Privacy Policy

1. Who We Are

UnlockedMagick ("we", "us", "our") is a YouTube automation SaaS platform operated by Golden Alien / UnlockedMagick LLC. Our website is unlockedmagick.com. For privacy questions, contact us at privacy@unlockedmagick.com.

2. Information We Collect

We collect the following information when you use our platform:

• Account information: Your name, email address, and Google profile data (collected via Google OAuth login)
• API keys: Your OpenAI, ElevenLabs, Pexels, and YouTube API credentials — stored encrypted using AES-256 encryption at rest
• Payment information: Processed entirely by Stripe. We never store credit card numbers or banking information on our servers
• Usage data: Videos generated, schedule settings, niche preferences, and job history
• Analytics: Page views, session duration, referral sources (via privacy-respecting analytics)
• Affiliate data: Referral link clicks and conversion events (IP addresses are hashed and never stored in plain text)

3. How We Use Your Information

• To run the automation pipeline on your behalf (generating and uploading videos)
• To process payments and manage your subscription through Stripe
• To send product updates, receipts, and service notifications
• To provide customer support
• To improve our platform and fix bugs
• To prevent fraud and abuse

4. How We Protect Your API Keys

Your API keys are the most sensitive data we hold. Here is exactly how we protect them:

• All keys are encrypted using Fernet (AES-128-CBC) symmetric encryption before being stored
• Encryption keys are stored as environment variables — never in the database
• Keys are decrypted only in memory at the moment they are needed to run your pipeline
• Keys are never logged, displayed in full, or transmitted to third parties
• You can delete your keys at any time from your dashboard

5. Data Sharing

We share your data with the following third parties only as necessary to operate the service:

• Stripe — payment processing (Stripe Privacy Policy)
• Mailchimp — email communications (Mailchimp Privacy Policy)
• Google — OAuth authentication and YouTube upload API
• Railway — server infrastructure hosting
• Vercel — website hosting

We do not sell, rent, or trade your personal information to any third party for marketing purposes. Full stop.

6. Cookies

We use minimal cookies to keep you logged in (session token) and to remember your preferences (popup dismissed, billing toggle state). We do not use advertising cookies or third-party tracking pixels.

7. Your Rights

You have the right to:

• Access all personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your account and all associated data
• Export your data in a portable format
• Withdraw consent for email communications at any time

To exercise any of these rights, email privacy@unlockedmagick.com. We will respond within 30 days.

8. Data Retention

We retain your account data for as long as your account is active. If you delete your account, all personal data is permanently deleted within 30 days. Job logs and video history are deleted within 7 days of account deletion. Stripe retains billing records as required by law.

9. Children's Privacy

UnlockedMagick is not directed at children under 13. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us immediately.

10. Changes to This Policy

We may update this policy from time to time. We will notify you of significant changes via email. Continued use of the service after changes constitutes acceptance of the updated policy.

11. Contact

Privacy questions? Contact us at privacy@unlockedmagick.com. We take privacy seriously and will respond promptly.