Privacy Policy
Who is responsible
First Step Magic is operated by [OPERATOR LEGAL NAME], at [BUSINESS / CONTACT ADDRESS], in [COUNTRY OF ESTABLISHMENT]. Privacy and support contact: [SUPPORT / PRIVACY EMAIL]. These details and the applicable regional disclosures need to be completed before this notice becomes final.
Information and purposes
We process your email and authentication records to sign you in; account, time zone and subscription details to manage access; and your inputs, generated steps, execution runs, saved ideas and completion counts to provide the workspace. Usage records include request identifiers, model usage, timing, costs and action events. Product events use identifiers, device category and local dates rather than input or idea text. Hosting and authentication providers also process connection and security information, which can include IP addresses, browser information and request metadata.
AI requests
When you request an AI-generated step, the original input for that run, the request type and, for regeneration, rejected steps from that run are sent through OpenRouter to a model endpoint. The application does not deliberately add your email, account ID, unrelated ideas or other runs to the model prompt. Information you type can itself identify you. Just start, saving an idea, Done and End do not invoke AI. Do not submit passwords, payment card details, sensitive health information or other people's confidential information.
AI provider limits
The model developer and the company hosting a model endpoint may be different. Routing can vary. The actual downstream endpoint, account logging settings, processing locations and retention terms have not all been verified. We therefore do not promise zero retention, exclusion from training, or processing in a particular country. Provider security and legal obligations may also apply. Review the provider information linked below before using AI with personal information.
Service providers and disclosures
Supabase provides our database and authentication. Vercel hosts the website and server requests. OpenRouter routes AI requests to model providers. Waffo Pancake is the planned payment provider and acts as merchant of record (the reseller of the subscription); the payment integration has not completed live acceptance. If enabled, Waffo processes checkout, payment, tax and billing information under its own terms and privacy policy. The application sends Waffo your account ID and email for checkout and stores subscription identifiers, status and billing period, not payment card numbers. Sign-in email delivery also involves the authentication service and its configured email delivery providers; a dedicated production email provider is not yet finalized. We may disclose information when required by law or necessary to investigate abuse and protect users, subject to applicable law.
Where information is processed
The currently checked Supabase project is hosted in the US (us-east-1). Hosting, AI, support and payment providers may process information in other countries. A database region does not establish the location of all processing or backups. [CONFIRM TARGET MARKETS, PROCESSING LOCATIONS AND APPLICABLE TRANSFER SAFEGUARDS]. We do not claim that this draft or the use of these suppliers establishes compliance with any particular privacy law.
Retention in the live application
Ideas you have not completed remain until you delete them or your account, including after a subscription ends. Completed ideas, with any linked run text and cached results, are cleared 30 days after completion. For ended runs, original input, step text, rejected steps and linked cached results are cleared after 30 days from the end time. The scheduled check runs every 15 minutes; workspace and export requests also clear overdue text. This is a scheduled process, not a guarantee of removal at an exact second. Abandoned started runs are ended when their activity lease expires. Unstarted previews are not covered by the ended-run deadline and currently have no automatic age-based expiry.
Other records and backups
Account metadata, text-free completion records, request deduplication records and operational events do not currently have a general age-based deletion schedule. Legacy card data is handled separately; the latest check found no legacy cards. [APPROVE LIMITS FOR PREVIEWS, OPERATIONAL RECORDS AND LEGACY DATA]. Encrypted operator-managed database snapshots exist, including authentication data; their expiry and off-site storage policy are not finalized. Deleting live data does not immediately erase a previously created backup or a provider's independent records. [APPROVE BACKUP EXPIRY AND DELETION REAPPLICATION PROCEDURE]. The 30-day run rule is not a promise about backup, log or provider retention.
Export and deletion
Settings lets you download an application-data export and request account deletion. The export is not a copy of provider logs, authentication secrets or every vendor record. Deleting an idea erases the linked run text and cached results tracked by the application, ends linked active runs and preserves text-free completion totals. Deleting an item from the done list works the same way and does not lower the completed count. Separately saved ideas and independently re-entered text are not removed by deleting another idea. Account deletion removes the authentication account and linked application records. If billing cancellation or account removal fails, the request may remain incomplete and can be retried; billing may already have been canceled. Export before deletion if you need your own copy. Payment providers may retain records for their own legal obligations.
Your rights and contact
Depending on applicable law, you may have rights to access, correct, delete or port your information, restrict or object to processing, withdraw consent where processing relies on it, and complain to a competent regulator. Use the settings tools where available; other requests go to [SUPPORT / PRIVACY EMAIL — NOT YET CONFIGURED]. We may need proportionate identity verification. [CONFIRM APPLICABLE LEGAL BASES, REGIONAL RIGHTS, RESPONSE DEADLINES AND REGULATOR CONTACT]. This draft does not replace mandatory rights.
Security, children and updates
We use access controls and encrypted backup files, but no system is completely secure. This service is intended for adults aged 18 or older; it is not designed for children and does not independently verify age. Report suspected child accounts or security issues to the contact above once configured. Material changes to the final notice are communicated before taking effect where required. This draft has no effective date.
Provider information
Supabase privacy · OpenRouter privacy · Vercel privacy
These links describe supplier policies, not confirmation that our account settings or service are compliant.