Privacy Policy
Last updated: 15 September 2026
The short version. We keep as little about you as we can. You sign in with Google or Apple, and we store your name, email and the lessons you make. We use your data to run the app and nothing else — we do not sell it, and we do not use your schoolwork to train AI models.
The photos you take of your books are never saved on our servers. They are sent to Google's AI to be read, and then they are gone.
You can delete your account, and everything in it, at any time.
1. Who we are
Magic Tutor AI ("Magic Tutor", "we", "us") provides the Magic Tutor website at www.magictutor.ai and the Magic Tutor mobile apps for iOS and Android. We are based in the Kurdistan Region of Iraq.
For anything in this policy, including requests about your data, write to support@magictutor.ai. We answer within 30 days.
2. What we collect
Your account
You sign in with Google or Apple. We never see or store your password. From the sign-in we receive and store:
- a user ID that identifies you to us
- your email address
- your display name and profile picture, where your provider supplies them (if you use Apple's "Hide My Email", we only ever see the relay address Apple gives us)
- which provider you used
What you make in the app
- the lessons that are generated for you, including the subject, the topic and the steps
- any topic or text you type in
- the language you chose, so the app opens in it next time
- your learning streak and how many lessons you have shared
Usage and subscription
- counts of how many lessons you have started today, this week and this month, so we can apply the free and Pro limits
- how much AI processing your account has used, measured in tokens
- whether you are on the free or Pro plan, when it expires, and which store the subscription came from
- the date you joined and the last date you used the app
We do not receive or store your card details. Payments are handled entirely by Apple and Google.
Technical
- a single sign-in cookie on the website, named
mt_token. It is httpOnly, lasts 14 days, and exists only to keep you signed in. We use no advertising or tracking cookies on the website. - ordinary server logs, including IP address, which we also use to stop anonymous abuse of the free tier
3. Your photos and PDFs
We do not store the photos you take. When you photograph a page, the image is sent straight to Google's Gemini AI to be read, and the lesson is built from what it says. The image itself is never written to our disks and never saved in our database.
A PDF you upload is held briefly, because it is too large to keep in memory while the lesson is built. It is stored for one hour and then deleted automatically by the database itself — not by a script that could fail to run.
Lessons built from a photo are treated as one-off: they are never reused or shown to anyone else, and they are deleted after 7 days.
4. Why we use your data
| What for | Why we are allowed to |
|---|---|
| Creating your account and keeping you signed in | To provide the service you asked for |
| Generating and storing your lessons | To provide the service you asked for |
| Counting lessons against free and Pro limits | To provide the service, and our legitimate interest in running it sustainably |
| Checking whether your subscription is active | To perform our contract with you |
| Preventing abuse of the free tier | Our legitimate interest in keeping the service available |
| Answering your emails | Our legitimate interest in supporting you |
5. Who else sees your data
We do not sell your data and we do not share it for advertising. We use these companies to run the service, and they only receive what they need:
| Company | What they receive | Why |
|---|---|---|
| Google (Firebase Authentication) | Your sign-in identity | To sign you in securely |
| Google (Gemini AI) | Your photos, PDFs and the topic text, at the moment a lesson is built | To read the page and write the lesson |
| Apple, Google Play | Your purchase | To take payment and manage subscriptions |
| RevenueCat | Your user ID and subscription status | To tell our server whether you are a subscriber |
| DigitalOcean | Everything stored, as our hosting provider | To run the servers and database |
Google processes your content to return a result to us. It is not used to train Google's models under the paid API terms we use.
We may also disclose data if the law requires it, or to protect the rights and safety of our users.
6. Where your data is held
Our servers are operated by DigitalOcean and our AI processing is performed by Google. This means your data is processed outside your own country, including in the European Union and the United States. Where the GDPR applies to you, these transfers rely on the European Commission's Standard Contractual Clauses.
7. How long we keep it
| What | How long |
|---|---|
| Photos you take | Never stored |
| PDFs you upload | 1 hour, then deleted automatically |
| Lessons built from photos | 7 days |
| Lessons built from a topic you typed | Until you delete your account |
| Your account and settings | Until you delete your account |
| Server logs | Up to 30 days |
8. Your rights
You can ask us to give you a copy of your data, correct it, delete it, or stop using it in a particular way. Write to support@magictutor.ai and we will answer within 30 days, free of charge.
The fastest way to delete everything is in the app itself — see how to delete your account.
If you are in the European Economic Area or the United Kingdom, you also have the right to complain to your national data protection authority.
9. Children
Magic Tutor is built for students, and we expect many of our users to be at school. You must be at least 13 years old to create an account. If you are between 13 and the age of digital consent in your country (16 in parts of the European Union), you need your parent's or guardian's permission to use Magic Tutor.
We do not knowingly collect data from children under 13. If you are a parent or guardian and believe your child under 13 has created an account, write to support@magictutor.ai and we will delete it.
We show no advertising to anyone, at any age.
10. Security
Traffic to Magic Tutor is encrypted with HTTPS. Sign-in is handled by Google and Apple, so we never hold your password. Our sign-in cookie cannot be read by JavaScript. Access to our servers and database is restricted.
No service can promise perfect security, but we will tell affected users promptly if a breach ever puts their data at risk.
11. Changes to this policy
If we change this policy we will update the date at the top of this page. If the change is significant, we will tell you in the app or by email before it takes effect.
12. Contact
Questions, requests or complaints: support@magictutor.ai