Privacy Policy

Last updated September 18, 2026

magicping ("we", "us") operates the Instagram automation platform at https://magicping-poc.vercel.app. This policy explains what we collect, why, and how you can control or delete it. magicping is open-source and self-hostable — if you are running your own instance, update this page with your own entity and contact details.

Data we collect

Instagram account metadata (username, profile picture), contacts derived from comments and DMs, conversation content, automation definitions, and basic account/workspace details (email, workspace name). Access tokens are encrypted at rest (AES-256-GCM). We also process standard server log data (IP address, request metadata) for security and debugging.

How we use data

To deliver comment → DM automations, the unified inbox, and analytics you configure. We do not sell personal data, and we do not use your contacts' data for advertising.

Legal basis

We process account and workspace data to perform our contract with you (providing the service) and contact data you import from Instagram under your legitimate interest in running the automations you configure, subject to Meta's Platform Terms and the opt-out handling built into magicping.

Third parties we use

Depending on how an instance is configured, data may pass through:

Meta Graph API — to send/receive Instagram messages on your behalf.
Supabase — database hosting.
Upstash — job queue and caching infrastructure.
OpenAI — optional, only if an AI provider key is configured, for generating DM copy suggestions.
Razorpay / Stripe — optional, only if billing is configured, to process payments.

None of these providers are used unless the corresponding integration is configured.

Cookies

We use only strictly-necessary cookies to keep you signed in. See our Cookie Policy for details.

Retention

Configurable retention per workspace. Deleted data is purged within 30 days.

Data deletion

You can delete a contact, delete workspace data, or request account deletion from Settings at any time. For Meta compliance, POST /api/data-deletion accepts Instagram's signed data-deletion callbacks. You can also email support@magicping.in to request deletion of your data.

Children's privacy

magicping is a business tool for creators and is not directed at children. We do not knowingly collect personal data from anyone under 16.

International transfers

Depending on where you and your chosen infrastructure providers are located, data may be processed outside your country. Where required, we rely on standard contractual clauses or equivalent safeguards with our processors.

Changes to this policy

We'll update the "Last updated" date above when this policy changes materially.