Privacy policy
Last updated 18 October 2026
Who we are
Magpie, 24A Baggot Street Upper, Dublin 4, D04 N528, Ireland. We are the data controller for everything described here. Email info@magpie.ie if you have any questions.
In the UK, Magpie is a trading name of Headline Productions Limited, registered in Northern Ireland (no. NI627084). Registered office: 12 Golf Road, Helens Bay, Bangor, BT19 1TL, Northern Ireland. If your billing address is in the United Kingdom, that company is a controller of your billing details — your name, address and payment record — alongside us. Everything else on this page, including your trackers and the alerts we send, is held by Magpie. Email info@magpie.ie for anything on this page, wherever you live.
What we hold, and why
Swipe the table sideways to see every column.
| What | Why | Lawful basis |
|---|---|---|
| Your email address | It is your account, and it is where alerts go | Performance of our contract with you |
| Your password, as a hash | So you can sign in. Supabase Auth hashes it; the password itself is not stored and we cannot read it | Performance of our contract |
| Your name, if you give us one | So emails are not addressed to a mailbox | Consent — leave it blank and nothing breaks |
| Your trackers: the product link, the size, any target price | They are the service | Performance of our contract |
| A record of every alert we tried to send you | So we can tell whether an alert reached you, retry one that failed, and notice when our email stops working at all | Legitimate interest in delivering the service reliably |
| Push addresses for your browser or the Magpie app, if you turn alerts on there | To send the alert to your device as well as your inbox | Consent — you can turn it off in your browser, in the app or in your phone’s settings at any time |
| Your plan, when your billing period started, a Stripe customer reference, and the dates of your free trial: when it started, when it ends, when we reminded you, and when you first paid | To know what you are entitled to, how much of this month’s allowance you have used, and whether a subscription that ends is a trial that never paid | Performance of our contract |
| The country of your billing address | We can only sell in Ireland and the United Kingdom, and the country on your billing address is what we check at checkout and what decides the VAT that applies | Legal obligation, and performance of our contract |
| Where you came from when you signed up, if the link said so: the campaign tags on that link, such as an ad or our other website, TicketLoop | To know which of our ads and links bring people who sign up, so we spend on the ones that work. We read the tags from the link you followed and store nothing on your device to do it | Legitimate interest in measuring our own advertising |
| A one-way hash of your IP address, if you look things up before signing in | To stop one visitor scripting thousands of lookups. We do not keep the address itself and cannot recover it from the hash | Legitimate interest in keeping the service usable |
What we deliberately do not hold
- No profile of you. No session recording, no advertising profile, no data broker, nothing sold or shared for anyone else to use. We count page views with a tool that sets nothing on your device and gives you no identifier, so we can see that a page was read without seeing who read it.
- No retailers’ catalogues. We store only the specific products someone is tracking, never a copy of a shop.
- No IP addresses in the database. Rate limiting uses a salted hash, and our hosts’ own access logs are outside our control and short-lived.
- No card details, ever. Stripe handles the payment and we see a reference and the outcome, never a card number. A free trial started with your email address takes no card at all. A trial started with a card leaves the card on file with Stripe for the first charge; that is held by Stripe under its own privacy policy, and we hold only the reference.
Price history is not about you
We keep a record of what each product cost over time. That is an observation about a shop, not about a person: it carries no identifier and stays after you leave. It is what lets us tell you whether a sale is genuinely a sale or the price the item quietly sat at in March.
How long we keep things
Swipe the table sideways to see every column.
| What | Kept for |
|---|---|
| Your account and trackers | Until you delete them |
| The record of alerts sent to you | 180 days, or until you delete your account — whichever is sooner |
| Operational logs (product checks, retailer health) | 30 to 90 days |
| Rate-limit counters | 7 days, or 1 day for signed-out visitors |
| Dead push addresses | Removed after 30 days of failures |
| Unsubscribes | Kept indefinitely, on purpose. Honouring an unsubscribe means remembering it; forgetting would mean emailing you again |
Who else touches it
We use a small number of processors, all under contract and none of whom may use your data for their own purposes:
- Supabase — the database and sign-in system. Hosted in the EU (Ireland).
- Vercel — hosts this website, and counts page views. The count is cookieless: no identifier is stored on your device and no individual is distinguished.
- netcup — the server that checks shops and sends alerts. Germany.
- Resend — delivers the emails. Configured to the EU (Ireland) region.
- Cloudflare— the “are you a person?” check on the sign-in page, and encrypted off-site backups.
- Stripe — payments and subscription billing.
- Google (Firebase Cloud Messaging) and Apple(Apple Push Notification service) — carry an alert to the Magpie app on Android or iPhone, if you turn alerts on there. They receive the alert’s text and your phone’s push address, not your email address.
Some of these are US companies. Where your data reaches them it is transferred under the EU–US Data Privacy Framework or standard contractual clauses.
We do not track you to a retailer
Links in our emails and on this site are the retailer’s own plain links. They carry no affiliate tag, no click identifier and nothing that identifies you. We are paid by subscribers, so there is no click for anyone to buy. If you follow a link, that shop sees an ordinary visit from you in the ordinary way; it does not learn your email address, your account or what else you are tracking.
Cookies
Everything we store on your device is what your browser needs for the site to work. Under the ePrivacy Regulations that is exempt from consent. We set no advertising cookies, so there is nothing to accept or refuse.
Swipe the table sideways to see every column.
| What | Set by | What it does | How long |
|---|---|---|---|
sb-…-auth-token | Magpie | Keeps you signed in. Without it every page would ask again | Until you sign out |
magpie:pending-tracker | Magpie | Local storage, not a cookie. If you set up a tracker and we ask you to sign in, this remembers your choices so you do not have to make them twice | One hour, or until the tracker is created |
| Turnstile | Cloudflare | Checks that a real person is asking, on two pages: the sign-in form, and the track page when you look up a product without being signed in | Short-lived |
Our page count sets nothing on your device. Stripe sets what it needs to take a payment, on Stripe’s own pages. Retailers you click through to set their own cookies, under their own policies. You can clear or block all of it in your browser settings. Blocking the sign-in cookie means you cannot stay signed in, which is the only thing it does.
Your rights
Under the GDPR you may ask for a copy of your data, correct it, delete it, restrict or object to how we use it, or take it elsewhere. Two of those you can do yourself, right now, without asking us: download or delete everything.
Deleting your account
You can delete your Magpie account yourself, at any time, in any of three ways:
- In the Magpie app on Android or iPhone: open Account, press Delete my account, and type your email address to confirm.
- On this site: sign in, open Account → Privacy, and press Delete my account.
- By email: write to info@magpie.ie from the address on the account, and we delete it for you.
Deletion is immediate. It erases your account, your trackers, your push addresses and the record of alerts sent to you, and running trackers stop at once. We send one goodbye email to the address. We keep only what the table above says outlives an account: an unsubscribe, if you made one, so that we never email you again.
If you think we have got this wrong, please tell us first — and you can complain to the Data Protection Commission, 6 Pembroke Row, Dublin 2, dataprotection.ie. If you are in the United Kingdom you have the same rights under the UK GDPR and can complain to the Information Commissioner’s Office, ico.org.uk, instead.
Changes
If we change anything that matters we will email you before it takes effect, rather than quietly editing this page.