Last updated 25 September 2026
Magpie is a podcast and article player. All features can be operated on screen or by voice. Because voice control is a primary interface designed for people who cannot easily use a screen, this policy explains how microphone access and voice requests are handled. Written articles are read aloud on your device — by Apple's system voices on iPhone and iPad, and by offline voices from Google's Speech Recognition & Synthesis app on Android. No outside service is involved in producing that audio. This policy covers Magpie for iOS and Magpie for Android.
The data controller is Henry Dashwood. You can reach us at hcndashwood@gmail.com about anything on this page.
Before Magpie sends anything to an AI provider, the app explains what will be shared and asks you to choose Allow AI Data Sharing. If you choose Not Now, nothing is sent to an AI provider. Ordinary on-screen library and podcast-directory search does not use an AI provider. The separate Search the web fallback does, so it is unavailable until you allow sharing. You can allow it later, or turn it off again, under Settings → Privacy & Support. Turning it off stops future AI requests immediately; the rest of the on-screen app remains available.
Magpie first uses Apple's on-device Dictation Transcriber. If that recogniser is unavailable, the app falls back to Apple's older speech recogniser. The live microphone audio is never sent to Magpie's server or to OpenAI, and Magpie does not store the recording.
On Android, Magpie uses only Android's on-device speech recogniser, provided by the speech service installed on your phone. It asks the recogniser to work offline and does not use a cloud recogniser; if on-device recognition or its language is not installed, the microphone is unavailable until you install it. Magpie does not keep the microphone audio. Android asks your permission before Magpie can use the microphone, and the microphone is used only while you are asking Magpie something.
Apple's older recogniser prefers processing on your device; when Apple processes audio on its servers, that is handled under Apple's privacy policy. The resulting text is sent to our server. If you choose Search the web after an ordinary search finds no publication, the typed publication name is sent to our server instead.
To understand and carry out a voice request, our server sends the recognised text directly to OpenAI's Responses API. Alongside your words, we send the recent conversation, the shows you follow, and relevant episode or article titles, show names, publication dates, and short description extracts. If you follow newsletters, their issues are part of that library: the sender's name stands in for the show name and the email's subject for the title. The names of newsletter senders waiting for your answer, and the subject of each one's latest email, are also sent, so that you can follow or block them by voice. The full text of newsletter emails is not sent. The model can search the web or the public podcast directory when it needs to resolve a show or publication, and can call only the specific Magpie actions our server makes available. A typed web search sends the publication name and the addresses already checked; it does not send your listening library.
In plain terms: for voice, the AI provider sees what you asked for, and part of your listening library. For an explicit typed web search, it sees the publication name you entered and the failed addresses described above. It does not see your name, your email address, or your account identifier. If you ask by voice to follow a publication we do not recognise, the name you said is also used to search the web for its feed.
OpenAI acts as our service provider: it processes these requests on our behalf so that Magpie can answer them, under its API terms rather than as part of a consumer product such as ChatGPT. OpenAI says data sent through its API is not used to train its models unless the API customer explicitly opts in; we do not opt in. By default, OpenAI may retain customer content in abuse-monitoring logs for up to 30 days. Its current terms are described in OpenAI's API data controls. A stable one-way code is attached for provider safety monitoring; it does not contain your name, email address or Magpie account identifier.
An app you drive by speaking is only as good as its understanding of you, and a request that plays the wrong thing looks, from the outside, exactly like one that worked. So that mistakes can be found again and put right, our server keeps a record of each request with Pydantic Logfire, a diagnostics service whose servers are in the European Union.
That record holds the words you said, which episode the app decided on, how long it took, and anything that went wrong along the way. It is labelled with the random diagnostic identifier described above — never your account identifier, name or email address, and never your device's IP address, which is removed before the record leaves our server. It is deleted after 30 days.
Logfire also holds our server's ordinary operational logs, for the same 30 days. They record the address of each request the app makes to our server, and of each request our server makes to other services. Some of those addresses contain what you typed into search: searching your library or a show's episodes, and searching the podcast directory, put your search words in the address, and our server passes directory searches on to Apple's podcast directory in the same way. So your search terms can appear in these logs. They are used only to find and fix problems. A few log lines about newsletter delivery and rate limits also include the same random code used for diagnostics (not your account identifier, name or email address), and newsletter log lines can include a newsletter's name or the subject of a sign-up confirmation email. These are deleted after 30 days like the rest.
The app on your phone sends a short record of its own each time you use the microphone — including the times it went wrong, which our server would otherwise never hear about at all. If the app cannot hear you, no voice command or transcript reaches our server; only this separate, word-free diagnostic record reports the failure.
