Thank you for using Magik Social Media AutoPost ("Magik", "the Application", "we"). Magik is a Shopify application that turns a merchant's own products into social media posts and publishes them, on a schedule the merchant sets, to social accounts the merchant connects and owns.
This policy explains what we collect, what we do with it, who we share it with, how long we keep it, and how to have it deleted.
Magik is operated by Glenkos. Contact: autoposter@glenkos.com.
1. Information we collect
We only collect data for accounts the merchant deliberately connects, and only the fields the publishing and reporting features actually need.
1.1 Your Shopify store
Your store domain, the storefront URL, and the product information we use to build a post: product titles, descriptions, prices, images, collections, inventory availability, and discount settings you configure in Magik. We also store your Magik settings, automations and captions, plus your billing plan status as reported by Shopify.
1.2 Facebook and Instagram (Meta)
Your name and public profile information, the Pages and connected Instagram accounts you select, their id, name and username, and an access token for them. Where you have enabled performance reporting, the engagement statistics of the posts Magik itself published.
1.3 TikTok
Your account display name and avatar, an access token and a refresh token, and the ids of the videos Magik itself published. Where you have enabled performance reporting, those videos' view, like, comment and share counts.
1.4 Pinterest
Your account name, an access token, the id of the board you choose for your Pins, and the ids of the Pins Magik itself created, with their statistics where performance reporting is enabled.
1.5 YouTube and your Google Account
When you connect a YouTube channel, Magik uses YouTube API Services and receives, through Google OAuth 2.0:
| What | Google scope and API call | Why |
|---|---|---|
| An OAuth access token and refresh token for the channel you selected | returned by Google OAuth | to act on your channel later, on the schedule you set, without asking you to log in again |
| Your channel's id and title | youtube.readonly — channels.list?part=snippet&mine=true, once, at connection |
to show you which of your channels is connected, because one Google Account can own several |
| The video id of each video Magik uploads | youtube.upload — videos.insert |
to link the upload back to the post in your calendar |
| The view, like and comment counts of videos Magik itself uploaded | youtube.readonly — videos.list?part=statistics,status |
to show performance on Magik's in-app "Post performance" screen |
We do not read, list, modify, delete or re-privatise any other video on
your channel, and we never access channels other than the one you
connected. We request no Google scope beyond the two named above: not the
full youtube scope, not youtube.force-ssl, not
youtubepartner, not the YouTube Analytics scopes, and no
Gmail, Drive, Calendar or Contacts scope.
Your use of the YouTube features of Magik is also subject to the YouTube Terms of Service and the Google Privacy Policy.
2. How we use the information
- To generate post content — captions, images and videos — from your own product data, according to the automations and settings you configure.
- To publish those posts to the accounts you connected, at the times you chose.
- To show you, inside Magik, what has been published and what is scheduled, and the performance of the posts Magik published.
- To keep your connections working: refreshing tokens, and telling you when an account needs to be reconnected.
- To provide support when you contact us, and to bill you via Shopify.
We do not use your data for advertising or profiling, we do not sell it, and we do not use data obtained from Google APIs — or from any connected social account — to train, retrain or fine-tune any artificial intelligence or machine learning model, whether ours or a third party's.
3. Who we share, transfer or disclose information to
We do not sell or rent your information, and we do not share it with advertisers, data brokers or analytics resellers.
We share it only in the four situations below.
3.1 The platform you asked us to publish to
When you schedule a post, its content is transmitted to the platform you
selected — Meta (Facebook, Instagram), TikTok, Pinterest, or Google
(YouTube) — because that transmission is the feature. For
YouTube this means the video file, its title and description are sent to
Google's videos.insert endpoint using your token.
3.2 Our infrastructure providers (sub-processors)
These providers host or process data on our behalf and on our instructions only. They are not permitted to use it for their own purposes.
| Provider | Role | What it handles |
|---|---|---|
| Fly.io | Application hosting | The Magik web application and its requests |
Amazon Web Services (Lambda, SQS, S3, CloudWatch), region us-east-1 | Scheduling, publishing and reporting jobs | Post scheduling and publishing, performance collection, logs |
| Fly.io (Fly Postgres) | Managed PostgreSQL database | Your settings, automations, posts, access tokens and statistics |
| Tigris | S3-compatible object storage | The image and video files generated for your posts |
| Intercom | Customer support messaging | Your store domain, your email, and whatever you write to us |
| PostHog (EU hosting) | Product analytics | Which pages of Magik you open and how you use them, tied to your store |
3.3 Content generation providers
To generate the media and captions of your posts, we send your Shopify product data — product title, description, price and product images — to: OpenAI, Google (Gemini), HeyGen, Creatify, Creatomate, and BytePlus (Seedance).
