Privacy Policy

Last Updated: October 15, 2026

1. Introduction

Magic Carpet Technologies Inc. ("we," "us," or "our") respects your privacy and is committed to protecting the personal data you share with us. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application, website, and related browser-based tools (collectively, the "Services").

By creating an account or using our Services, you consent to the collection and use of information in accordance with this Privacy Policy. If you are in the European Union, the European Economic Area, the United Kingdom or Switzerland, we instead rely on the legal bases described in Section 7.

2. Information We Collect

We collect information that you provide directly to us, as well as information automatically collected when you use the Services.

A. Information You Provide to Us

• Account Information: When you sign up or log into our Services using a third-party authentication provider (such as Google Sign-In or Apple Sign-In), we receive a unique token, your email address, and your name as permitted by that provider’s privacy settings. We do not collect, view, or store user passwords.
• Trip & Profile Data: We collect information you voluntarily input into your itineraries, such as travel dates, party size, reservation times, and destination preferences.

B. Information Collected Automatically

• Location Data: The mobile application may request access to your device’s precise location services.
  • Walking Directions: When you view walking directions, the App shows where you are on the map.
  • Park-Day Location History: If you allow location access, the App records your precise location up to once a minute between your planned arrival and departure times, including while the App is in the background. We use this history to develop upcoming features that show when you’re running behind your plan and point out short queues near you.
  • Web/Browser Location: The web version may request your general location (via IP address) or precise location (via browser prompt) solely to personalize your experience.
• Push Notification Tokens: To send you real-time itinerary updates, wait-time changes, and system alerts, we collect and use unique device tokens provided by mobile and browser messaging systems. These tokens allow us to securely route messages to your specific device, but they do not reveal your identity.
• Usage and Device Data: We automatically collect data about your device type, operating system, browser type, IP address, app version, and how you interact with our Services (e.g., pages viewed, features used, and performance logs).

3. How We Use Your Information

We use the information we collect to operate, maintain, and improve our platform. Specifically, we use your data to:

• Generate, recalculate, and optimize your travel itineraries.
• Review how the Services are used, including your itineraries and park-day location history, to improve our predictive optimization algorithms and develop new features.
• Maintain your account, verify your identity, and provide customer support.
• Deliver real-time push notifications, such as time-sensitive itinerary alerts and essential system notices.

4. Data Sharing and Minimization

We do not sell, rent, or trade your personal data to third parties for marketing or advertising purposes.

Separately, and only with your consent, our website uses a Meta (Facebook) pixel to measure the performance of our own advertising — see Section 5.

We only share your information in the following limited circumstances:

• Service Providers: We share data with trusted third-party service providers who assist us in operating our platform and delivering the Services. These categories include:
  • Cloud Infrastructure and Hosting: Third-party cloud vendors providing secure servers, databases, and computing environments.
  • Authentication Partners: Third-party identity providers used to securely verify your identity without exposing passwords.
  • Notification and Communication Services: Third-party messaging platforms used to deliver time-sensitive push notifications.
• Aggregated, De-Identified Data: We may use and share fully anonymized, aggregated data (e.g., overall crowd trends, ride wait times) for analysis, algorithm training, or public reporting. This data contains no personally identifiable information.
• Legal Compliance: We may disclose your information if required to do so by law, regulation, or court order.

5. Cookies and Advertising Measurement

Our website uses a Meta (Facebook) pixel to measure how well our advertising brings visitors to Magic Carpet. The pixel is off by default: it only runs if you choose “Allow” in the cookie banner, and no data is shared with Meta before then.

When you allow it, the pixel sets the _fbp cookie (and, if you arrived from a Meta ad, the _fbc cookie), each lasting up to 90 days, and shares with Meta Platforms, Inc. your IP address, browser and device information, the pages you visit on our website, and whether you signed up for the beta. We use this solely to measure the performance of our advertising campaigns. Meta is based in the United States, so this data is transferred to and processed in the United States, where Meta handles it according to its own privacy policy.

You can change your mind at any time via cookie preferences (also linked in the website footer). Declining removes the Meta cookies from your browser. Your choice is stored locally on your device.