That record says how long the app listened, whether the microphone started working, which speech recogniser it used, whether VoiceOver or TalkBack was running, and what kind of thing you asked for — playing something, pausing, setting a sleep timer. It never contains your words and never any audio. If your phone is offline it is kept on the device and sent later. That queue is kept separately for each signed-in account and is deleted when you sign out or delete the account. It is held alongside the records above, for the same 30 days, and used the same way.
If the app crashes or freezes, we send a small summary describing the app failure and its version, not what you were listening to. On iOS, these reports come from Apple's MetricKit. Your phone only provides them if you have left iOS's Share With App Developers analytics setting on; you can turn it off in Settings → Privacy & Security → Analytics & Improvements. On Android, we use the system's recent crash and unresponsive-app records and check whether the visible app's main thread has stopped responding. We do not upload raw crash traces, your words, audio, article text, or listening titles. Reports are sent only for the signed-in account that experienced them.
In Magpie for Android, these diagnostics are on unless you switch them off. You can turn off Share app diagnostics under Settings → Privacy & Support. This stops both voice-request diagnostics and crash or freeze reports and clears their pending on-device records. The retry queue holds at most 50 recent reports per account for up to 30 days, is excluded from device backups, and is cleared when you sign out. Switching this off does not affect playback, recognition or your library.
Magpie for iOS has no equivalent in-app switch. Its crash and freeze reports follow iOS's Share With App Developers setting described above; its word-free voice-request diagnostics are always sent. You can object to them by writing to us (see Your rights).
It is used to fix the app and for nothing else. It does not build a profile of you, it is not shared onward, and no advertising or cross-app tracking is involved in it.
Newsletters are optional. Magpie can read aloud newsletters that are only sent by email. To do that, it gives you a private newsletter address made of three random words at magpieinbox.com, created the first time you ask for it, for example by opening Settings → Newsletters or asking Magpie to sign you up to a newsletter. You give this address to newsletters instead of your own email address. Anyone who learns it can send mail to it, which is why new senders need your approval (below).
How the email arrives. Mail for magpieinbox.com is received by Cloudflare Email Routing, and a small Cloudflare program passes each message, complete and unaltered, straight on to our server. Magpie does not ask Cloudflare to keep the messages; Cloudflare's delivery logs record the address each message was sent to and whether it was delivered. Mail to an address that does not belong to a Magpie account is refused.
What we keep. From each email, we keep the sender's name and email address, the subject, the date it was sent, the newsletter's content converted into an article (text, links and pictures' web addresses), a one-line preview, a link to the web version if the email has one, and the newsletter's unsubscribe address. Separately, apart from mail from a sender you have blocked, the complete original email, including all its headers, addresses and any attachments, is kept for up to 7 days so that a message that could not be processed can be tried again, and is then deleted. An email can contain whatever its sender put in it; if you forward mail from your own inbox, that can include your own email address.
Private to you. Your newsletter emails are private to your account. They are never added to Magpie's shared catalogue or shown to anyone else. When you follow a newsletter, Magpie may look for the same publication's public web feed on its own website and show that feed's archive and artwork beside your emails; that public feed is shared like any other show, but your emails are not.
New senders wait for your answer. The first email from a sender appears under Waiting for your answer, not in your library, until you choose Follow or Block. A sender you have not answered is deleted, with its emails, 30 days after its latest email. Choosing Block deletes that sender's emails at once and asks the sender to stop, using the unsubscribe address in its email. Later emails from it are discarded without being stored. We keep the blocked sender's name and email address, so that the block keeps working, until you delete your account. If you stop following a newsletter, Magpie asks the sender to stop in the same way (and asks again, at most daily, until the sender accepts) and keeps its emails for 30 days in case you change your mind; then they are deleted. Magpie does not unsubscribe a newsletter you forward from another inbox, because that subscription belongs to the other inbox.
Signing up for you. If you give Magpie a newsletter's web address and ask it to sign you up, our server opens that web page and submits your newsletter address to the publisher's own sign-up form or mailing service (such as Substack, Ghost or Mailchimp), just as pressing its subscribe button would. It sends only your newsletter address, together with whatever the form itself supplies. It never sends your own email address or name, and because our server makes the request, the publisher does not see your device's IP address. For a first Substack newsletter, Magpie also asks Substack to send a sign-in email that verifies the address. When a confirmation email arrives, Magpie follows its confirmation link for you, and it likewise accepts Gmail's request to confirm a forwarding rule you set up to your newsletter address. Magpie never completes a CAPTCHA; sites that need an account or a CAPTCHA are left for you to sign up to by hand. We keep a record of each sign-up request (the website, publication and mailing service) for 30 days, so that the first email can be recognised.