These providers never receive data obtained from Google APIs. Your YouTube access token, your channel id or title, your video ids and your video statistics are never transmitted to any of them, nor to any other third party. The same holds for the credentials and statistics of your Meta, TikTok and Pinterest accounts.
3.4 Legal obligations
We may disclose information where we are legally required to do so, or where it is necessary to establish, exercise or defend legal claims. We will tell you unless the law forbids it.
4. Google user data — Limited Use
Magik's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Concretely, and in addition to section 3:
- Data from Google APIs is used only to provide and improve the YouTube publishing and post-performance features described in section 1.5, which are user-facing features you can see in the Application.
- It is never transferred to others except as needed to provide those features (that is: back to Google itself), for security purposes, or to comply with applicable law.
- It is never used for advertising, and never used to train or improve generalised AI or ML models.
- No human reads your Google user data, except where you have given explicit consent for us to look at specific data to resolve a support request you raised, where it is necessary for security or to comply with applicable law, or where the data is aggregated and anonymised.
Revoking access
You can disconnect a YouTube channel from inside Magik at any time, which deletes the stored tokens for it. You can also revoke Magik's access directly from your Google Account at myaccount.google.com/permissions. Revoking there immediately stops all further access; videos already published to your channel remain yours and stay on your channel unless you delete them yourself.
5. Cookies and similar technologies
Magik runs inside your Shopify admin. Magik itself does not set cookies or write to your browser's storage, but the services it embeds do store, access or recognise information on your device and in your browser, using cookies, local storage and similar technologies:
| Who | What | Why |
|---|---|---|
| Shopify | Session token and Shopify's own cookies | To sign you in to Magik inside your Shopify admin |
| PostHog | A cookie and local storage holding a random identifier | Product analytics: understanding which features are used, so we can improve them |
| Intercom | Cookies | To keep your support conversations with us available across visits |
| Meta (Facebook SDK) | Cookies set by Meta | Loaded where you connect accounts, to run Meta's login for Facebook and Instagram |
| Google, TikTok, Pinterest | Cookies set by these platforms on their own sites | Only during their sign-in windows, when you connect an account |
We do not use these technologies for advertising, and we do not let any third party use them to track you across other websites for advertising.
You can clear or block cookies and site data in your browser settings. Blocking those set by Shopify will prevent you from signing in to Magik; blocking analytics or support cookies will not stop Magik from working.
The YouTube features of Magik do not place cookies of their own: they use YouTube API Services from our servers, under the Google Privacy Policy.
6. Storage, security and location
Access tokens and your data are stored in our managed PostgreSQL database
and, for media files, in object storage. Data is processed in the United
States (AWS us-east-1, Fly.io iad).
We restrict access to production systems to the people who operate them, reach social platforms strictly over HTTPS, and never expose your access tokens to your browser or to any other merchant.
No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
7. Retention and deletion
- On disconnecting an account: the access and refresh tokens for that account are deleted.
- On uninstalling Magik: all of your data is deleted within 48 hours, as required by Shopify's app requirements.
- On request: email autoposter@glenkos.com and we will delete your data.
- Posts already published to your social accounts belong to you and are not affected by deletion here — remove them on the platform if you want them gone.
8. Your rights
Depending on where you live, you may have the right to access, correct, export or delete your personal data, and to object to or restrict its processing. Write to autoposter@glenkos.com and we will respond within 30 days.
9. Children
Magik is a business tool for merchants and is not directed at children under 16. We do not knowingly collect their data.
10. Changes to this policy
We may update this policy. The updated version will be posted at this address with a new "Last updated" date. Material changes affecting how we share your data will be announced in the Application.
11. Contact
Glenkos — autoposter@glenkos.com
This policy is also published, in the same wording, at magikautopost.com/privacy.