MagicLess

MagicLess Privacy Policy

Last updated: September 27, 2026

This policy covers the MagicLess Chrome extension, the MagicLess server it talks to (at composio-otp-bridge.vercel.app), and this website, magicless.io. “We”, “us” and “our” mean the business that runs MagicLess.

The Short Version

• MagicLess reads recent email only from Gmail inboxes you connect, and only to find a sign-in code or sign-in link for the page you are on.
• It never sends, deletes, labels or changes your email, and it never presses a button or submits a form for you.
• It does not read passwords or cookies, and it never sends what you type into web pages.
• In a lookup, email text is processed to find the code and is not stored. Codes and links found by a lookup go to your browser and are not kept on our server.
• We do not sell data, show ads, or use Gmail data to train AI models.

How MagicLess Uses Data, Step by Step

1. Install. When you install the extension, our server creates a random MagicLess ID for your browser, and the extension keeps it on your device. You do not need an account, and we do not ask for your name.

2. Connect Gmail. You connect an inbox through a Google sign-in run by Composio, our Gmail connection provider. Google’s consent screen shows what access is requested before you agree. Composio keeps the authorization for that connection, together with the inbox’s account ID, and MagicLess never sees your Google password. To show your inboxes in settings and to check Pro status, our server reads each connected inbox’s email address from Gmail. The free plan connects one inbox, and Pro connects up to five.

3. Page check, on your device. The extension’s page script runs on the websites you open so that it can notice a sign-in or verification screen. That check happens in your browser. It skips password fields, and for a code field it only checks whether something is already in it; it never sends what you typed. Nothing is sent to us for a page that is not a sign-in or verification page, unless you start a lookup yourself.

4. Lookup. When a page asks for an email code or a sign-in link, MagicLess starts a lookup: automatically by default, or only when you click if you turn automatic lookups off in settings. The extension sends our server the site’s address without the path (for example https://example.com), the page title, up to eight short text hints from the page such as a heading or a field label, a summary of the code field, and a one-way fingerprint of the page that lets MagicLess recognise the same page again. Our server then searches each connected inbox, up to five, through Composio and Gmail. The search covers the last day of email in all folders, including spam and trash, and looks for sign-in style messages and for a few words from the site’s name, the page title and the hints; if nothing matches, it takes the newest messages of that day. It reads up to eight messages per inbox and fetches the full text of up to three of them, picks out likely codes and sign-in links, and keeps only those from email that arrived in the last 15 minutes. It sends the best matches to your browser: the code or link, the sender, subject and time of the email, and which inbox it came from.

5. Whether to show the card. During each lookup, our server asks Typesafe, an AI service that classifies pages, whether the on-page card should appear. It sends a description of the page (the site’s domain, the title, the text hints and the field summary) and, when a match was found, a description of the match: whether it is a code or a link, how confident MagicLess is, the domains of the sender and of the link, and short fixed labels that explain the match. It never sends the code, the link, the sender’s full address, the subject or any email text. We use Typesafe only to get a show-or-hide answer for that request.

6. You act. MagicLess fills the code or opens the link only when you click, and copying a code puts it on your clipboard. MagicLess never presses a button for you, although some sites submit on their own once a code is entered.

New-mail notifications. Our server can also receive notice of new messages from Composio, so that a code is ready before you ask. The current version of the extension does not turn this on, but it may still be on for an inbox that was connected with an earlier version. For an inbox where it is on, our server reads each new message to look for a sign-in code, a sign-in link or a password reset link. It keeps the sender, recipient, subject, date and a preview of up to 2,000 characters of each new message for up to 10 minutes, and any code or link it finds, with its sender, subject and inbox, for up to 10 minutes. If browser push is used for this, a push message carries the event’s reference, its type, the site’s domain and the time, never the code or link, and the browser’s push address, browser details and extension version are kept for up to 90 days.

Feedback. If you send feedback through MagicLess, our server emails it to us: your message, the email address you give, the page address, your browser details, the extension version and your MagicLess ID.

What Is Stored, Where, and for How Long

• In the extension, on your device: your MagicLess ID and your settings, until you uninstall. Lookup results, including found codes and links, are kept in browser session storage, which Chrome clears when you close the browser; stale results are removed sooner. A short log of recent lookup steps, used for troubleshooting, drops entries older than 30 minutes and is also cleared when you close the browser.
• At Composio: the connection, its authorization and the inbox’s account ID for each inbox you connect, until you remove the inbox in MagicLess settings (which deletes the connection) or revoke access in your Google Account. Your MagicLess ID is valid for up to a year; when it runs out, the extension gets a new one and you connect your inboxes again. A connection made under an old ID stays at Composio until you revoke it in your Google Account or ask us to remove it.
• On our server: nothing from a lookup is kept after the lookup ends, apart from logs. Inbox email addresses read for settings are held in server memory for up to 15 minutes. Short-term storage holds the new-mail notification data described above for up to 10 minutes, rate-limit counters (a hashed form of your MagicLess ID and IP address) for up to an hour, and Pro status for up to 400 days after the last subscription update.
• Server logs: our hosting provider keeps technical logs for a short period. Our log entries include your MagicLess ID or a hashed form of it, and record things like the site’s domain, the sender’s domain, the link’s domain, the length of a code and whether a match was found. When a lookup finds nothing, they also record, for up to six of the messages checked, the sender’s domain, the domains of links in the message and similar technical signals. Logs never contain a code, a full link, a sender’s address, a subject or email text.
• Email you send us: kept for as long as we need it to help you, or until you ask us to delete it.

