Magic Scraper — Privacy Policy
Last updated 27 October 2026 · applies to the Magic Scraper browser extension for Chrome and Edge, to Magic Scraper Desktop for Windows and Linux, and to the Magic Snippers extension
Magic Scraper is built for privacy. It has no servers of its own, no account, no analytics and no telemetry. What it reads stays in your browser, and what it produces goes only where you send it: a file you save, or — with Pro, if you choose — a Google Sheet in your own Google account or a webhook address you give. Detecting a table, picking one by hand and exporting it make no network requests at all. The only requests the free extension ever makes are for further pages of the site you are already on, and only once you press Start crawling — never to a server of ours, because there isn't one. Three things go further, all only with Pro and all only when you start them: activating your licence sends the key to Gumroad, once; Send to Google Sheets (from version 1.23) sends the rows you choose straight to your own sheet at Google; and Send to webhook (from version 1.23) sends them to the address you set.
What it reads
When you open the popup on a page, the extension reads that page's visible content — the text, links and image URLs already rendered in your browser — in order to find the repeating rows and turn them into a table. If you turn on drill-down, it also opens the pages your rows link to and reads them the same way.
It does not read pages you have not opened the popup on, does not run in the background, and does not touch form fields, passwords or cookies.
What it stores, and where
Everything is kept in your own browser. Nothing is uploaded. All of it is kept by the extension itself, in storage that belongs to the extension: no website can read it, and removing the extension deletes all of it.
| What | Why |
|---|---|
| Rows from a drill-down run | So results survive the popup closing while the run continues. IndexedDB on the extension's own origin. Removing the extension deletes it. |
| Your setup for a site — speed, excluded columns, renames, removed rows, the link column | So you do not reconfigure the same site every visit. Kept per site, for the 200 most recently used; the oldest is replaced after that. |
| A pending drill-down preview | So a half-configured chain survives the popup closing. |
| A crawl's rows, written as it goes | So a long run survives the tab closing, a crash, or the power going out. IndexedDB on the extension's own origin. Removing the extension deletes it, and Clear in the popup deletes it for the site you are on. |
| Up to five past runs of the same list | So a new run can be compared with the last one and tell you what changed. Same place, and deleted the same two ways. |
| Rows from a run over a list of pages | So the lists already read survive the popup closing while the rest are read. Same place; removing the extension deletes it, and the next run replaces it. |
| Saved setups, and any schedule attached to one | So the next site like this one takes seconds. Settings only — a setup never holds scraped rows. You can export them to a file, and that file is yours. |
| An interrupted run | A crawl writes its rows to the extension's own storage as it goes — so a tab that dies does not take them with it. Offered back the next time you open the popup there, and thrown away as soon as a run finishes cleanly or you discard it. Nothing is downloaded for this. |
| A short log of recent problems | So that when something fails you can tell us what, by choosing Copy a diagnostic report. The last 40 errors, with web addresses removed and no scraped data. It is kept by the extension, removing the extension deletes it, and it goes nowhere unless you copy it and send it yourself. |
| A file you choose to compare with | Only if you use Compare with a file on the Changes tab. The file is read in the popup, on your computer, and compared there. It is not uploaded, not sent anywhere, and not kept: close the popup and it is gone. |
| A scheduled run's CSV | Only if you set a schedule. Each run writes its result into your downloads folder, because nobody is there to press export, named with the date and time of the run. An ordinary file: it stays after the extension is removed. |
If you used a version before 1.21
Earlier versions kept a crawl's rows and your past runs in storage belonging to the website you scraped, not to the extension. That had two consequences you should know about: the website's own scripts could see that the data was there and read it, and removing the extension did not delete it. Clear in the popup did not delete it either, although this policy said it did.
From 1.21 that data is moved into the extension and deleted from the website automatically, the next time you open Magic Scraper on that site. For a site you do not open it on again, clear that site's data in your browser (in Chrome: the padlock beside the address → Site settings → Delete data).
What leaves your machine
Your data: only what you send. The only network requests the extension makes while scraping are to the site you are already on: when a site paginates by URL, it fetches the next page of that same site directly, exactly as your browser would if you clicked the link. Your rows, your columns, the pages you visit and the files you export never leave your machine — unless you press Send to Google Sheets or Send to webhook (Pro), and then only the rows you send, to the place you chose, as described below. Nothing ever goes to us.
