English (EN)

Magic Cookie — Privacy Policy

Effective: October 15, 2026

1. Controller

Magic Cookie (Android package com.funnyapps.magiccookie) is operated under the Miracle Mirka developer brand by Myroslava Morozova, Ukrainian individual entrepreneur (FOP), 24 Zolotoho Leva St., Birky, Yavorivskyi District, Lviv Oblast, Ukraine. Privacy contact: echoyouapp@gmail.com.

2. Information processed by the current release

Account data: Firebase user ID, email address, email-verification status and sign-in provider. Google Sign-In can also provide a display name or profile image to Google/Firebase, although Magic Cookie does not currently use those fields in its interface. Guest sessions use local and/or anonymous identifiers.
AI chat data: the message you send, a bounded portion of recent conversation history, relevant saved memories, selected personality settings and current Kuki mood/satiety context. The backend stores request accounting and the delivered AI response for idempotency. Chat history, drafts and long-term memory are currently stored locally on the device; cloud memory synchronization is not enabled.
Game and economy data: local care state, Kuki profile and settings, schedules, inventory and room state. The backend stores miniCookie wallet records, AI accounting, food and wardrobe purchase records for authenticated users.
Reports: when you deliberately submit a report, we store its reason, details, locale, room, content type and a limited content snapshot together with your Firebase user ID.
Technical data: network requests necessarily include connection metadata such as IP address. The current Android build does not include Firebase Analytics, Firebase Crashlytics, an advertising SDK or Google Play Billing.

3. Purposes and legal bases

We process account, game, economy and conversation data to provide the service you request, authenticate accounts, generate AI replies, prevent duplicate charging, preserve purchased virtual items and respond to reports. We process limited security and operational data for legitimate interests in protecting the service and preventing fraud. Where consent is legally required for an optional feature, consent is the basis for that feature. The current release does not display advertising and does not make real-money purchases available.

4. AI provider and memory

Magic Cookie sends the limited context described above through a Magic Cookie Firebase Functions endpoint to the OpenAI API. OpenAI states that API inputs and outputs are not used to train its models by default unless the customer opts in, and that default abuse-monitoring logs may be retained for up to 30 days. See OpenAI API data controls.

AI replies and generated memories may be inaccurate. In the app, users can view and delete individual memories, clear memories or history, and turn off saving of new memories. These controls affect Magic Cookie's local store; they do not replace a request to delete server-side account records.

5. Providers and locations

Google Firebase Authentication provides email/password, anonymous and Google authentication. Cloud Firestore stores the server-side economy, purchase, AI-operation and report records. Cloud Functions run in us-central1; the project's Firestore database is also located in us-central1. Firebase states that Authentication is processed in the United States and that Firebase services may use Google infrastructure. See Firebase privacy and security. OpenAI processes AI requests under its API terms and privacy materials. Google Play distributes the app, but no Play Billing integration is present in the current build.

6. Android permissions

Internet: authentication and backend features.
Microphone: optional speech input initiated by the user.
Display over other apps and special-use foreground service: the optional floating Kuki feature.
Usage access: used by the optional floating-character behavior to avoid displaying duplicate Kuki instances while Magic Cookie or another app is open. Android requires the user to grant this special access in system settings.
Boot completed: restores the floating Kuki feature after restart when the user previously enabled it.

Overlay permission does not by itself allow Magic Cookie to read the content of other apps. Permission and special-access settings can be revoked in Android settings.

7. Retention

Local game, chat and memory data remains on the device until removed through available controls, app data is cleared or the app is uninstalled. Server-side account and economy records are retained while needed to provide the account, preserve entitlements, secure transactions and resolve disputes. Submitted safety and support reports may be retained while needed to investigate and meet legal obligations. We do not state a fixed backup-deletion cycle because one has not been confirmed. OpenAI's provider retention is described above.

8. Deletion and rights

Uninstalling the app does not by itself delete Firebase or backend data. Signed-in users can request permanent deletion from the account profile in the current internal-test build. The authenticated deletion service removes the Firebase Authentication account, its Magic Cookie backend data and reports linked to that account. A request can also be started without the app at Account and Data Deletion. For requests covered by GDPR, we respond without undue delay and normally within one month; permitted extensions or legally required retention will be explained.

Depending on applicable law, you may request access, correction, deletion, restriction, objection or portability, and withdraw consent where processing relies on consent. Email echoyouapp@gmail.com. EEA users may complain to their local supervisory authority.

9. Children

Magic Cookie is in internal testing. A final minimum-age setting and Google Play target-audience declaration have not yet been confirmed, so this policy does not invent an age threshold. The app must not be used to exploit or endanger children. See the Magic Cookie Child Safety Standards.

10. Planned features

Advertising, Google Play purchases, cloud synchronization of chat memory and user-to-user messaging are not enabled in the current release. If added, this policy and the Google Play Data safety declaration must be updated before release of those features.

11. Contact and changes

We may update this policy when the service changes and will provide notice where required. Contact the controller at echoyouapp@gmail.com.