Privacy Policy

Effective Date: August 6, 2026

This Privacy Policy describes how Magic Mirror ("we," "us," or "our"), packaged as com.smartmagicmirror.app, handles device permissions, third-party network services, and user data in our Android smart dashboard application.

1. Device Permissions Requested

Magic Mirror requests specific Android permissions to provide dashboard features. Android categorizes these permissions into normal (automatically granted) and dangerous (runtime prompt):

INTERNET (Normal - Granted Automatically): Used for all outward network traffic including weather queries, reverse geocoding, daily quote requests, Google OAuth, Google Tasks synchronization, and ICS calendar downloads.
ACCESS_FINE_LOCATION & ACCESS_COARSE_LOCATION (Runtime Dialog): Requested upon app launch strictly to fetch current geographic coordinates for local weather updates via Open-Meteo (https://api.open-meteo.com) and reverse geocoding of city/country names via OpenStreetMap Nominatim. Coordinates are handled ephemerally and are never stored or tracked.
CAMERA (Runtime Dialog): Used exclusively for local motion detection and face presence recognition. When activated, the camera detects user proximity to automatically wake or sleep the mirror display. Camera data is processed entirely in real-time on-device and is never recorded, stored, or transmitted.
WAKE_LOCK (Normal - Granted Automatically): Prevents the display from turning off automatically while functioning as an active mirror dashboard.
DISABLE_KEYGUARD (Normal - Granted Automatically): Enables the mirror display to show seamlessly over the lock screen.

2. External Services & APIs

Magic Mirror integrates lightweight public APIs to display ambient dashboard information without requiring personal user registration:

Weather Data (Open-Meteo): Fetches weather forecasts based on GPS coordinates. No API key or user authentication is required.
Location Names (Nominatim / OpenStreetMap): Performs reverse geocoding of coordinates to display the user's city and country beneath the weather widget.
Daily Inspiration (ZenQuotes): Fetches a daily inspirational quote from zenquotes.io/api/today. Quote responses are cached locally on the device until midnight to prevent unnecessary network calls.
Weather Visuals (Local Unicode Emoji): Weather conditions are represented visually using native Unicode emoji characters mapped locally on-device based on standard WMO weather codes in weather.js, eliminating external image fetching.

3. Independent Account Logins & Feature Parity

Magic Mirror supports two separate, independent login options with completely isolated local storage:

Google Sign-In Account: Authenticates via Google OAuth, retrieves basic profile names for greetings, accesses read-only Google Calendar agendas (https://www.googleapis.com/auth/calendar.readonly), and syncs tasks bi-directionally (https://www.googleapis.com/auth/tasks).
Outlook ICS Feed Account: Connects using a user-provided iCalendar URL. Users manually enter their preferred display name during login.

Both account types offer identical feature capabilities, including full task creation/editing, motion detection screen controls, local photo frame displays, daily quotes, and display name customization.

4. Google API Limited Use Compliance

Magic Mirror’s use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

5. Data Security & Technical Protection Mechanisms

We implement strict security measures to safeguard user information and data fetched from third-party APIs (including Google Calendar and Google Tasks):

Encryption in Transit: All data transmitted between the app and external endpoints (Google APIs, Open-Meteo, Nominatim, ZenQuotes) is strictly encrypted using Secure Sockets Layer / Transport Layer Security (TLS 1.2/1.3 / HTTPS).
On-Device Local Sandbox Storage: OAuth access tokens, user preferences, cached calendar entries, and tasks are stored exclusively within Android's private internal application sandbox storage. No central remote server, cloud database, or third-party storage is operated or utilized by Magic Mirror.
Ephemeral Processing: Real-time camera frames utilized for motion detection and location coordinates queried for weather updates are processed ephemerally in volatile memory (RAM). They are never written to disk, logged, or retained after processing.

6. Account Deletion & Data Retention

Magic Mirror processes all user data locally without remote databases. If you select Delete Account inside the app settings, all locally saved session data—including OAuth tokens, display names, calendar caches, task lists, cached quotes, and settings—is permanently erased from your device.

7. Data Sharing

We do not sell, trade, rent, or share personal data, location information, camera processing feeds, or calendar/task content with third parties or advertising networks.

8. Contact Us

For inquiries regarding this Privacy Policy or data clearing procedures, please contact:

Email: support@magicmirror.it.com