store generated objective-image URLs and generation status.

For authentication and security, we process hashed session and refresh-token values, hashed verification and password-reset tokens, expiry and revocation status, essential CSRF values, and request or technical log information needed for rate limits, security, troubleshooting and service operation. Depending on infrastructure configuration, this may include IP address, request time, route, response status, user agent and error details.

3. How we use your data

We use account data to create and secure your account, verify your email, maintain and refresh sessions, recover access, record consent and communicate essential service information. We use planning data to display your workspace, validate dates and dependencies, calculate progress and review metrics, and preserve your work across devices.

We use relevant planning information to provide AI-assisted mission suggestions, mission splitting and objective illustrations. We also use technical information to prevent abuse, enforce limits, investigate errors and secure and improve the beta. We may create aggregated or de-identified operational information that no longer identifies you. We do not sell or rent personal information and do not use it for third-party behavioural advertising.

4. Artificial intelligence and service providers

Magimica uses OpenAI services for planning suggestions and generated objective illustrations. Depending on the feature, we send objective text, target dates, existing mission text, estimates, accepted sub-missions and optional context to OpenAI. OpenAI returns suggested text or image data. We do not send your password. Avoid placing confidential, regulated or highly sensitive personal information in planning fields. OpenAI processes submitted data under its applicable business-service terms and privacy commitments, which may change independently of Magimica.

We use Amazon Web Services for generated-image storage through S3 and transactional account email through SES. These configured services operate in AWS region us-east-2 (Ohio, United States). Generated images are stored under randomized object identifiers and may be delivered through a public image URL; avoid objectives whose generated illustration could itself reveal sensitive information.

Our production PostgreSQL database is hosted by Render in its Oregon, United States region. Other hosting, logging or delivery providers used for deployment may process information only as needed to operate and secure the service. Because OpenAI, AWS, Render and other providers may process data outside Québec or Canada, foreign laws may permit access by courts, law-enforcement or national-security authorities. We assess providers and use contractual or other safeguards where required by law.

5. Cookies and local storage

Magimica uses essential cookies for authenticated sessions, session refresh and cross-site request-forgery protection. The primary session cookie lasts up to one hour; refresh and CSRF cookies last up to 30 days unless cleared or revoked earlier. Authentication cookies are SameSite=Lax and are marked Secure in production; session and refresh cookies are not accessible to browser scripts. The CSRF cookie must be readable by the application to protect account actions.

The service stores your light or dark theme preference in browser local storage. The current product does not use advertising cookies or an analytics platform. If optional analytics or marketing technologies are introduced, we will update this policy and provide any consent controls required by law before using them.

6. Sharing and disclosure

We share personal data only with service providers acting on the service's behalf, when you direct us to, when needed to protect users or the service, in connection with a legitimate business transfer, or when required by applicable law.

Magimica does not sell your personal data. We do not make your email, objectives, missions or completion history public. If future collaboration or sharing features are added, they will describe what becomes visible before you use them.

7. Retention and deletion

We keep account and planning data while your account is active and as reasonably needed to provide the beta, resolve disputes, enforce agreements, protect the service and comply with law. Verification links expire after 24 hours, password-reset links after 30 minutes, primary sessions after one hour and refresh credentials after 30 days. Expiry prevents further use, but related database records are not yet removed by an automated cleanup schedule. Logs, backups and generated image objects may persist for technically reasonable operational, security and recovery periods.

Direct account deletion and export controls are not yet available in the current interface. Until they are, send a verified request to contact@pebroc.com or by mail to Perboc at the address below, marked “Privacy Officer.” After verification, we will delete or de-identify information that is no longer required, subject to legal holds, fraud and security records, consent evidence, backups and technical limitations. The current product does not automatically remove an S3 image object when its objective is deleted; we will address associated image objects as part of a verified account-deletion request where reasonably possible.

8. Security

Magimica uses safeguards including password hashing, hashed session and recovery tokens, email verification, secure cookie settings in production, cross-site request-forgery protection, request validation and rate limiting. Generated planning output is validated before it is used by the application.

No online service can guarantee absolute security. Use a unique password, keep access to your email secure, sign out on shared devices, and report suspected unauthorised access through the service's published contact channel.

9. Your rights and choices

Subject to applicable law, you may request access to or correction of personal information, withdraw consent where processing relies on consent, request deletion or de-indexing in appropriate cases, ask about categories of people with access, and obtain information about automated processing and processing outside Québec. You may also complain to the Commission d'accès à l'information du Québec or another competent privacy authority.

You can correct much of your planning information directly in Magimica and choose whether to accept text suggestions. Creating an objective currently initiates an AI-generated illustration, while mission suggestions and splitting are user-requested. For account-level access, correction, portability or deletion requests not available in the interface, contact the Privacy Officer by mail. We will verify identity and respond within the period required by applicable law. Withdrawing consent may prevent us from providing features that require the information.

10. Children

Magimica is intended only for people aged 18 or older. We do not knowingly collect personal information from minors. If you believe a minor has created an account or provided personal information, contact our Privacy Officer so we can investigate and delete it where appropriate.

11. Changes to this policy

This is an MVP policy for an evolving beta. We will update it as Magimica's features, providers, retention practices and business model develop. Material changes will be reflected by the effective date and, where appropriate or required, announced in the service or sent to the email associated with your account. If law requires fresh consent, we will request it before the new processing begins. Earlier versions may be retained to document consent or compliance.

12. Contact

Perboc's Privacy Officer is responsible for Magimica's privacy program. For any privacy question, complaint, access or correction request, consent withdrawal or verified deletion request, email contact@pebroc.com or write to: Privacy Officer, Perboc Inc., 5441 rue Waverly, Montréal, Québec H2T 2X8, Canada.

Include the email associated with your Magimica account and enough detail to understand the request, but never send your password or authentication tokens. We may ask for additional information to verify identity.