Magic Guide Tool

Privacy Policy

Last updated: August 7, 2026

Magic Guide Tool runs no analytics, no advertising and no behavioural tracking, and never sells your data. Your guides, annotations, screenshots and uploaded images stay on your device. There are exactly two outbound transmissions, both triggered by you: exporting a report, and validating a paid license.

Data Controller

For the purposes of Article 13 of the EU General Data Protection Regulation (GDPR), the data controller for this extension is the publisher of Magic Guide Tool:
Fang Ming Yuen（方明岳）
Contact: support@ninedaymoon.com

You may exercise your rights of access, rectification, erasure, restriction of processing and data portability via that address. We reply within 3 business days.

Data processing at a glance

Data	Purpose	Leaves your device?
Guides, region annotations, vector shapes, preferences	Core extension functionality	No — chrome.storage.local only
Images you upload (overlays, custom stamps)	Overlay comparison, reusable stamps	No — local IndexedDB only
Page content, browsing history	—	No — never collected or uploaded
Screenshots	Local display; written to your sheet on export	Only when you click “Export report”
Annotation report content	Written into your own Google Sheet	Yes — but only to a Google Apps Script you deploy yourself
License key	Verifying your PRO subscription is valid	Yes — via the publisher's Cloudflare Worker to Creem
Random device ID	Device seat management (max 3 devices)	Yes — same path. A pseudonymous identifier; it cannot identify you
Payment & billing data (card, email, billing address)	Checkout and receipts	Never touches this extension — collected and processed by Creem as Merchant of Record

Under the GDPR, the license key and random device ID constitute pseudonymous personal data. The lawful basis for processing them is performance of a contract (GDPR Art. 6(1)(b)) — without them we cannot confirm your PRO entitlement. Free users never trigger this transmission.

What data we handle and where it lives

Guides, region annotations, vector shapes, settings: stored only in your browser's local storage (chrome.storage.local), remembered per URL, and never leave your device.
Images you upload (overlays, custom icons): stored only in your browser's local IndexedDB; never uploaded to any server.
Screenshots: generated locally when you capture or export, used only for display or for writing into the Google Sheet you specify.

Outbound transmission #1: report export (optional)

When you explicitly use "Export report to Google Sheet", your annotation data and screenshots are sent over HTTPS to a Google Apps Script endpoint that you deploy yourself and set to "only myself" access, then written into your own Google Sheet.

Data does not pass through the extension developer or any third-party server.
You provide the endpoint URL yourself; the extension only allows the https://script.google.com and https://script.googleusercontent.com domains.
If you don't use this feature, no data ever leaves your device.

Outbound transmission #2: license validation (optional)

When you explicitly purchase a paid plan and activate a license key, or when your subscription status is re-checked, the extension sends your license key and a randomly generated local device ID over HTTPS to the publisher's self-hosted license proxy (a Cloudflare Worker), which relays them to the payment provider Creem for validation.

Only the license key and device ID are sent — never any browsing content, guides, annotations, or images.
This request happens only when you actively activate a key or re-validate; the free version never triggers it.
The license key is stored only in your browser, used to re-verify that your subscription is still valid.
Payment itself happens on Creem's hosted checkout page; the extension never sees or stores your card details.

Third parties

This extension uses no analytics, advertising, or tracking services. Only the two user-initiated flows above involve third parties:

Creem (payment provider, Merchant of Record): handles checkout, subscriptions and refunds, and validates license keys. Your payment data is collected directly by Creem under its own privacy policy.
Google Apps Script: used only when you export a report, writing to an endpoint and spreadsheet you deploy and own yourself.

Retention

Local data (guides, annotations, images) is kept until you delete it or remove the extension. The license key and device ID are cleared when you click “Deactivate this device” or when the subscription ends; transaction records held by Creem follow its own statutory retention obligations.

Contact

Questions, or want to exercise your data rights? Contact support@ninedaymoon.com — we reply within 3 business days.