Once a newsletter is received, it is handled like any other article: it can be read aloud on your device, and its title and sender are part of the library details used for voice requests described above.
Deleting newsletter data. You can block a sender or stop following a newsletter at any time, as above. Deleting your account deletes your newsletter address, every newsletter, issue and original email, your blocked senders and your sign-up records; mail sent to the address after that is refused. An issue you added to Saved is kept with your saved articles, as described below, until you delete your account.
OpenAI, Railway, Pydantic Logfire and Cloudflare are service providers: they process data on our behalf, to run Magpie, and we do not share your data with anyone for their own use. Apple, Google and publishers are described below.
Android keeps unfinished voice and typed library requests privately on your device, including their recognised text, original target, recent conversation context and any confirmed result. This lets you check the original request after an interruption without repeating changes. These records are excluded from device backups. Opening the recovery list does not start the microphone or send a command. Records remain until resolved or dismissed, or until you sign out. Dismissing a request cancels unfinished server work and removes its local recovery record; changes already made to your library remain.
Your account, subscriptions and playback positions are kept until you delete your account. Sign-in tokens expire after 180 days without use. Shows that nobody subscribes to and nobody has listened to are removed from our catalogue after 30 days. The diagnostic records and operational logs described above are deleted after 30 days.
Newsletters you follow are kept until you stop following them (then for 30 days more) or delete your account. Complete original emails are deleted after 7 days, senders you have not answered 30 days after their latest email, and sign-up records after 30 days. Blocked senders are remembered until you delete your account. The details are under Newsletters.
Turning off AI data sharing prevents new AI requests. It does not rewrite diagnostic records already created while the feature was allowed; those continue to expire under the same 30-day limit.
We also keep backups of the database, so that the service can be recovered if something goes wrong with it. This means a backup taken before you deleted your account may still hold a copy of your data for a short time afterwards. Backups are never kept longer than 30 days, and are not used for any purpose other than restoring the service.
Open the Settings tab in the app, choose Delete Account in the Account section, and confirm. If you cannot use the app, follow these steps instead. This permanently removes your account, your subscriptions and your place in every episode, your saved articles, your newsletter address and every newsletter email received through it, and all linked sign-in identities. When an Apple connection is present, Magpie also asks Apple to revoke it. Deletion applies to the same account on both iOS and Android. It also deletes the only mapping between your account and its random diagnostic identifier. Existing diagnostic records then remain only under that random code until their 30-day expiry and are no longer connected through Magpie's live account database. A retained disaster-recovery backup may still contain the old mapping until that backup's 30-day expiry, but backups are used only to restore the service. Because a spoken transcript is free text, its own words could still identify you if you chose to say identifying information. Operational logs, including any search terms and the few lines that carry your random diagnostic code, are not rewritten either; they expire under the same 30-day limit. It cannot be undone. You do not need to contact us or wait for us to act.
If you are in the UK or the EU, you have the right to access your data, to correct it, to have it deleted, to object to how it is used, and to receive a copy of it. Deletion is available immediately in the app; for anything else, write to us at the address above and we will respond within one month. You also have the right to complain to the Information Commissioner's Office.
We use different lawful bases for different purposes. Account, library, playback, newsletters you choose to receive, and the processing needed to answer a voice or web-search request are necessary to provide the service you ask for. We separately require the explicit in-app permission described above before sharing a request with third-party AI, and you can withdraw that permission at any time. Limited security, reliability and accessibility diagnostics, and the operational logs described above, are used for our legitimate interest in keeping Magpie safe and usable: they are pseudonymised, kept for 30 days, never used for advertising or profiling, and you may object by contacting us. Crash diagnostics are also controlled by iOS's Share With App Developers setting, and on Android by Magpie's Share app diagnostics setting.
Magpie is not directed at children under 13, and we do not knowingly collect data from them.
If we change how any of this works, we will update this page and change the date at the top. Material changes will be announced in the app.
hcndashwood@gmail.com
When you share a page to Magpie or add a link, it is stored on your device until the app can sync it to your account. Safari may include the page content you are viewing. Captured article text is private to your account, including copies captured while signed into a publication. Matching an article to a publication's feed does not share your captured text with other users.
Magpie keeps the selected copy stable so you can resume reading or listening. Removing it from Saved retains that copy for playback restoration. Deleting your account erases your private copies. Downloaded text is stored on your device for offline use and cleared when you sign out. With your existing AI data-sharing consent, saved titles and save dates can be used to answer voice requests, just as other library items are.