Security at MagicListr

MagicListr is made by Bubby Studio LLC, a small US company. Resellers trust us with their inventory, their sales and access to their stores, so we keep security simple, written down and followed. These are the policies we work by.

Effective October 14, 2026 · Reviewed at least once a year and whenever MagicListr changes how it handles data · Questions or reports: [email protected]

1. Information security policy

Bubby Studio's owner is responsible for security at MagicListr and for making sure everyone who works on it follows these policies.

What we protect

• Sellers' account details (name, email), their items, listings, sales, costs and offers, and their photos.
• The access sellers give MagicListr to their stores and email: marketplace access tokens (eBay, Etsy, Shopify, TikTok Shop) and read-only Gmail access.
• MagicListr's own keys and settings.

How we protect it

• We never see store passwords. Sellers sign in to each store on that store's own page. MagicListr keeps only the access the store grants it.
• Encryption: everything travels over HTTPS (TLS). Store access tokens are encrypted with AES-256 before they're saved, and the database is encrypted at rest by our host.
• Each seller sees only their own data: the database enforces this for every request (row-level security), and store tokens can be read only by MagicListr's server, never by the app.
• We collect only what MagicListr needs to list, sync and track sales, and we use it only for that. We don't sell seller data or use it for advertising.
• Trusted providers: MagicListr runs on established providers with their own security programs: Supabase (database and sign-in, hosted in the United States), Expo (web app hosting), Cloudflare (website and DNS), Anthropic (reading listing photos and sale emails), Sentry (error reports, with personal details turned off), Postmark (email), and Apple, Google and RevenueCat (subscriptions).
• Data stays in the United States: MagicListr's data is stored and processed in the US.

Daily security baseline

• Two-factor sign-in is on for every account that can reach MagicListr's systems or data (hosting, database, code, domain, email, app stores and marketplace developer accounts).
• Unique, strong passwords kept in a password manager; never shared or reused.
• Work computers stay updated, use the operating system's built-in malware protection and firewall, lock automatically when idle, and use full-disk encryption.
• Seller data is never copied to personal devices, spreadsheets or email, and no paper copies are kept.

2. Access control policy

• Least privilege: people get only the access their work needs. Today that's Bubby Studio's owner, who administers MagicListr. Anyone added later gets the narrowest role that works and their own login, never a shared one.
• Secrets stay secret: server keys are stored as encrypted settings with our hosting provider, never in the code, in the app or in chat.
• Looking at a seller's data happens only to fix a problem they've reported or to keep MagicListr secure, and only as much as needed.
• Access is reviewed every three months and whenever someone's role changes. Access is removed the same day it's no longer needed.
• Sellers control MagicListr's access to their stores: they can disconnect any store or Gmail in Settings at any time, which deletes the stored token, and they can revoke access from the store's own settings too.

3. Data classification and encryption

Keeping and deleting data: sellers can delete any item or sale, disconnect any store, or delete their whole account in the app at any time (how). When an account is deleted, or a marketplace partner ends its relationship with us, we delete the related data and store tokens; copies in our providers' backups expire on their normal schedule, usually within 30 days. We help sellers and marketplace partners access, correct or delete data whenever they ask, within 30 days.

4. Incident response policy

An incident is anything that could expose, change or lose seller data, or let someone into MagicListr who shouldn't be there. Bubby Studio's owner leads the response.

1. Contain: stop it first. Revoke and rotate affected keys and store tokens, block the access path, take the affected feature offline if needed.
2. Assess: work out what happened, whose data was involved and how, using our provider and error logs.
3. Notify: tell affected sellers, and any affected marketplace partner (including TikTok Shop, eBay, Etsy and Shopify for data that came from them) without undue delay, and within 72 hours of confirming the incident, or sooner where a partner's agreement requires it. We also notify regulators where the law requires it.
4. Fix: close the cause, restore anything affected, and confirm it's fixed.
5. Learn: write up what happened and change our practices so it can't happen the same way again.

Sellers, partners and security researchers can report a suspected problem to [email protected] with "Security" in the subject. We reply within 2 business days.

5. Vulnerability management

• Updates: MagicListr's software libraries are checked for known security problems at least once a month and before each release. Critical fixes are applied within 7 days, others within 30.
• Before each release: changes are reviewed and tested, and keys or personal data are kept out of code and logs.
• Watching for problems: errors and unusual activity are monitored with Sentry and our providers' logs, and anything security-related is handled under the incident response policy above.
• Providers: our hosting, database and email providers patch and monitor their own infrastructure; we keep our accounts with them on their current security settings.

Report a security problem

Found something? Email [email protected] with "Security" in the subject and enough detail for us to reproduce it. Please give us a reasonable chance to fix it before sharing it. We won't take action against anyone who reports a problem in good faith and doesn't access more data than needed to show it.

See also our Privacy Policy and how to delete your account or data.