Privacy Policy

Last updated: September 11, 2026. Applies to every McMizzle app, including AmbientCast and Calorie Burndown.

The short version: your data stays on your own devices and in your own Apple Account. None of it passes through any server McMizzle operates, because there isn't one — every McMizzle app talks directly to the devices and services you've chosen to connect it to (your own printer on your own network, or YouTube), to Apple's own on-device frameworks (like HealthKit), or to your own iCloud account to keep an app's own settings and history in step across your devices, and nowhere else.

What McMizzle apps store, and where

Specifics vary by app, but the pattern is the same everywhere:

• Account credentials and access tokens (e.g. AmbientCast's YouTube sign-in) are stored in your device's Keychain, on-device only. Passwords are sent directly to the relevant third-party service to authenticate — never stored by the app itself. Your Google/YouTube tokens never sync at all: they stay on the device you signed in on.
• Printer access codes and camera passwords (AmbientCast) are stored in your device's Keychain too, and they stay on the device you typed them into. There is no setting that shares them. An earlier version of AmbientCast offered to sync them through iCloud Keychain; that option has been removed, and the app moves any credential it had put there back to the device — and out of iCloud — the next time it launches. The practical consequence is that a printer's access code has to be entered on each device you want to watch it from.
• Health & fitness data (e.g. Calorie Burndown's use of HealthKit) is read directly from Apple's HealthKit on your device and never leaves it, governed by Apple's own HealthKit privacy rules. Today's totals are written to an on-device App Group container so the widgets and watch complication can display them — a widget runs as a separate process and cannot reliably query HealthKit itself.
• App settings and cached status (e.g. printer connection details, daily calorie goals) are stored locally, and where an app has a companion widget or watch app, shared via an on-device App Group container. Some of these settings also sync through your own iCloud account — see the next point.
• iCloud sync — some apps keep a small amount of their own data in step across your devices using Apple's iCloud. This is Apple's storage inside your Apple Account, not a McMizzle server: McMizzle cannot read it, and it stops as soon as you sign out of iCloud on that device. What syncs today:
  • Calorie Burndown — your goal settings: target weight, target date, and any manual overrides you have entered. Your health data is not included — nothing read from HealthKit is ever written to iCloud.
  • AmbientCast — your custom watermark image; the printers and cameras you have set up (names, addresses, ports, stream paths and connection modes), so a camera added on your iPhone appears on your Apple TV; the list of timelapses the app has published to YouTube (video identifiers, titles, printer names, publish times, and whether the print failed), including a record of which entries you have since removed from that list; and, if you use that feature, which of your devices is recording the timelapse — a random identifier for the device that has claimed the job, so two of your devices watching the same print don't both record it. It identifies the device to your other devices, not you to anyone. No access code or password is included in any of that — those stay in each device's Keychain and never leave the device they were entered on.

What McMizzle apps don't do

• No analytics, crash reporting, advertising, or tracking SDKs of any kind are included in any McMizzle app.
• No account credentials, health data, or usage data are ever sent to any server McMizzle operates.
• Nothing is sold or shared with third parties beyond the services you've directly chosen to connect to.

Third-party services

Where a McMizzle app connects to a service on your behalf (e.g. AmbientCast to YouTube for optional live streaming), what that service then does with your data on its own side is governed by that service's own privacy policy, not this one. How the McMizzle app itself requests, uses, stores, and deletes that data is covered here — see Google user data below for the full account of AmbientCast's YouTube Live feature.

No McMizzle app shares your data with any third party for McMizzle's own purposes. There are no analytics providers, advertising networks, tracking SDKs, or parent, subsidiary, or related entities with access to your data — the only services your data ever reaches are the ones you personally chose to connect the app to, and it goes there directly from your device. Apple's iCloud is the one thing you do not separately choose to connect, and it is not a third party in this sense: it is your own Apple Account, McMizzle has no access to what is stored there, and what goes into it is listed above.

Retention, deletion, and revoking access

Nothing here has to be requested from McMizzle, because none of it reaches McMizzle. Almost all of it lives on your own device, where you control it directly; the exception is what an app syncs to your iCloud, which sits in your Apple Account and is covered by the last point below:

• Account credentials and access tokens (AmbientCast's YouTube OAuth tokens) are kept in your device's Keychain until you sign out of that service from the app's Settings, which deletes them immediately and on-device. For YouTube you can also revoke AmbientCast's access at myaccount.google.com/permissions. Deleting a printer or camera deletes its access code or password with it.
• Health & fitness data is read from Apple's HealthKit on demand and is not kept beyond what your widgets and watch complication need to show today's figures — those are held in an on-device App Group container, never sent anywhere, and removed with the app. Revoke HealthKit access any time in the iOS Settings app under Privacy & Security → Health, or in the Health app itself.
• App settings and cached status are stored locally and are removed along with the app when you delete it — except for the settings an app syncs to iCloud, such as Calorie Burndown's goals, which are covered by the next point.
• Anything synced through iCloud is held in your own Apple Account, so — unlike everything above — it is not removed by deleting the app. Signing out of iCloud on a device stops that device syncing. What is already in your Apple Account stays there, under Apple's control rather than McMizzle's: there is no McMizzle copy of it, and nothing to request from McMizzle, because it never reaches us.