What MagicLess Does Not Collect

• Passwords, cookies or session tokens from websites.
• What you type into web pages, or raw page HTML.
• Your browsing history. We receive only the address of a site where a lookup runs.
• Email older than one day, or email in inboxes you did not connect.
• Long-term copies of email text.
• Advertising identifiers.

Google User Data and Limited Use

MagicLess uses Gmail data only to find sign-in codes and sign-in links for you, to show which connected inbox they came from, to show each inbox’s email address in settings, and to match an inbox’s email address to a Pro purchase. It reads messages; it never sends, deletes, labels or changes them.

• We transfer Gmail data only as needed to provide these features: to Composio, which makes the Gmail requests for us, and to our hosting and storage providers. Typesafe receives only the signals derived from a match that are described in step 5, never email content.
• We do not sell Gmail data or use it for advertising, and we do not use it to decide credit, lending, employment or eligibility.
• We do not use Gmail data, or anything derived from it, to develop, improve or train AI or machine learning models.
• No person at MagicLess reads your email, except when you ask us to (for example by forwarding a missed code for support), when needed for security or to comply with the law, or when the data has been aggregated and anonymized for running the service.

MagicLess’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements, and to the Chrome Web Store User Data Policy.

MagicLess Pro Payments

Pro is sold through Stripe checkout. Stripe collects your card or wallet details and processes the payment under its own privacy policy; we never see your full card number. We receive your email address, your Stripe customer ID and your subscription status and, if you upgrade from the extension, your MagicLess ID, so that we can turn Pro on. We keep this for up to 400 days after the last subscription update.

This Website

magicless.io uses PostHog, through the site’s own address, to measure how the website is used: pages viewed, the page that sent you here, clicks, time on page and scrolling, browser and device type, errors and request timings, an approximate location worked out from your IP address, and a few named events such as running the demo, whether the demo sees the extension, and reaching the welcome page after install. It also records some sessions. Anything typed into a form field is masked in your browser before a recording is sent, but a recording keeps the full address of each page, including anything after “?”. PostHog stores a first-party cookie and a local storage entry to tell visits apart. We use no advertising cookies. Our analytics does not currently respond to Do Not Track or Global Privacy Control signals; a content blocker that blocks /pa.js stops it.

When a request to this website identifies itself in its user agent as a crawler, a bot, a monitoring or link-preview service, a headless or scripted client, or the Claude app’s built-in browser, our server sends PostHog one event with the name it matched, the page path and the user agent string. It does not record a location or create a visitor profile. The extension itself contains no analytics.

Companies That Process Data for Us

• Composio: the Gmail connection and Gmail requests.
• Google: Gmail itself, under your Google account terms.
• Vercel: hosts the MagicLess server and this website.
• Upstash: storage for the server, provided through Vercel, for the short-term data and Pro records described above.
• Typesafe: the show-or-hide decision for the on-page card.
• Stripe: Pro payments.
• PostHog: website analytics, for magicless.io only.
• Resend: sends product feedback and our own test email from the server.
• Mailgun and Google Cloud: receive and archive email sent to our support address. We also use AI tools to help us read and answer that email.

We also disclose information when the law requires it, to protect people’s safety or our legal rights, or to a buyer if MagicLess is ever sold, in which case this policy continues to apply to it. We do not sell personal information or share it for targeted advertising.

Your Choices and Rights

• Turn off automatic lookups in the extension settings, so that a lookup runs only when you click.
• Remove an inbox in the extension settings. This deletes its connection at Composio.
• Revoke access at any time in your Google Account, in the list of third-party apps and services with access to your account, where the connection may appear under Composio’s name. Do this as well as removing the inbox if you want to be sure Google’s grant is withdrawn. Uninstalling the extension does not by itself remove an inbox connection.
• Ask us what we hold, or ask us to delete it, by emailing jimmy@magicless.io. We may ask you to write from the connected inbox so that we know the request is yours.

Depending on where you live, for example in the EEA, the UK, California, Colorado, Connecticut or Virginia, you may have further rights, such as a copy of your data, a right to object, and a right not to be treated differently for using your rights. We honor these requests wherever you live. If you are in the EEA or the UK, we process Gmail data and page details to provide the service you asked for, and website analytics and security logs on our legitimate interest in running and protecting MagicLess. You can also complain to your data protection authority.

Security

Traffic between the extension, our server, Composio and Gmail is encrypted. Your MagicLess ID is a signed token, the extension never holds your Google authorization, and access to our systems is limited to the people who run MagicLess. No system is perfectly secure; if you believe your data has been exposed, email us at once.

Where Data Is Processed

Our server and this website run in the United States, and our providers may process data in the United States and in other countries. If you use MagicLess from outside the United States, your data is transferred there.

Children

MagicLess is not directed to children under 13, and we do not knowingly collect their data. If you believe a child has connected an inbox, tell us and we will delete the data.

Changes to This Policy

We update this page and its date when our practices change. Before we use Gmail data in a new way, we will tell you in the extension and ask for your consent.

Contact

Questions, deletion requests or privacy concerns: jimmy@magicless.io. The rules for using MagicLess are in our Terms of Service.