Privacy

OpenMagic stores account details, email verification challenges, sessions, API key digests, and usage totals to provide sign-in and workspace features. Passwords are not collected. Verification codes expire after 10 minutes and are usable once.

Account security

Session cookies are secure and HTTP only. API keys are shown once; only their one-way digest and short prefix are retained. Workspace API keys and usage records are scoped to the account that created them.

Model requests

The current public service uses the local mock adapter. Requests do not reach a live model provider. Do not submit sensitive information. If a permitted provider is configured in the future, prompts will be sent to that provider under its terms.

Payments

Payments are disabled. Sandbox examples do not charge a card, request a transfer, or credit a balance.