Deleting a McMizzle app removes everything on your device. Whatever an app synced through iCloud remains in your Apple Account, where McMizzle cannot reach it. Since no copy is ever sent to a McMizzle server, there is nothing left behind for you to request the deletion of, and no deletion request to make.

Google user data (AmbientCast's optional YouTube Live feature)

This section exists specifically to satisfy Google API Services User Data Policy disclosure requirements for AmbientCast's optional YouTube Live broadcasting feature.

What's requested and why. When you turn on YouTube Live in AmbientCast's Settings and sign in, it requests the single OAuth scope https://www.googleapis.com/auth/youtube — the narrowest scope Google's device-flow sign-in (used because tvOS has no in-app browser for a standard OAuth redirect) permits for YouTube at all; the read-only youtube.readonly scope isn't sufficient because the app needs to create and manage a broadcast, not just read your channel. With that scope, AmbientCast only ever calls:

• liveBroadcasts.insert / .bind / .transition — to create a live broadcast on your own channel and start/stop it, only when you tap the record button (or the optional auto-start-with-print-jobs setting fires).
• liveStreams.insert — to create the ingest endpoint AmbientCast's own RTMP relay pushes your printer's camera feed to.
• thumbnails.set — to set the finished broadcast's thumbnail to a still frame of your own completed print, once, when a broadcast you started ends.
• liveBroadcasts.list / liveStreams.list — to read back the state of broadcasts and streams on your own channel: whether one this app created is still live, which stream is bound to it, and whether YouTube is receiving video yet.
• videos.insert — to upload a short timelapse of your own completed print to your own channel, if you've turned that on. The timelapse is assembled on your device from your own printer's camera feed, and is uploaded once, when the print finishes. It has its own visibility setting, separate from the broadcast's, so you can keep the full-length stream private while the timelapse is public (or the other way round, or neither).

Nothing else on your YouTube account is ever read, listed, or modified — no other videos, playlists, subscriptions, comments, or channel settings. Every one of these calls is a direct consequence of something you started: a broadcast you began yourself, or a print you chose to have a timelapse made of. AmbientCast never creates a broadcast, and never uploads anything, on its own — and never ends one either, with the single exception described next.

The one thing it does without being asked. At launch, AmbientCast looks for live broadcasts left running by a previous session of the app — a print that ended while the Apple TV was asleep, or the app replaced mid-stream — and ends them, telling you it has done so. Without this, a dead broadcast can sit live on your channel indefinitely. It will only end a broadcast that both carries AmbientCast's own title suffix and has nothing currently publishing to it, so a stream you are running from another device or another tool is never touched.

Data protection. Your OAuth access and refresh tokens are stored in your device's Keychain, on-device only, encrypted at rest by iOS/tvOS's standard Keychain protection. In transit they are sent only over encrypted HTTPS/TLS connections, and only ever directly to Google's own token and YouTube Data API endpoints — never to any server McMizzle operates, because there isn't one. No McMizzle employee or system can read them, since they exist nowhere McMizzle can reach.

Retention and deletion. Your OAuth tokens stay in your device's Keychain only until you either sign out of YouTube from AmbientCast's Settings (which deletes them immediately, on-device) or revoke AmbientCast's access directly from Google at myaccount.google.com/permissions (which invalidates them on Google's side even if the local copy hasn't been cleared yet). No copy of these tokens is ever retained anywhere off your device — there is no McMizzle-operated server for any of it to be retained on. One thing derived from these calls does leave your device: the list of timelapses you have published, including their video identifiers and titles, syncs through your own iCloud account as described under "What McMizzle apps store, and where". The tokens themselves never do, and nothing derived from them ever reaches McMizzle.

Limited Use. AmbientCast's use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Specifically, Google user data is used only to provide the YouTube Live broadcasting feature described above; it is never transferred to others except as necessary to provide that feature (which, since there is no McMizzle server, means it is never transferred at all), never used for advertising, never used to build profiles or for any purpose other than the one you invoked it for, and never read by humans.

This website

Everything above is about the apps. This site is worth a short note of its own, because until now this policy didn't mention it at all.

• No cookies, and no JavaScript. Every page here is plain static HTML and CSS. There is no analytics script, no tag manager, no embedded widget, and nothing loaded from a third-party domain — so there is nothing here that could follow you to another site.
• McMizzle never sees who visits. There is no server to log anything: the site is hosted on GitHub Pages, which necessarily handles the request in order to send you the page, under GitHub's own privacy statement. That data goes to GitHub as the host, not to McMizzle.
• Google Search Console. This site is registered with it, which reports how the site appears in Google's search results — which pages are indexed, and roughly which searches showed them. It is aggregate information about Google's index, not about you: it places nothing on this site, sets nothing on your device, and cannot identify an individual visitor.

Contact

Questions about this policy: see the support page for the right place to ask, per app.