One exception, and only if you buy Pro: activating your licence. When you
paste a licence key and press Activate, the extension sends that key and the product ID
to api.gumroad.com, once, so Gumroad can confirm the purchase. That is the whole
request. It carries nothing about the page you are on, the data you have collected, or anything
else about you. The answer is saved locally and never checked again — there is no
call on startup, no periodic re-check and no telemetry. A free installation never makes this
request at all, and never asks for permission to.
We do not store your name or email address, even though Gumroad's reply contains them.
Google Sheets (Pro, from version 1.23)
Off until you use it. Send to Google Sheets puts the rows you are looking at into a spreadsheet in your own Google account. The first time you press it, your browser asks for permission and Google asks you to sign in and agree. Nothing is sent to Google before that, and a free installation never asks.
- What is sent: the rows you send — the table as you see it, with the columns you kept — from your browser straight to Google’s Sheets API. If you link a scheduled run to a sheet, each run sends its rows the same way. Nothing passes through a server of ours.
- What it can open: only spreadsheets it created itself. It asks Google for the narrowest access there is (“only the specific Google Drive files you use with this app”), so it cannot see the rest of your Drive, your email, your contacts or your profile, and it does not ask for your name or email address.
- What is kept, and where: Google’s sign-in is kept in your browser’s memory for about an hour and is never written to disk. The extension remembers, in its own storage on your machine, the address and title of each sheet it made and that sheet’s column headings, so a later run lines up under the earlier ones. None of it is sent to us.
- Turning it off: Settings → Saving and exporting → Sign out of Google Sheets revokes the access at Google. You can also remove it at myaccount.google.com/permissions. Your sheets stay in your Google Drive; removing the extension deletes what it remembered about them.
Magic Scraper’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Data from your Google account is used only to write the rows you send into your own sheets: it is never sent to us, never sold, never used for advertising, and never read by a person. Google’s own privacy policy applies to what is in your Google account.
Send to webhook (Pro, from version 1.23)
Off until you set it up. Send to webhook posts the rows you are looking at, as JSON, to an address you type in: your own server, or a “catch hook” at a service such as Zapier, Make or n8n that passes them on to wherever you point it. Nothing is sent anywhere until you save an address, and a free installation never sends.
- What is sent: the rows you send, with the columns you kept, plus the address and title of the page they came from, the time, and the extension’s version number. If you tick it for a scheduled run, each run sends its rows the same way. Nothing passes through a server of ours.
- Where it goes: only to the address you saved, and only over an encrypted (https) connection. Your browser asks your permission for that one site when you save it; the extension cannot post anywhere else. What happens to the rows after that is up to the service you chose, under its own privacy policy.
- What is kept, and where: the address, and the optional secret you give it so your receiver can check the posts are yours, in the extension’s own storage on your computer. They are not synced and not sent to us.
- Turning it off: Settings → Saving and exporting → Remove forgets the address and secret and gives back the permission for that site.
Files you export (CSV, XLSX, JSON) are written to your own downloads folder. Where they go after that is up to you.
Two pages of this website, opened by your browser. When you first install
the extension, it opens magicscraper.app/welcome, a page saying where the icon went.
When you remove it, your browser opens magicscraper.app/goodbye, which asks why. The
only thing the extension puts in either address is its version number, on the goodbye page, so
an answer can be matched to the build it is about. Neither page receives anything you scraped,
and the goodbye question is optional — see About this website.
Permissions, and why each one exists
| Permission | Why |
|---|---|
activeTab |
Read the page you are looking at, only when you open the popup on it. |
scripting |
Run the detection and extraction code inside that page. |
downloads |
Save your CSV / XLSX / JSON file — and, if you set a schedule, the CSV each run produces while you are not there. |
tabs, storage, all-sites access (optional) |
Requested only if you switch on drill-down, which has to open each row's page in a background tab and keep the results while it works. Decline it and the rest of the extension still works. |
alarms (optional) |
Requested only if you put one of your own saved setups on a schedule. It is a timer and nothing else: it wakes the extension when a run is due. Scheduled runs happen only while your browser is open — an extension cannot wake a browser that is shut, and there is no server of ours to do it instead. A run that came due while it was shut happens shortly after you next open it. |
api.gumroad.com (optional) |
Requested only when you activate a Pro licence, for the single check described above. Free users are never asked for it. |
identity, sheets.googleapis.com,
oauth2.googleapis.com (optional, from 1.23) |
Requested only the first time you use Send to Google Sheets (Pro): identity
opens Google’s own sign-in window, and the two Google addresses are where the rows
are written and where signing out revokes access. Never asked for otherwise. |
| Your webhook’s site (optional, from 1.23) | Requested only when you save an address for Send to webhook (Pro): access to that one site, so the extension can post your rows to it. Remove the address and the permission goes with it. |
Scheduled runs
If you schedule a saved setup, the extension opens that page in a background tab at the time you chose, collects it, writes a CSV to your downloads folder and closes the tab again — without you watching. Two things follow from that, and you should know both before you switch it on.
