Your privacy matters. ImprovoMagic is built with privacy-first principles. We collect only what's necessary, never sell your data, and give you full control.
We use your data to:
We DO NOT sell your data. Ever.
We share data only in these limited cases:
You have these rights:
Exercise these rights from your Privacy Settings page.
We protect your data with:
ImprovoMagic uses only strictly necessary cookies — the ones required to log you in, keep you logged in, and (if you choose to enable it) remember a trusted device for two-factor authentication. We do not use analytics, marketing, or advertising cookies. No Google Analytics, no Meta Pixel, no LinkedIn Insight Tag, no third-party trackers of any kind.
Under the EU ePrivacy Directive (Article 5(3)) and UK PECR, strictly necessary cookies are exempt from the consent requirement. We still disclose them in full below so you know exactly what we set and why.
| Name | Purpose | Retention | Category |
|---|---|---|---|
| next-auth.session-token | Keeps you signed in after login. | 30 days | Strictly necessary |
| next-auth.csrf-token | Protects the sign-in form from cross-site request forgery. | Session | Strictly necessary |
| next-auth.callback-url | Remembers where you wanted to go before signing in, so we can return you there. | Session | Strictly necessary |
| mfa_passed | Confirms you just passed a two-factor challenge so the sign-in completes. | 5 minutes | Strictly necessary |
| 2fa_trusted | Set only if you tick "Remember this device" during two-factor sign-in. Lets you skip the 6-digit code on this browser. | 30 days | Strictly necessary (you opt in) |
All cookies above are first-party, marked HttpOnly and SameSite=Lax, and (in production) Secure. They cannot be read by JavaScript on other sites.
Legal basis (GDPR Art. 6): Authentication cookies are processed under Art. 6(1)(b) — performance of the contract you entered into when you created an account. The optional 2fa_trusted cookie is processed under Art. 6(1)(a) — your explicit consent via the "Remember this device" checkbox — which you can withdraw at any time from Security Settings by revoking the device.
Cloudflare Turnstile: Optional bot protection (privacy-first, no cookies).
If this ever changes: if we add analytics or any non-essential cookie in the future, we will update this section, raise a consent prompt before setting it, and give you per-category controls.
ImprovoMagic is not intended for users under 18. We don't knowingly collect data from children. If you believe a child has created an account, contact us immediately.
Your data is primarily stored in EU data centers (Supabase EU region). If you're outside the EU, your data may be transferred internationally. We ensure adequate protections through standard contractual clauses.
We may update this privacy policy occasionally. We'll notify you of significant changes via email. Continued use after changes means you accept the updated policy.
Questions about your privacy? Contact us:
ImprovoMagic was built with privacy as a core principle. We believe you should own your data, understand how it's used, and have complete control. No dark patterns, no hidden tracking, no data selling. Just honest, transparent service.
Built with passion, fueled by Swedish coffee, shared with purpose 🚀