Privacy Policy

Last updated: March 31, 2026

SpellMaker.ai ("we", "us", "our") respects your privacy. This policy explains what data we collect, how we use it, and your rights.

1. Data We Collect

Data	When	Purpose
Email address	When you register	Authentication (magic link), account management, service communications
Spell prompts	When you generate a spell	AI processing, service improvement
Generated spells	After generation	Display results, allow re-access
IP address	Each visit	Rate limiting, abuse prevention
Payment info	When you purchase	Processed by Stripe; we do not store card details
Usage analytics	Each visit	Anonymous analytics via Umami (privacy-focused, no cookies)
Language preference	When you select a language	Stored in your browser (localStorage), not on our servers

2. How We Use Your Data

Email: To send magic link login emails, important service updates, and occasional product announcements. We will never sell your email or share it with third parties for marketing.
Spell prompts and results: To provide the service. We may use anonymized prompts to improve AI quality. We do not share individual prompts with third parties.
IP address: For rate limiting (1 free spell/day) and to prevent abuse. IP addresses are stored temporarily in Cloudflare KV and automatically expire after 24 hours.

3. Email Communications

By registering, you consent to receive:

Transactional emails: Magic link login, purchase confirmations
Product updates: New features, important changes (infrequent)

You can unsubscribe from product updates at any time by clicking the unsubscribe link in any email or by contacting us. Transactional emails (login, purchases) cannot be opted out of while your account is active.

4. Third-Party Services

We use the following third-party services:

Cloudflare: Hosting, CDN, DNS, security (Workers, Pages, D1, KV)
Groq / Google Gemini / Mistral: AI spell generation. Your prompts are sent to these providers for processing. See their privacy policies: Groq, Google Gemini, Mistral.
Stripe: Payment processing. Card details are handled entirely by Stripe and never touch our servers.
Resend: Email delivery for magic links.
Umami: Privacy-focused analytics. No cookies, no personal data collected.

5. Cookies and Tracking

We do not use tracking cookies. The only browser storage we use is:

localStorage: Your language preference and authentication token. This data never leaves your browser.

Our analytics provider (Umami) is cookie-free and does not track individual users.

6. Data Retention

Account data: Retained while your account is active. You can request deletion at any time.
Spell history: Stored indefinitely for registered users. Anonymous spells are stored for 90 days.
IP rate limit data: Automatically expires after 24 hours.
Payment records: Retained as required by financial regulations.

7. Your Rights

You have the right to:

Access your personal data
Request correction of inaccurate data
Request deletion of your account and associated data
Export your spell history
Withdraw consent for marketing emails

To exercise these rights, contact us at [email protected].

8. Children's Privacy

The Service is not directed at children under 13. We do not knowingly collect personal data from children under 13. If you believe a child has provided us with personal data, please contact us and we will delete it.

9. Data Security

We use industry-standard measures to protect your data, including encrypted connections (HTTPS), secure authentication (JWT), and Cloudflare's security infrastructure. However, no method of transmission over the internet is 100% secure.

10. International Data Transfers

Your data may be processed in different countries through our cloud providers (Cloudflare, Groq, Google, Mistral, Stripe). By using the Service, you consent to such transfers.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify registered users of material changes via email. Continued use of the Service after changes constitutes acceptance.

12. Contact

For privacy questions or data requests, contact us at [email protected].