Privacy policy
Last updated 17 October 2026
Magickal Chaos holds unusually personal material, so this policy describes what actually happens in the code rather than what a lawyer might prefer to promise. Where something is not configured, it says so.
What we collect
An account email and a password hash, handled by Convex Auth. We do not send marketing email and there is no email verification or password reset flow in this build.
Whatever you choose to write or record: journal entries, daily check-ins, habits and completions, intentions and their steps, tarot readings, grimoire notes, rituals and sessions, experiments and symbols.
Your profile settings: display name, timezone, chosen interests, reflection rhythm, dashboard layout and AI consent.
Where it lives
Your records are stored in the project’s Convex deployment, scoped to your account and keyed by your user id.
Every private query, mutation and action resolves your identity from the session on the server and re-checks that each record belongs to you. A record that is not yours is treated exactly like a record that does not exist.
Private pages are rendered in your browser, not on the server, and are served with no-store cache headers.
Optional AI processing
The AI reflection assistant is off by default. It does nothing at all unless an administrator has configured a provider and you have switched consent on.
When it is enabled and you ask for a reflection, only the text you submit for that request is sent to the provider you have configured. It is not used to train models by us, and your entries are never sent automatically.
If no provider is configured, the assistant reports that plainly and stays disabled. Nothing is simulated.
Advertising and selling
We do not run advertising, we do not sell or share your data with advertisers or data brokers, and we do not use your journal content to target anything.
Export and deletion
You can export everything as a single JSON file from Settings at any time.
You can delete your account from Settings. That removes your records, your profile, your usage counters and your authentication records — sessions, refresh tokens, accounts and verification codes — from the deployment. There is no soft-delete copy kept behind the scenes.
Deleting your account is immediate. It cannot be undone, so export first if you want a copy.
Retention
Records are kept for as long as your account exists, because the product is a long-term personal archive. Nothing expires on its own.
When you delete your account, the records are removed as described above. Database backups, if a deployment operator keeps them, follow that operator’s own retention schedule; the application itself keeps no additional copy.
Age
Magickal Chaos is intended for adults. It is not directed at children and you should not use it if you are below the age of digital consent where you live.
Contact
This is a self-hostable application rather than a staffed service, so privacy requests are handled by whoever operates the deployment you signed up to. If you are running your own deployment, you are the data controller.