Privacy Policy

Last updated: March 5, 2026

This Privacy Policy describes how BuildMagic ("we", "us", or "our") collects, uses, and protects your personal information when you use our CI/CD platform at buildmagic.dev ("the Service"). We are committed to protecting your privacy and handling your data transparently.

1. Information We Collect

1.1 Account Information

When you create an account, we collect:

  • Name — Your display name as provided during registration or from your Git provider profile.
  • Email address — Used for account identification, notifications, and communication.
  • Password — If you register with email/password (stored as a bcrypt hash, never in plain text).
  • OAuth tokens — When you connect GitHub or GitLab, we store encrypted OAuth tokens to access your repositories on your behalf.

1.2 Repository and Build Data

When you use the Service to build applications, we process:

  • Source code — Cloned temporarily during builds and deleted after the build completes. We do not permanently store your source code.
  • Build configuration — Your buildmagic.yaml files and pipeline settings.
  • Build logs — Output from your build processes, stored for your review.
  • Build artifacts — Compiled binaries (IPA, APK, AAB files) stored until you delete them or your account is terminated.

1.3 Code Signing Credentials

If you upload code signing credentials, we store:

  • iOS distribution certificates (.p12 files) and provisioning profiles.
  • App Store Connect API keys.
  • Android keystores (.jks or .keystore files).

All code signing credentials are encrypted at rest using AES-256 encryption. They are only decrypted within isolated build environments during active builds.

1.4 Usage Data

We automatically collect:

  • Build metrics — Build duration, status (success/failure), platform type, and timestamps.
  • Usage statistics — Build minutes consumed, number of builds, and storage usage per team.

1.5 Issue Reports

If you submit an issue report through our status page, we collect the email address, category, subject, and description you provide.

2. How We Use Your Information

We use your information to:

  • Provide the Service — Authenticate you, clone repositories, execute builds, store artifacts, and manage code signing.
  • Manage your account — Process billing, enforce plan limits, and manage team memberships.
  • Communicate with you — Send account-related notifications, respond to issue reports, and provide support.
  • Improve the Service — Analyze aggregate usage patterns to optimize build performance and infrastructure.
  • Ensure security — Detect and prevent abuse, unauthorized access, and fraudulent activity.

3. Data Storage and Security

3.1 Infrastructure

Your data is stored on infrastructure that we operate. The Service uses:

  • PostgreSQL — For account data, team configurations, and build metadata.
  • Object storage (MinIO) — For build artifacts and encrypted code signing credentials.
  • Redis — For session management and build queue coordination.

3.2 Security Measures

We implement the following security measures:

  • All data in transit is encrypted using TLS (HTTPS).
  • Code signing credentials are encrypted at rest using AES-256.
  • Passwords are hashed using bcrypt with appropriate cost factors.
  • Session tokens are HTTP-only secure cookies.
  • Build environments are isolated — each build runs in a fresh virtual machine (iOS) or container (Android) that is destroyed after the build.
  • OAuth tokens are stored encrypted and are only used to access repositories you have authorized.
  • Internal API communication between services uses token-based authentication.

3.3 Build Environment Isolation

Each build runs in a clean, isolated environment:

  • iOS builds run in ephemeral macOS virtual machines using Tart. The VM is created from a clean base image before each build and destroyed afterward.
  • Android builds run in ephemeral Docker containers that are removed after the build completes.

Your source code is only present inside these environments during the active build process. No source code persists after the build environment is destroyed.

4. Data Sharing

We do not sell, rent, or trade your personal information. We may share data only in the following circumstances:

  • With your Git provider — We use your OAuth tokens to interact with GitHub or GitLab on your behalf (cloning repos, receiving webhooks).
  • With Apple (App Store Connect) — If you configure automatic publishing, we use your API key to upload builds to TestFlight or the App Store.
  • Payment processing — If you subscribe to a paid plan, payment information is processed by Stripe. We do not store your credit card details.
  • Legal requirements — We may disclose information if required by law, court order, or governmental authority.
  • With your team members — Other members of your team can see shared resources like applications, builds, and build logs within that team.

5. Data Retention

  • Account data — Retained for the duration of your account. Deleted within 30 days of account closure.
  • Build logs — Retained for 90 days, then automatically deleted.
  • Build artifacts — Retained until you manually delete them or your account is terminated.
  • Code signing credentials — Retained until you delete them or your account is terminated.
  • Usage records — Retained for billing and auditing purposes for up to 12 months after account closure.
  • Issue reports — Retained for as long as needed to resolve the issue and improve the Service.

6. Your Rights

You have the right to:

  • Access your data — View your account information, build history, and stored credentials through the dashboard.
  • Update your data — Modify your account details, team settings, and application configurations at any time.
  • Delete your data — Remove individual build artifacts, code signing credentials, or applications. You can also request full account deletion.
  • Export your data — Download your build artifacts and build logs through the dashboard.
  • Disconnect integrations — Revoke access to GitHub or GitLab at any time, which removes the stored OAuth tokens.

To exercise any of these rights, use the settings in your dashboard or contact us at [email protected].

7. Cookies

We use cookies strictly for functional purposes:

  • Session cookie — An HTTP-only secure cookie that maintains your authenticated session. This is essential for the Service to function and cannot be disabled.
  • Team preference — A local storage value that remembers your selected team across sessions.

We do not use tracking cookies, analytics cookies, or any third-party advertising cookies.

8. Children's Privacy

The Service is not intended for children under the age of 16. We do not knowingly collect personal information from children. If you believe a child under 16 has created an account, please contact us and we will promptly delete the account.

9. International Data Transfers

Your data is processed on servers located in the region where the Service is hosted. If you access the Service from a different jurisdiction, your data may be transferred across borders. By using the Service, you consent to this transfer.

10. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you via email or through the Service at least 14 days before the changes take effect. The "Last updated" date at the top reflects the most recent revision.

11. Contact Us

If you have questions or concerns about this Privacy Policy or how we handle your data, contact us at: