Privacy policy

Magpie remembers things for you, and it can only do that by reading what you give it. That is the exchange. This page says, in plain words, what it reads and keeps, who helps, what we never do, and how you stay in charge. The short version comes first.

The full policy, for anyone who wants the detail.

Who runs Magpie

Magpie is made by Forest Studio Ltd, a company registered in England and Wales (company number 17496887), at 43 William Drive, Stanmore, HA7 4FZ, United Kingdom. We are responsible for the information this page describes. Write to privacy@forestinc.cloud about any of it.

What Magpie is

You add photos, files, notes, recordings, and links. Magpie reads them, stores the facts, and answers questions from that graph. It runs in the EU.

Magpie is an AI system and will get things wrong. It labels a connection it suggests, and acts on one only if you accept it.

What we collect

What you give Magpie

What you capture (photos, files, voice notes, text, shared links), what Magpie extracts from it, the graph those facts sit on, and your conversations with Magpie. Captures may include health, politics, religion, and faces, yours and sometimes other people's.

Magpie doesn't keep where a photo was taken: the location saved inside a photo is removed before it is stored.

Sign-in

Your identity from Google or Apple: the account id it gives us, and your email (or the Hide My Email address Apple gives us). Sign in with Google and Sign in with Apple make two separate accounts, each with its own graph. Signing out does not delete the graph.

After you delete your account, we keep this identity for 30 days, so the app can still tell you your Magpie is gone, then delete it once no sign-in of yours can be renewed.

What stays after that is the record that your account was erased: the account id, when each step happened, which key was destroyed, and counts of what went, never your email or anything you wrote. That record has no end date: it is how we can show the erasing happened.

Screenshots, if you turn them on

The Screenshots switch in Settings lets Magpie read new screenshots from the moment you tap On, even while the app is closed. It needs full access to Photos: with limited access, the switch stays Off.

Magpie never imports what was already in your library, and shots taken while the switch was Off stay out. The share sheet and the in-app picker work either way.

Calendar, if you turn it on

The Calendar switch in Settings lets Magpie read the calendars you turn on. Each time it looks, it reads from a day back to a year ahead, never from before you turned Calendar on, so an event that ended in the last 24 hours is read too.

For each event it reads the title, its calendar, when and where it is, its notes and link, who organised it, who is invited with each person's response and role, and how it repeats. It never reads your Birthdays calendar or calendars you subscribe to, and skips events you declined.

If you pick calendars for Magpie to write into, it adds your due dates and its own guesses there, where anyone who can see that calendar can read them. It never changes or removes an event you made.

Voice

Conversation audio is discarded after it becomes words. A captured voice note's recording is kept on purpose.

How you use Magpie

Counts of what you do, like capturing something or finishing a task, and when your account was made and whether an invite code let you in. Never what is in any of it. Who keeps these counts, and how, is below.

How much AI your account uses

So one account can't run up costs for everyone, we count how much of Google's AI each account uses: for each day and each model, the text in and out (counted in tokens) and the number of requests. Never what the text said. We keep these counts for 90 days, and delete them sooner if your account is deleted.

We also keep a daily summary of the same kind of counts for each part of Magpie, with how often its checks failed and how long it took, to watch Magpie's quality and cost. It is filed under a random code, not your account id, and kept until your account is deleted.

Invite codes

Magpie is invite-only. When a code lets you in, we keep a record that it did: your account, the code, and when. It stays until your account is erased after you leave, or until we remove it. A code's label says which group or channel it went to, never who.

When a code doesn't work, we keep only which account tried and when, never what was typed, and that is gone within about two hours.

Paying for Magpie

Magpie is a subscription you buy through Apple's App Store, and Apple takes the payment: we never see your card, your bank or your billing address, and we don't keep what you paid. Apple tells us whether your subscription is running: your plan, whether you're in your free trial, and when it renews or ended. It tells us with Apple's own ids for the purchase, and we keep those beside your account so Magpie knows what you can use. We keep them as long as your account, and delete them with it. Apple's own messages about a purchase we keep for thirty days. If you delete your Magpie account, Apple keeps billing until you cancel the subscription in your Apple ID's settings. We count when a trial starts, a subscription starts, renews, ends or is refunded, and when someone turns renewal off, in PostHog, under the same pseudonymous id as Magpie's other counts and never with a price or a purchase id. When an invite let you in, that count also says what kind of invite it was: a plain one, a free month, or a founding year, and never the code.

The waitlist

If you join the waitlist on this website, we keep your email address, what you tell us you use today, and your ADHD answer, but only if you tick the box beside it. That answer is health information, so it is optional, and we keep it only with that tick, the time you gave it and the words you agreed to.

We use your email to send you an invite code, and your answers to decide who to invite first. We delete your ADHD answer when we send your invite, and your whole entry within an hour of you joining with a code we sent you, when you ask, or a year after you signed up, whichever comes first.

We don't check that an address belongs to whoever typed it: if yours is on our list and you didn't put it there, write to us and we'll delete it. The website sets no cookies.

Came from one of our campaign links? We keep the campaign's name with your entry: where the link was shared, never who you are. Each sign-up is also counted by campaign, never with your email; those counts are tied to no account, so they stay if you delete your entry or account. Once you join, your account remembers which campaign brought you, so we can see which ones bring people who stay. That goes when your account does.

We email your invite code ourselves, from our Gmail, so Google keeps a copy, and not only in the EU.

