Privacy Policy

Last updated: October 26, 2026

MAGE ID ("we," "us," or "our") operates the MAGE ID mobile and web applications (the "Service"). This page informs you of our policies regarding the collection, use, and disclosure of personal data when you use our Service.

Information We Collect

Account Information: Name, email address, and password (encrypted) when you sign up.
Project & Financial Data: Project details, schedules, estimates, costs, invoices, change orders, daily reports, documents, photos, and client/subcontractor contact details you create inside the app.
Payment Data: When you send or receive payments, card processing is handled by Stripe; we do not store full card numbers. Subscriptions are handled by RevenueCat and the Apple App Store / Google Play.
Precise Location (only when you allow it): the GPS position stamped on a jobsite photo, a field-verified takeoff row or a signed field ticket. See Location.
Voice Recordings: audio you record for dictation or upload from a meeting, sent for transcription and not kept on our servers. See Voice recordings.
Safety Records: incident reports you write can include health details about a worker: whether they were injured, what the injury was, and the treatment they received (first aid or medical care).
Device Information: Operating system, device type, and app version for diagnostic purposes.
Usage Data: App interactions and diagnostics, via PostHog (product analytics), to improve the product.
Crash Reports and Session Replay: collected by Sentry when the app crashes or hits an error. See Crash reports and session replay.
Information About Other People: the names, emails, phone numbers, addresses, signatures and photos of clients, owners, tenants, subcontractors, workers and design professionals that a MAGE ID customer enters, and what those people send through a link the customer gives them. See If a Contractor or Manager Uses MAGE ID With You.

Location

MAGE ID uses your device's precise location only when you have allowed it and only in response to something you tap. It never tracks you in the background, and the iPhone app does not ask for "Always" location access.

Stamped on records: when you take a jobsite photo, field-verify a takeoff row, or sign a field ticket, we save the GPS position with that record so it carries proof of where it was made. It is stored with the project and visible to the people you share that project with.
Used once, not stored: when you tap "Use my location" or "Near me," your position is used on your device to sort nearby projects, jobs and companies by distance.
Public pages: when you publish a photo to your public portfolio, we remove the location data embedded in the image file first.

You can turn location off at any time in your device settings (on iPhone: Settings → MAGE ID → Location). Records are still saved, just without a GPS stamp.

Voice recordings

When you tap the microphone to dictate (for example, a daily report, a punch item or a note) or upload a meeting recording, the audio is sent to our server and from there to Google (Gemini), which turns it into text. We keep the text you choose to save; we do not keep the audio on our servers. If you are offline, the recording waits on your device until it can be sent, and is deleted from your device once it has been transcribed. MAGE ID only records while you are actively recording.

Crash reports and session replay

We use Sentry to find and fix crashes. When the app crashes or hits an error, Sentry receives a report with the error, the app version, your device model and operating system, and the screens and taps that led up to it. A report also includes the app's recent log lines and the addresses of the network requests it made just before the error; those log lines can sometimes contain account details such as your email address. We have switched off Sentry's collection of IP addresses, and we do not deliberately attach your account ID to these reports, though it can appear inside the address of a recorded network request.

In the iPhone app, Sentry also records a session replay for every session that hits an error and for a random 10% of other sessions. A replay is a reconstruction of what was on screen: layout, navigation and taps. All text, images and graphics are masked (replaced with blocks) before the replay leaves your device, so your project names, numbers and photos are not readable in it. Sentry stores this data in the United States.

AI features and who processes them

MAGE ID's AI features run on third-party AI providers. When you use one, we send that provider what the feature needs to answer: the text you typed or dictated, the photos, plan pages or documents you submitted, and the relevant project details from your account (for example, your past costs when you ask for an estimate, or your schedule's tasks when you ask to change it). We send them from our server, never with your password.

Google (Gemini) powers most AI features: estimates, quantity takeoff, plan and spec reading, photo analysis, scanning documents, schedule import and edits, safety drafts, plain-English summaries, and turning voice recordings into text.
Anthropic (Claude) answers construction and building-code questions (it may run web searches to find the code sections it cites) and can run quantity takeoff for Enterprise accounts.

In the phone app, AI features send nothing until you allow them, and you can turn them off in Settings. Two client portal features use AI on our server without a tap from you each time: the weekly client recap (Google Gemini writes the email from that job's name and location, the week's daily report text and completed task names) and Ask Your Home (your client's typed question and the matching Home Passport records go to Google Gemini). Both use AI only while your account's answer to the AI question is yes; you give or change that answer in the app. Otherwise the recap is sent as a plain summary written without AI, and Ask Your Home does not answer. A Claude connection you set up in Settings is separate: it lets the Claude app you connected read your project data until you revoke its token.

AI prompts are not used to train third-party foundation models. AI answers can be wrong; check anything you rely on.

If a Contractor or Manager Uses MAGE ID With You

Many people whose details are in MAGE ID never signed up: a homeowner, a building owner, a tenant, a subcontractor, a worker, an architect or an engineer. The MAGE ID customer who added you (your contractor, your building manager or the general contractor on your job) decides what goes into their account and who they share it with. We hold and process that information for them, to run the Service for them. We do not sell it, we do not use it to advertise to you, and we do not send you marketing.