- It visits that site in your browser, as you, on a timer. If you are signed in to the site, the run is signed in too, exactly as it would be if you opened the page yourself.
- It writes files to your downloads folder while you are doing something else.
- If you ticked Also add each run’s rows to a Google Sheet (Pro), it also sends that run’s rows to that sheet, as described under Google Sheets.
- If you ticked Also send each run’s rows to your webhook (Pro), it also posts that run’s rows to your webhook address, as described under Send to webhook.
Apart from what you ticked, nothing about those runs is sent anywhere. The rows, the files and the schedule itself stay on your machine, and a schedule stops the moment you switch it off or remove the extension.
Children
Magic Scraper is a developer and analyst tool. It is not directed at children and collects no personal information from anyone.
Your responsibility when scraping
The extension automates reading pages you can already see. You remain responsible for
respecting the terms of service, robots.txt, rate limits and copyright of the
sites you use it on, and for handling any personal data you collect lawfully.
Magic Scraper Desktop (Windows and Linux)
Everything above is about the extension. The desktop app is a separate program with its own licence, and it does more on its own, so here is exactly what it keeps and what it sends.
What it keeps, on your computer. Your jobs, monitors and their run history, the rows
each run collects (saved as they arrive, so a crash doesn't lose them), your settings, and your
licence key with the purchase details Gumroad returns for it. It lives in your user data folder:
%APPDATA%\MagicScraper on Windows (or a data folder beside the app in
the portable edition) and ~/.local/share/magicscraper on Linux. Saved logins
(the cookies of a site you signed in to through the app) and any proxy passwords you enter are
stored there unencrypted, so anyone who can open your user account can read them; sign
out of a saved login, or delete the folder, to remove them. Nothing here is sent to us.
What it sends, and to whom.
| When | What goes where |
|---|---|
| You run a job or a monitor | Requests for the pages you asked for, and their
robots.txt, go from your computer to those sites, as your browser's would. |
| You activate a licence, and when the app starts | Your licence key and our product id go to Gumroad's licence service to confirm the purchase. Gumroad answers with the purchase details (including the email used to buy), which are kept on your computer. No identifier of your computer is sent. Without a connection the app keeps working for up to 30 days. |
| The app starts (you can turn this off) | One request for a small file on magicscraper.app saying which version is newest, with the app's version in the request. Nothing else is sent; our host sees an ordinary web request. |
| You download Magic AI's model (optional) | A one-time download of the model file. Tagging runs entirely on your computer; rows are never sent anywhere to be tagged. |
| You set up webhooks | The results of runs, or a monitor's changes, are sent to the addresses you entered — Zapier, Make, n8n, Slack or your own server — and handled under their terms. |
| You turn on the local API | It listens on your own computer only
(127.0.0.1), behind an API key you create. |
| You turn on remote access | Requests to your API from outside pass through
Cloudflare's tunnel service, using Cloudflare's own cloudflared program. |
| You add a proxy or other network service in Settings | Page requests go through the server you configured, which you choose and are responsible for. |
It has no analytics, no telemetry and no crash reporting. We don't receive your jobs, your results, the sites you visit or how you use the app. Notifications are shown by your operating system and stay on your computer.
Magic Snippers (Chrome extension)
Magic Snippers is a separate extension, with its own licence: it scrapes tables and lists, takes whole-page screenshots, and opens every link in a list to screenshot each page. It works differently from Magic Scraper in two ways worth knowing — a drill-down can open pages on many sites, and it re-checks a Pro licence every few days — so here is exactly what it does.
What it reads. The page you are on, when you press Find data, Take snapshot or Scan this page; and, during a drill-down you start, each page the chosen links lead to. Reading happens inside your browser. It never reads a page you haven't asked it to.
What it keeps, and where. What you capture — CSV and JSON exports, PNG
screenshots and the _index.csv of a drill-down — is saved as files in your
Downloads folder. Your settings (folder and file names, wait times, extra pages) and, with Pro,
your licence key, the email address Gumroad returns for it and the date it was last checked are
kept in the extension's own storage (chrome.storage.local) in your browser. Nothing
here is sent to us.
What it sends, and to whom.
| When | What goes where |
|---|---|
| You drill down | The pages behind the links you chose are opened in a tab, as your browser would open them if you clicked each one. |
| You activate a Pro licence | Your licence key and our product id go to
Gumroad’s licence service (api.gumroad.com) to confirm the purchase.
Gumroad answers with the purchase details, including the email used to buy, which are kept in
your browser as described above. |
| Every 3 days, when the panel opens (Pro only) | The same key and product id are sent to Gumroad again, so a refunded or cancelled purchase stops unlocking Pro. If Gumroad can’t be reached, Pro keeps working for 14 days after the last successful check. |
It has no analytics, no telemetry and no crash reporting, and loads no code from anywhere but itself. A free installation never contacts Gumroad or anyone else.
Permissions, and why each one exists.
| Permission | Why |
|---|---|
activeTab | Clicking its toolbar icon lets it read the tab you clicked it on, and only that tab. It has no access to any site when you install it. |
| Access to a site, asked one site at a time | When you use it on a tab you didn’t click the icon on, or a drill-down opens links on a site, your browser first asks whether to allow those sites. It keeps only the sites you allow; you can remove them in Chrome’s extension settings (Site access). It acts on a page only when you press one of its buttons. |
tabs | Show the name of the page the panel will work on, and follow a drill-down’s tab as each page loads. |
scripting | Run its own detection, waiting and measuring code in the page, and click a tab you asked for inside each link (a “Details” tab, say). |
debugger | Whole-page screenshots. It attaches to the tab being captured only while a snapshot or drill-down runs, makes the tab tall enough to fit the whole page, takes the picture and detaches. Chrome shows a “started debugging this browser” bar while it does. |
downloads | Save your exports and screenshots, and open the folder when you press Open folder. |
storage | Remember your settings and, with Pro, your licence. |
sidePanel | Its interface is a side panel beside the page. |
Remove the licence (Upgrade → Remove license from this browser) or uninstall the extension to delete everything it stored. Files you saved stay in your Downloads folder until you delete them.
About this website
Everything above is about the extensions, which have no server and never did. This website is a different thing and now has one small piece of one, so it is worth saying plainly rather than leaving you to find it.
The feature request board, and the I’d use this buttons on the home page that feed it, store what was asked for and how many people want it. A request is the title and details someone typed and what it is for; new ones are read before they are shown. A vote is stored with a random id your browser makes up for itself, so that voting twice does not count twice. That id identifies nobody, is not a cookie, is not joined to anything, and is not shared. No name and no IP address is stored with a request or a vote.
The goodbye page works the same way. If you answer it, what is stored is the reason you picked, the version you had, the date, and anything you chose to type in its two optional boxes. No name, email or IP address is stored with it, and a typed answer is deleted after about a year.
The site counts page views with Cloudflare Web Analytics, which is built into the hosting. It sets no cookies and does not identify or follow you: it reports totals, such as how many people opened a page and which site linked to it.
Some guides have a video. Until you press play it is a picture stored on this site, and nothing is requested from YouTube. Pressing play loads YouTube’s player in its privacy-enhanced mode (youtube-nocookie.com), and from then on YouTube’s own privacy policy applies to that video.
If you choose to leave an email address, on a request or after a vote, that address is kept, with the request you left it on, for one purpose: telling you when that thing ships. It is never shown on the board, it is deleted once we have told you, and asking to be removed at support@magicscraper.app is enough to delete it sooner.
If you email us to be told when Magic Scraper Desktop launches, or when Magic Snippers is in the Chrome Web Store, your address is kept for that one message and nothing else; ask at support@magicscraper.app to be removed sooner.
None of this touches the extensions. Beyond Magic Scraper opening those two pages, they have no idea the website exists.
Changes
If this policy changes, the updated version will be published at this address with a new date at the top.
Contact
Questions or reports: email support@magicscraper.app.