Mugwheel

Privacy Policy

Last updated: 23 August 2026

This policy describes how Mugwheel — a local-first, currently-in-development creative workspace application — handles data. It's written to be accurate about the current version of the software, not a generic template. Mugwheel is not yet publicly downloadable; this policy is published ahead of that so it's in place before anyone connects a real account.

This is product and legal documentation, not a substitute for independent legal advice.

On this page
  1. What Mugwheel is
  2. Local, on-device storage
  3. Your content
  4. Google integrations (Drive & Gmail)
  5. AI-provider integrations
  6. TikTok and other social platforms
  7. OAuth tokens and credentials
  8. What Mugwheel's own infrastructure sees
  9. No sale of data, no behavioral advertising, no hidden analytics
  10. Data retention
  11. Disconnecting services and deleting data
  12. Other companies' privacy policies
  13. Children and minimum age
  14. International users
  15. Security limitations
  16. Changes to this policy
  17. Contact

1. What Mugwheel is

Mugwheel is a creative workspace: planning tools, a media editor, publishing helpers, an audience/contacts hub, and business-tracking tools for authors and creators, built as a browser-based application. It is currently in development and not yet publicly released. Its internal codebase and some technical identifiers still reference an earlier project name; that's an implementation detail and doesn't change anything described in this policy.

2. Local, on-device storage

By default, Mugwheel stores your working data — plans, drafts, media project state, contacts, business records — in your web browser's own local database (IndexedDB) on your device. This is the primary place your data lives. Mugwheel does not operate a server that automatically receives a copy of this data.

3. Your content

Content you create or import — text, images, audio, video, and the metadata around them — belongs to you. You're responsible for having the rights to any material you bring into the app. Because storage is local by default, you're also responsible for backing it up; see Data retention.

4. Google integrations (Drive & Gmail)

Mugwheel offers optional integrations with your own Google account:

  • Google Drive — used to sync your data between your own devices, using the drive.file and drive.appdata scopes. These scopes only give Mugwheel access to files Mugwheel itself creates, in a hidden application-data area of your Drive — never your general Drive files. As of this policy's date, Drive sync is built and tested, but not switched on for everyday use of the main application.
  • Gmail — used, if you connect it, to send emails (for example, audience newsletters) on your behalf through your own Gmail account, using the gmail.send scope. Mugwheel does not read your inbox and does not request broader mail scopes than sending.

Both integrations use a public OAuth client and a token that lives only in your browser; Mugwheel never asks for or stores your Google account password, and never requests or stores the private OAuth client secret associated with its own app registration.

Limited Use disclosure. Mugwheel's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Concretely: data from Google Drive and Gmail is used only to provide the specific feature you invoked (syncing your data, or sending a message you composed) — never for advertising, never for building generic or non-personalized AI/ML models, never sold or shared with data brokers, and never read by a human at Mugwheel except where you've explicitly agreed to it (for example, if you ask for help debugging a problem) or where required for security or legal reasons.

5. AI-provider integrations

Mugwheel's AI-assisted features (captioning, review, suggestions, and similar) are provider-dependent: you supply your own API credentials for the AI provider(s) you choose to use. No AI request is sent anywhere until you enable the relevant feature, and each category of data has its own permission you control in Settings. Content sent to an AI provider is subject to that provider's own privacy policy and data-handling practices, not Mugwheel's — Mugwheel does not operate its own AI models or servers.

6. TikTok and other social platforms

Mugwheel includes a TikTok integration that is still in development and subject to TikTok's own app review process. Mugwheel configures and owns the TikTok developer integration itself — you are never asked to create or supply your own TikTok developer app or developer credentials. When TikTok publishing is available, you'll connect your own TikTok account through Mugwheel and explicitly choose what to upload; Mugwheel prepares that upload to your account's private inbox for you to finish and post yourself. A small, stateless Cloudflare Worker that Mugwheel operates holds TikTok's client secret and performs the OAuth token exchange — it does not see your video content, captions, or any other Mugwheel data; see What Mugwheel's own infrastructure sees. Automatic or direct posting to TikTok is not currently implemented. Instagram and other platform integrations are planned but not built.

7. OAuth tokens and credentials

Access tokens for services you connect (Google, TikTok) are stored in your browser's local storage on your device, alongside connection metadata like the account email and token expiry. They are not transmitted to any Mugwheel-operated server for storage. Client secrets for these integrations are never requested from you and are never present in the application you run in your browser.

8. What Mugwheel's own infrastructure sees

Mugwheel's own server-side footprint is deliberately small. The one piece of infrastructure Mugwheel currently operates is a Cloudflare Worker that relays TikTok's OAuth token exchange (the one step that requires a client secret, which can't safely live in a browser). That Worker sees only the OAuth codes/tokens necessary for that exchange — never your videos, drafts, projects, or any other application data. It runs on Cloudflare's free Workers plan.

9. No sale of data, no behavioral advertising, no hidden analytics

Mugwheel does not sell personal data. Mugwheel does not run behavioral or interest-based advertising, and does not use your data (or data obtained through Google or other connected APIs) to serve ads. Mugwheel does not install third-party analytics or tracking scripts on this website or in the application by default.

10. Data retention

Locally stored data persists on your device until you delete it, clear your browser's site data, or remove it from within the app. Cloud-synced data (where enabled) persists in your own Google Drive's application-data area until you disconnect the integration or delete it yourself. Mugwheel does not currently operate a central database of user content to separately retain or purge.

11. Disconnecting services and deleting data

Every connected service (Google Drive, Gmail, TikTok, AI providers) can be disconnected from within Mugwheel's settings screens; disconnecting revokes Mugwheel's local copy of the access token. You can export or delete your local application data at any time from the app's backup/export tools, or by clearing your browser's storage for the site.

12. Other companies' privacy policies

When you connect a third-party service, that service's own privacy policy governs how it handles the data you send it. See Google's Privacy Policy and TikTok's Privacy Policy, and the privacy policy of whichever AI provider you choose to configure.

13. Children and minimum age

Mugwheel is a general-purpose creative and business tool intended for adults running or supporting a creative practice or business. It is not directed at children, and Mugwheel does not knowingly collect data from children under 13 (or the relevant minimum age in your jurisdiction). If you believe a child has provided personal data through a connected service, contact us using the details below.

14. International users

Mugwheel can be used from anywhere, but any data you sync or send through Google, TikTok, or an AI provider is subject to that provider's own handling and storage locations. Mugwheel itself does not currently operate region-specific infrastructure or data residency controls.

15. Security limitations

Mugwheel relies on your browser's own storage security and your device's security. No method of storage or transmission is perfectly secure, and Mugwheel cannot guarantee absolute security of data stored on your device or transmitted to a connected third-party service. Keep your device and browser secured, and disconnect services you're no longer using.

16. Changes to this policy

If Mugwheel starts using data in a materially new way — particularly involving Google user data — this policy will be updated first, and where required, you'll be asked to consent again before the new use takes effect. The "Last updated" date at the top of this page reflects the most recent revision.

17. Contact

Mugwheel is currently developed and operated by an individual developer, not a registered company. For privacy questions, use: [email protected].

User decision pending — before Mugwheel is submitted for Google/TikTok production review or publicly released, decide whether to stand up a dedicated [email protected] mailbox (via Cloudflare Email Routing, already available on this account) rather than continuing to use a personal address here.