How we use it

To do what Magpie is for: read what you capture, keep the facts, find them when you ask, help you break a plan into steps, and remind you. Nothing else.

The legal basis is your consent. Special-category data about you needs explicit consent, and using Magpie is that consent. The waitlist's ADHD answer rests on the tick beside it.

Turning Screenshots On is a further explicit consent for Magpie to read new screenshots, which often contain other people's messages and faces. Your On tap is your consent, not theirs. Turning Calendar On is the same for your calendars, which hold other people's names and plans; a work calendar may belong to your employer. Off withdraws that consent for anything new.

Counting how you use Magpie, and how much AI your account uses, rests instead on our legitimate interest in running Magpie well and keeping its costs in check. None of these counts holds anything you wrote. You can object to any of them by writing to privacy@forestinc.cloud.

Who helps us run Magpie

Google runs the AI and the cloud Magpie is built on, and PostHog keeps our usage counts:

Captures, including screenshots of other people's messages, go to Google Vertex AI in the EU so Magpie can extract and recall. Conversation audio goes to Google Speech-to-Text in the EU; that recording is discarded after it becomes words. We do not train on your data. If Google's safety classifiers flag a prompt, authorised Google staff may read it for up to 90 days, still in the EU, not to train. We do not look at your graph without asking you, except that Google may, in that flagged case. We count how you use Magpie, like when you capture something or finish a task, but never what's in it. PostHog stores these counts in Frankfurt, under a code instead of your name or email, without your IP address. They're deleted with your account.

Calendar events are captures too, read the same way. Notifications reach your phone through Apple's push service carrying counts and references, never your words; your phone fills those in. Magpie's own code in the app has no advertising or analytics in it: the counts are sent by our server.

If you sign in with Google, the app uses Google's own sign-in library. Google declares that the library may collect your device's approximate location and a phone number, and, for Google's own analytics, an id for you and your device and data about how you use it. That is for Google's purposes, under Google's privacy policy, not ours.

Mail you send to privacy@forestinc.cloud passes through ImprovMX, which forwards it to a Gmail inbox, where Google keeps it, and not only in the EU.

Where it is kept

Files are sealed under a key we can shred (Google Cloud KMS, EU) and stored in Google Cloud Storage in the EU. Magpie's servers and database run on Google Cloud in the Netherlands, the servers on Google Cloud Run. We do not move this data outside the EU.

Google also keeps the service's logs for 30 days. They can include your IP address, and they are not held only in the EU. Lines written before Magpie stopped putting what people shared into its logs could also hold names from it; they are not deleted early, and expire 30 days after they were written, like every other line.

Opening this page does not sign you in and does not send your graph.

What we never do

• We never sell your data, and never show it to advertisers. Magpie has no ads.
• We never use your data to train AI models, ours or anyone else's, and neither does Google.
• We never look at your Magpie without asking you. The one exception is a prompt Google's safety classifiers flag, described above.

Your controls

Turn a source off

Turn Screenshots or Calendar Off in Settings at any time. Magpie stops reading from that moment.

Fix what Magpie got wrong

You can correct a fact Magpie got wrong on the card of the person or thing it is about: open that card in your graph and long-press the fact to end it, or to move it where it belongs.

Delete your account

In the app, open Settings from the person icon on Today and tap Delete account. Magpie waits 30 days so you can change your mind; Keep my account undoes it. After that it is gone, and signing in again starts empty. Anything you capture in those 30 days goes too, unless you change your mind.

What that erasing means, step by step:

• Gone from Magpie now: nothing of yours shows or answers again.
• The stored files become unrecoverable at the next successful key rotation, if that ran.
• Copies can remain up to 7 days in object storage and 14 days in database backups.
• Your sign-in identity goes 30 days later, as described above. The record that the erasing happened stays, with the account id, never your email or anything you wrote.
• Our record of how Magpie ran is not erased: it stays its full 400 days, holding no account id, email or anything you wrote.

Ask us

Write to privacy@forestinc.cloud to ask what Magpie holds, to get a copy of it, to ask us to erase something, or to ask us to restrict or stop a particular use, leaving the waitlist included. We put a copy together by hand and send it to you.

You can complain to the ICO (UK) or to your EU supervisory authority.

How long we keep things

• What you capture, and what Magpie learns from it: until you delete your account.
• Conversation audio: only until it becomes words.
• Your sign-in identity (the account id and email from Google or Apple): while you have an account, and 30 days after it is erased.
• The record that an account was erased (the account id, when, which key was destroyed and counts of what went, never the email or anything written): no end date, as the proof that it happened.
• Usage counts: until your account is deleted.
• How much AI your account uses: 90 days; the daily summary we watch quality and cost by: until your account is deleted.
• An invite code's record of letting you in: until your account is erased after you leave. A code that didn't work: about two hours.
• Whether your subscription is running: as long as your account. Apple's messages about a purchase: 30 days.
• The waitlist: your ADHD answer until we send your invite; your entry until you join, ask, or a year has passed.
• Sign-up counts (by campaign, never your email): kept, since they're tied to no account.
• Service logs, which can include your IP address: 30 days.
• Our record of how Magpie ran, in the EU (random ids, which part of Magpie ran and with which model, counts and timings, and one word for what you did with a suggestion, like kept or dismissed; never what you wrote, your email or your account id): 400 days, also after your account is erased.
• A prompt Google's safety classifiers flag: up to 90 days, at Google, in the EU.

Children

Do not use Magpie if you are under 16.