6. Your Choices and Data Control

• Location Services: You can opt out of precise location tracking at any time by disabling location permissions for Magic Carpet in your mobile device or web browser settings. Disabling location removes your position from the walking directions map and stops the App from recording your park-day location history.
• Push Notifications: You can turn off push notifications at any time through your device or browser settings.
• Account Deletion: You can delete your account at any time within the App settings or by contacting us directly. Deletion takes effect immediately: we permanently delete your name, email address, profile photo, sign-in credentials (including requesting revocation of Sign in with Apple authorizations), push notification token, and your precise location history. Records of the email choices you made are kept as proof of consent, with no link to your account or trip data. If you subscribed to our emails, we also delete your address from our email provider within 30 days. Your remaining trip data (plans and schedules) is irreversibly anonymized so it can no longer be associated with you, and we retain it to improve wait-time predictions and understand how the Services are used. Crash and diagnostic reports are never linked to your account. Residual copies of deleted data may persist in encrypted backups for up to 35 days and in server logs for up to 60 days before being automatically purged.
• Data Correction: You can update your account information at any time through your profile settings.

7. Additional Information for the EU, EEA, UK and Switzerland

If you are in the European Union, the European Economic Area, the United Kingdom or Switzerland, the General Data Protection Regulation (GDPR), the UK GDPR or the Swiss Federal Act on Data Protection gives you the rights described in this section. Magic Carpet Technologies Inc. is the controller of your personal data and can be reached at the contact details in Section 10.

A. Legal Bases for Processing

• Performance of a Contract: We use your account information, trip and itinerary data, Lightning Lane selections, the updates you make during your park day, and your push notification token to provide the Services you ask for.
• Consent: We record your park-day location history only if you allow location access, send product updates and news by email only if you opt in, and run the Meta pixel on our website only if you choose “Allow.” You can withdraw consent at any time by turning off location access in your device settings, switching off emails in your profile or using the unsubscribe link in any email, or changing your cookie preferences. Processing that took place before you withdraw remains lawful.
• Legitimate Interests: We rely on our legitimate interests to keep the Services secure and prevent fraud, diagnose crashes and other technical problems, respond to your feedback and support requests, understand how the Services are used so we can improve them, and keep a record of your email consent choices.
• Legal Obligation: We process data where the law requires it.

Your account information is needed to create an account and use the Services. Location access is optional.

B. Service Providers

We share personal data with the following providers:

• Amazon Web Services (United States): hosting, databases, file storage and email delivery.
• Google (United States): Firebase Authentication, Google Sign-In, Firebase Crashlytics crash reporting and Firebase Cloud Messaging push notifications.
• Apple: Sign in with Apple and push notification delivery.
• Kit (United States): product update and news emails, if you opt in.
• Mapbox (United States): the maps shown in the App.
• Meta (United States): advertising measurement on our website, if you allow it (see Section 5).

C. International Transfers

We are based in Canada, and our servers are in the United States. When we transfer personal data from the EU, EEA, UK or Switzerland, we rely on adequacy decisions (including the European Commission’s decision for Canada), the EU-U.S. Data Privacy Framework and its UK and Swiss extensions where the recipient is certified, or Standard Contractual Clauses.

D. How Long We Keep Your Data

• Account information, park-day location history and feedback: until you delete your account.
• Trip data (plans and schedules): anonymized when you delete your account, then kept to improve wait-time predictions and understand how the Services are used.
• Email consent records: your email address and the choices you made, kept after you withdraw consent or delete your account so we can show what you agreed to and when. Once you delete your account, these records have no link to it.
• Backups and server logs: as described in Section 6.

E. Your Rights

You have the right to:

• access the personal data we hold about you and receive a copy of it;
• correct inaccurate data;
• have your data deleted;
• restrict how we use your data;
• receive the data you gave us in a portable, machine-readable format;
• object to processing based on our legitimate interests;
• withdraw your consent at any time.

To exercise any of these rights, email [email protected]. We respond within one month. You can also lodge a complaint with the data protection authority where you live or work, or, in the UK, the Information Commissioner’s Office.

F. Automated Decision-Making

The App builds and updates your itinerary automatically. These decisions shape your plan for the day and produce no legal or similarly significant effects on you.

8. Security

We implement standard technical and organizational security measures to protect your personal data from unauthorized access, loss, or alteration. However, no method of transmission over the internet or electronic storage is 100% secure, and we cannot guarantee absolute security.

9. Changes to This Privacy Policy

We may update our Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the "Last Updated" date. If you have an account, we may also notify you via email or a mandatory prompt within the Services.

10. Contact Us

If you have any questions or concerns about this Privacy Policy, please contact us at:

• Email: [email protected]
• Corporate Address: Magic Carpet Technologies Inc., 1529 Lilac Street, Halifax, NS B3H 3W4, Canada