Privacy Policy
Last updated: October 2026
1. Controller & developer
The controller responsible for data processing and developer of this app is:
Roman Kocian
iRX Solutions, spol. s r.o.
Web: www.irx-solutions.com
Email: support@magicairlines.app
If you have any questions about data protection, you can contact us at any time via the contact form or the email address above.
2. Overview: where your data is stored
Magic Airlines initially stores your trips locally on your device. For some features, data is processed on our server:
- your user account (sign-in, access)
- trips you share with others – including content you or your fellow travellers add
- push notifications about shared trips
Our server is operated by WebSupport s.r.o. (Bratislava, Slovakia) within the EU. Transmission is encrypted (HTTPS).
3. Account & sign-in
For an account we store your name, email address, a password (only as a secure hash, never in plain text), optionally a short bio and profile picture, and your access status (purchase or invite code).
To confirm your email address we send a code via the email service Brevo (Sendinblue SAS, France, EU). After signing in, your device receives a session token that is stored in your iPhone's keychain.
Face ID/Touch ID is evaluated exclusively on your device; we never receive biometric data.
Sign in with Apple: If you choose this option, Apple sends us an anonymous identifier and, the first time, your name and email address (or a relay address if you use “Hide My Email”). No password is stored. When you delete your account, we also revoke the sign-in with Apple.
Trial & purchase: The 7-day trial and the one-time purchase are handled by Apple via the App Store. We only learn whether the trial is active or full access has been purchased – no payment data.
Backup: The automatic backup of your trips is stored only on your device or in your iCloud backup, not on our server.
4. Shared trips
When you share a trip or join one, the following is stored on our server and shown to all members of that trip:
- Trip details: destination, dates, description, itinerary, budget
- Accommodation incl. address, contact details, booking number, Wi-Fi and access details
- Members (name, email address)
- Documents, tickets, photos and videos that are uploaded
- Expenses, receipts, repayments, chat messages
- Itinerary suggestions and votes (incl. who voted how)
Please only upload content that all fellow travellers may see. If you add other people with name/email, you are responsible for the lawfulness of this entry.
5. Photos, videos & documents
To add media you use the iOS system photo picker, the camera or file import. No permanent access to your entire photo library is requested – only selected files are added.
For trips that aren't shared, these files stay on your device. For shared trips they are uploaded to our server and can be accessed by the members of the trip.
6. Expenses & payment details
You can optionally add payout details (PayPal.me name, Revolut name, IBAN and account holder). These are visible to the members of your shared trips so they can pay you back. You can change or delete them at any time in Settings.
Magic Airlines does not process payments itself: when paying, PayPal, Revolut or your banking app opens, and their privacy policies apply. In-app purchases are handled by Apple – we receive no payment data.
7. Push notifications
If you allow notifications, we store the Apple Push Notification service (APNs) device token together with the codes of your shared trips to inform you about news (e.g. new expenses, tickets, suggestions). Delivery is handled by Apple. Reminders (e.g. check-in, departure) are scheduled locally on your device.
8. External services
Some features send requests to external services. For technical reasons your IP address is transmitted; in addition, only the data listed:
- Live flight tracking: tapping “Live verfolgen” (Track live) opens the Flightradar24 or FlightAware page with the flight number (their privacy policies apply)
- Exchange rates: Frankfurter (api.frankfurter.app) – only the currency
- Weather: Open-Meteo – coordinates of the destination
- Trip images: Picsum and LoremFlickr – a keyword for the destination
- Maps, place search and directions: Apple Maps
- Translation of AI suggestions into languages not supported by Apple Intelligence (e.g. Slovak): Google Translate, alternatively DeepL or MyMemory via our server – only the AI-generated texts (e.g. suggestions, chat summary, travel story; these may contain names and chat content)
- Support form: Formspree or email – your message and contact details
No account data, fellow travellers or documents are transferred to these services. Their respective privacy policies apply.
9. Processing on your device only
The following features run exclusively on your iPhone, without any transfer to us:
- AI suggestions with Apple Intelligence (on-device model; only the finished suggestions are transmitted for translation, see 8.)
- Text recognition when scanning tickets
- Calendar export (write-only access), widgets and Live Activities
- Face ID/Touch ID
- Greeting with your location: only while the app is open and only approximately (about 1 km). Apple Maps determines the city and country; your location is neither stored nor sent to us. Can be turned off in Settings.
10. No tracking, no ads
This app does not use any analytics or tracking services, no advertising SDK and no user tracking across apps or websites. No usage profiles are created.
11. Legal basis
- Art. 6(1)(b) GDPR – providing the app and its features (account, shared trips)
- Art. 6(1)(a) GDPR – consent, e.g. for notifications, camera, calendar and optional payment details (can be withdrawn at any time in iOS or app settings)
- Art. 6(1)(f) GDPR – legitimate interest in secure operation and in showing suitable trip images
12. Retention & deletion
Local data stays on your device until you delete it or remove the app.
We store account data as long as your account exists. You can delete your account at any time in the app (Profile → Delete account); your account and session data will then be removed. Content of shared trips remains available to the other members until it is deleted or the organiser removes the trip. Deleted content is also removed from the server.
13. Your rights
Under the GDPR you have the right of access, rectification, erasure, restriction of processing, data portability and objection, as well as to withdraw consent given. Please contact us at the email address above.
You also have the right to lodge a complaint with a data protection supervisory authority.
14. Data security
All connections are encrypted (HTTPS). We store passwords only as a hash and session tokens only as a checksum. On your device, data is kept in the protected app area; please secure your iPhone with a passcode and Face ID/Touch ID. Device backups (e.g. iCloud) may include app data.
15. Children
The app is not specifically aimed at children. We deliberately do not collect personal data from children.
16. Changes to this policy
We may update this privacy policy if the app's features or legal requirements change. The current version is always available in the app (see date above).