Privacy policy
1. Information and purposes
Magnet is a personal travel journal operated by 2weeks. You can start with a guest account without providing your email. A generated account identifier and authentication/session information provide access control. Connecting an email is optional and uses a one-time code to let you sign in on another installation while keeping the same records. Cities, travel dates, notes, selected photos, cover-photo crops, magnet placements, and view/effect preferences provide your journal, board, and statistics.
2. Information you provide and photo access
You enter cities, dates, and notes yourself. Only photos you select in the operating system picker are copied into the app and uploaded. We do not collect your current location or upload your entire photo library. Permission to add photos is requested when saving an image. Denying permission does not remove your existing travel records.
3. Authentication and security
Email codes are used only when connecting an email or signing in. Codes expire after five minutes and cannot be reused after successful verification. Sessions, request metadata such as IP address and user agent, and request limits protect account access and prevent abuse. Records and photos require account ownership. Guest records cannot be recovered if you lose the session before connecting an email. There is no public feed, public profile, or in-app messaging.
4. Retention and deletion
Records and photos are retained to provide the service until you delete them or delete your account. Confirming account deletion blocks new writes and starts removal of server photos, travel records, and authentication information. Partial failures are not reported as completed deletion; cleanup is retried. A non-public account identifier and deletion status are temporarily retained to clean up delayed uploads that overlap with deletion. This information is used only for cleanup, not record recovery. Signing out clears account-specific temporary photos and drafts in the app while keeping server records. User recovery after account deletion is not provided. Completed deletion markers contain only an opaque account identifier and status; the hourly cleanup removes them after 24 hours. Unfinished cleanup remains until it completes. Deleted database entries may remain in Cloudflare D1 rolling recovery backups for up to 30 days, are not accessible through the app, and are not offered as user record recovery.
5. Service providers and sharing
Cloudflare, Inc. provides Workers request processing, D1 account/travel storage, R2 photo storage, and Cloudflare Email Service authentication-email delivery. Better Auth is the authentication software running on our server. These services process account/session information, your selected content, and authentication-email addresses/messages for service operation and security. Cloudflare operates global infrastructure; our D1 region is Asia Pacific, and processing can occur outside the Republic of Korea, including the United States and other Cloudflare locations. Data is sent over encrypted connections when using the service, uploading content, or requesting a code. See https://www.cloudflare.com/privacypolicy/ and https://www.cloudflare.com/locations/. When you choose to share an image, you select the destination in the operating-system share sheet; Magnet does not publish or send it automatically.
6. Your rights and contact
You can view, edit, and delete records, photos, and notes in the app, and delete your account in Settings. Contact contact@2weeks.kr for account access or privacy requests. Choosing email support prepares a draft with app version/build, OS, device model, and an abbreviated account identifier for your review and sending. The app does not send support emails automatically.
7. Changes
Changes to information processed, purposes, service providers, or deletion procedures will be announced in the policy documents in the app with their effective dates. This document describes the actual functionality of Magnet.
8. Analytics, crash reporting and notifications
Google LLC provides Firebase Analytics, Crashlytics, and Cloud Messaging using app-usage events, technical errors/stack traces, app/OS information, approximate geography inferred from IP, and installation identifiers. Google may process this data on its global infrastructure, including outside the Republic of Korea. Custom events/error reports do not include email addresses, codes, search text, travel notes, or photos. Analytics event retention is configured to two months and user retention to 14 months; new activity resets the user-retention period, and aggregated reports may remain longer. Crashlytics keeps crash data and associated identifiers for 90 days before starting deletion. You can disable usage analytics and crash reporting in Settings. Notifications require permission; turning them off, signing out, or deleting the account removes the app-server registration. Google retains Firebase installation IDs until a deletion API request, then starts removal from live/backups within 180 days. Contact contact@2weeks.kr for data-rights requests, or see https://firebase.google.com/support/privacy and https://policies.google.com/privacy. You can refuse optional collection in Settings; refusing an email connection prevents email-based session recovery.
9. Effective date
Effective November 1, 2026. Operator and privacy contact: 2weeks, contact@2weeks.kr. Contact us to request access, correction, deletion, or suspension of processing; we verify account ownership before acting.
Support