Privacy policy
What Magpie keeps about you, who else sees it, and how to get it back or gone. Last updated 2 October 2026.
Who is responsible
The controller under the GDPR is Osman Cakir, Leonrodstr. 31, 80636 München, Deutschland. Email: hey{at}libraryuniverse.com. Full details are in the Impressum.
What I collect
- Your account: email address, username, name, profile photo if you add one, a hashed password, and passkeys or two-factor settings if you set them up. If you sign in with Google, I get your Google account ID and email from Google.
- Your library: the films, series, records, books and artworks you add, rate, shelve or save to a list, and the recommendations made for you.
- Technical data: when you visit, the hosting provider processes your IP address, browser and the pages you request, to deliver the site, limit abuse and keep short-lived logs.
This is used to run your account and make recommendations (Art. 6(1)(b) GDPR) and to keep the site secure and working (Art. 6(1)(f) GDPR). There is no advertising and nothing is sold.
Cookies
Magpie only sets cookies it needs to work: one that keeps you logged in (up to 30 days), short-lived ones for login verification and on-screen messages, and preference cookies for your theme and time zone. There are no tracking or advertising cookies, so there is no cookie banner.
Who else processes your data
- Cloudflare hosts the site, the database and file storage.
- OpenAI generates recommendations. It receives the titles and ratings in your library, not your name or email.
- Resend sends account emails such as verification codes and password resets.
- Sentry collects error reports. To find bugs it may record a replay of a browsing session, mostly when an error happens.
- Have I Been Pwned checks whether a new password has appeared in a known breach. Only the first five characters of its hash are sent, never the password.
- Google, only if you choose to sign in with it.
Some of these companies are based in the USA. Transfers rely on the EU–US Data Privacy Framework or the EU standard contractual clauses.
Images from other sites
Posters, covers and artworks load straight from TMDB, Discogs, Google Books and WikiArt. Your browser connects to them directly, so they see your IP address, as with any image on the web.
How long it is kept
Your account and library are kept until you delete them. Server logs and error reports are deleted automatically after a short period.
Your rights
You can ask for access to your data, have it corrected or erased, restrict or object to its processing, and take it with you. You can download or delete your data yourself in your profile settings, or email me. You can also complain to a data protection supervisory authority.