A customer can send you a private link that opens one page with no account. Each link sends only what you type or attach on that page to the customer who sent it:

Tenant Problem Link: your unit, what is wrong, a photo if you add one, and your name and phone number if you give them. It reaches the building's manager as a work order request.
Owner Warranty Report: which warranty (or Not Sure), where the problem is, what is wrong, how soon it needs a look, a photo if you add one, and your name and phone number if you give them. It reaches your contractor. The page does not decide whether a problem is covered; your contractor and your warranty do.
Insurance Link for Subcontractors: the certificate file or photo you send, the expiry date you type and your note. It reaches the general contractor as a certificate they have not checked yet. The date you type is shown as yours and does not change any reminder.
Owner Link for a Building: it shows the building's work orders as they stand (title, trade, unit, stage, days open, budget and price), never a description, a note, a photo or a tenant. When you press Go Ahead or Hold, your name, your answer, the date, the amount it was given for and your note are saved on that work order for the manager to see.
RFI Reply Link and Bid Invite Link: your name, email, role and answer, and any sketch or photo you attach, or your company, price, what it includes and excludes, your terms, notes, questions and a reason if you decline.

What you send is stored with the customer's account and seen by that customer and the people they share the job or building with. It stays there until the customer deletes it or deletes their account. The customer can stop a link at any time. To stop abuse, the page counts how many times your internet address sends something each hour; we do not save your internet address with what you send.

These pages are not watched around the clock and are not a way to reach emergency services. For a fire, a gas smell, flooding or anyone hurt, call 911 first, then the person who sent you the link.

To see, correct or remove information a customer holds about you, ask that customer first, since they control it. You can also email help@mageid.app; we will tell you which customer holds it and pass your request to them, and where the law gives you a right we must answer ourselves, we will.

Skills Certificates

When you pass a MAGE ID skills check, we save a certificate with the name you typed, the topic and the date. Anyone you give its code or link to can open a page that shows those three things. The page says we do not check identity and that the certificate is not a trade, safety or license credential. You can remove a certificate, and the page then says it was removed.

Purchases

Subscriptions bought in the iPhone app are processed by Apple. We never see your card details. RevenueCat records your subscription status and purchase history against your account so the app knows which plan you are on. Payments you send or receive for your jobs (for example, a client paying an invoice) are processed by Stripe.

How We Use Your Information

To provide and maintain the Service.
To authenticate your account and secure your data.
To send transactional emails (account confirmation, password reset, invoices, notifications you opt into).
To improve the Service through product analytics tied to your account ID (not your name or email).
To respond to your support requests.

Data Storage and Security

Your data is stored on secure, encrypted servers provided by Supabase (PostgreSQL database, hosted on AWS). We use industry-standard encryption in transit (TLS) and at rest. Passwords are hashed using bcrypt and never stored in plain text. If a security breach exposes your personal information, we will tell you and the authorities the law requires us to tell, as the law requires.

Third-Party Services

We use a limited set of third-party service providers to operate MAGE ID. Each processes data only to provide its service to us:

Supabase — authentication and database hosting
Stripe — payment processing (when you send or receive payments)
RevenueCat — subscription management, alongside the Apple App Store and Google Play
PostHog — product analytics
Resend — transactional email delivery
Expo — delivering push notifications to your phone (your device's push token and the text of the notification)
Intuit QuickBooks — only if you connect your QuickBooks company: the customer, invoice and payment records the sync sends to it
Sentry — crash reports and session replay
Apple / Google — app distribution and in-app purchases
CloudConvert — converting plan PDFs you upload into page images
OpenStreetMap (Nominatim) — finding the map position of the location you enter for a project (an address or a city) and of the city and state of a public bid
OpenWeather — the weather forecast for a project's map position
U.S. Census Bureau geocoder and city and state open-data services — matching a project's address to its city and county, and looking up the public permit and building records for that address when you ask for them
Google (Gemini) and Anthropic (Claude) — strictly to deliver in-app AI features on data you submit (see AI features). AI prompts are not used to train third-party foundation models.

We do not sell or rent your personal information to any third party.

Your Rights

You can request to access, correct, export, or delete your data at any time — in-app (Settings → Delete Account) or by emailing help@mageid.app. We will respond within 30 days, except where law requires us to retain certain records.

California Privacy Rights (CCPA / CPRA)

California residents may access, correct, delete, or export their personal information, and opt out of any "sharing." We do not sell personal information. To exercise these rights, email help@mageid.app or use our Do Not Sell or Share page.

Data Retention

We retain your data for as long as your account is active. When you delete your account, we delete your account, the projects you own and the files you uploaded from our database and file storage straight away. We keep:

A record that you accepted our Terms and this policy, which version and which app version, with your account ID replaced by a one-way hash.
For each signed document deleted with your account (a client's change order approval, a signed lien waiver, contract or field ticket, a sealed punch list), a record that it existed: its type, its ID, the date it was signed, and one-way hashes of the document and of your account ID. We do not keep the document, the names on it, the signatures or the amounts. A person who has their own copy of a signed document can ask us to confirm that it matches.
For each pay application you sent that is deleted, with your account or with its job while your account stays open, the same kind of record: its ID, its date, and one-way hashes of what it said and of your account ID, with nothing kept in clear.
A log of AI requests (feature, model, size and cost, never the content), with your account removed, for 400 days.

Analytics events, crash reports, and payment and subscription records held by PostHog, Sentry, Stripe, Apple, Google and RevenueCat are kept by those providers under their own retention.

Work you logged as a team member on another contractor's job is not deleted: daily reports, photos, punch items, RFIs, submittals, permits, plan sheets and markups, time entries (with their GPS location and notes), signed T&M tickets, delivery and site-access bookings, and saved code checks and desktop takeoffs stay with those jobs, and the job's owner keeps them. They are no longer linked to your account.

Children's Privacy

MAGE ID is not intended for use by individuals under 18 years of age. We do not knowingly collect information from children.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or via the app.

Contact

Questions about this policy? Email help@mageid.app.