Privacy Policy

Last updated: October 10, 2026. Applies to every McMizzle app, including AmbientCast and Calorie Burndown.

The short version: your data stays on your own devices and in your own Apple Account. None of it passes through any server McMizzle operates, because there isn't one — every McMizzle app talks directly to the devices and services you've chosen to connect it to (your own printer on your own network, or YouTube), to Apple's own on-device frameworks (like HealthKit), or to your own iCloud account — to keep an app's own settings and history in step across your devices, and, in AmbientCast, to carry something you have asked it to carry from one of your devices to another — and nowhere else.

What McMizzle apps store, and where

Specifics vary by app, but the pattern is the same everywhere:

• Account credentials and access tokens (e.g. AmbientCast's YouTube sign-in) are stored in your device's Keychain, on-device only. Passwords are sent directly to the relevant third-party service to authenticate — never stored by the app itself. Your Google/YouTube tokens never sync at all: they stay on the device you signed in on.
• Printer access codes and camera passwords (AmbientCast) are stored in your device's Keychain too, and they stay on the device you typed them into unless you turn on Sync Credentials, in AmbientCast's Settings — one setting, covering a printer's access code and a camera's username and password alike; a setting of its own, beside the Sync with iCloud switch rather than part of it; and off until you turn it on. With it on, each access code and camera login is encrypted on your device before it is sent and kept in your own private iCloud database, so your other devices can use it; the key is derived from your iCloud Keychain, which means neither Apple nor McMizzle can read it. Turning the setting off takes them back out of iCloud: the device deletes the credentials for the printers and cameras it knows about — it cannot speak for one only another device has set up — and every device keeps its own local copy, so nothing stops working. Deleting a printer or camera also removes its credentials from iCloud, and from your other devices with it. Sync Credentials exists because these are typed on an Apple TV remote otherwise, on every device you want to watch from — and a generic camera is usually the thing you are watching from the Apple TV. An earlier version of AmbientCast tried to do this through iCloud Keychain and that was removed: Apple does not synchronize an app's Keychain items to or from tvOS, so the option did nothing on the platform most people use it on. This uses a different mechanism, which does work there.
• Health & fitness data (e.g. Calorie Burndown's use of HealthKit) is read directly from Apple's HealthKit on your device and never leaves it, governed by Apple's own HealthKit privacy rules. Today's totals are written to an on-device App Group container so the widgets and watch complication can display them — a widget runs as a separate process and cannot reliably query HealthKit itself.
• App settings and cached status (e.g. printer connection details, daily calorie goals) are stored locally, and where an app has a companion widget or watch app, shared via an on-device App Group container. Some of these settings also sync through your own iCloud account — see the next point.
• iCloud sync — some apps keep a small amount of their own data in step across your devices using Apple's iCloud, and AmbientCast can also use it to hand something from one of your devices to another. This is Apple's storage inside your Apple Account, not a McMizzle server: McMizzle cannot read it, and it stops as soon as you sign out of iCloud on that device. What goes there today:
  • Calorie Burndown — your goal settings: target weight, target date, and any manual overrides you have entered. Your health measurements are not included — nothing HealthKit reports about your body or your energy is ever written to iCloud. One preference read through HealthKit is: which units you work in — kilograms or pounds, kilocalories or kilojoules — so that a target you set on one device reads the same way on another.
  • AmbientCast — your custom watermark image; the printers and cameras you have set up (names, serial numbers, addresses, ports, stream paths and connection modes), so a camera added on your iPhone appears on your Apple TV; the list of timelapses the app has published to YouTube (video identifiers, titles, printer names, publish times, and whether the print failed), including a record of which entries you have since removed from that list; and, if you use that feature, which of your devices is recording the timelapse — a random identifier for the device that has claimed the job, so two of your devices watching the same print don't both record it. It identifies the device to your other devices, not you to anyone. No access code or password is in that list — those are a separate, opt-in thing, described in the two points below.
  • AmbientCast's printer access codes, and its cameras' usernames and passwords — but only if you turn on Sync Credentials, which is off unless you do, and which is its own setting rather than part of the Sync with iCloud switch that covers the items above. These travel to the same Apple Account by a different route (CloudKit, rather than the key-value storage the items above use), as records encrypted on your device before they are sent, with a key derived from your iCloud Keychain. Neither Apple nor McMizzle can read them. This is the only thing listed here that is a secret, which is why it is off by default, asked for on its own, and removed from iCloud again when you turn it off.
  • A diagnostics report, if you ask AmbientCast on your Apple TV to send one — the Apple TV has no share sheet of its own, so the report goes to your private iCloud database for your iPhone to pick up and share. It is the app's own logs, encrypted on the device before it is sent, and it is the same text you can read on screen first: the access codes, camera usernames and passwords, and printer serial numbers the app holds are replaced before it is written, while network addresses, printer models and error codes are kept, because those are what make a log useful. Nothing is sent unless you ask for it, there is one report per device, and sending again from that device replaces the last one. The Apple TV that sent it can take it back out of iCloud from the same screen. It reaches McMizzle only if you then choose to share it from your iPhone.

What McMizzle apps don't do

• No analytics, crash reporting, advertising, or tracking SDKs of any kind are included in any McMizzle app. Nothing is gathered in the background to send anywhere: AmbientCast can assemble a diagnostics report from its own logs, and it is written when you ask for it and goes where you send it.
• No account credentials, health data, or usage data are ever sent to any server McMizzle operates.
• Nothing is sold or shared with third parties beyond the services you've directly chosen to connect to.

Third-party services

Where a McMizzle app connects to a service on your behalf (e.g. AmbientCast to YouTube for optional live streaming), what that service then does with your data on its own side is governed by that service's own privacy policy, not this one. How the McMizzle app itself requests, uses, stores, and deletes that data is covered here — see Google user data below for the full account of AmbientCast's YouTube Live feature.

No McMizzle app shares your data with any third party for McMizzle's own purposes. There are no analytics providers, advertising networks, tracking SDKs, or parent, subsidiary, or related entities with access to your data — the only services your data ever reaches are the ones you personally chose to connect the app to, and it goes there directly from your device. Apple's iCloud is the one thing you do not separately choose to connect, and it is not a third party in this sense: it is your own Apple Account, McMizzle has no access to what is stored there, and what goes into it is listed above.

Retention, deletion, and revoking access

Nothing here has to be requested from McMizzle, because none of it reaches McMizzle. Almost all of it lives on your own device, where you control it directly; the exception is what an app syncs to your iCloud, which sits in your Apple Account and is covered by the last point below:

• Account credentials and access tokens (AmbientCast's YouTube OAuth tokens) are kept in your device's Keychain until you sign out of that service from the app's Settings, which deletes them immediately and on-device. For YouTube you can also revoke AmbientCast's access at myaccount.google.com/permissions. Deleting a printer or camera deletes its access code or password with it — including the copy in your iCloud, if you turned on Sync Credentials, and the copies on your other devices; that happens whether the setting is on or off. Turning Sync Credentials off takes the credentials for the printers and cameras that device has back out of iCloud, while leaving each device the local copy it is using.
• Health & fitness data is read from Apple's HealthKit on demand and is not kept beyond what your widgets and watch complication need to show today's figures — those are held in an on-device App Group container, never sent anywhere, and removed with the app. Revoke HealthKit access any time in the iOS Settings app under Privacy & Security → Health, or in the Health app itself.
• App settings and cached status are stored locally and are removed along with the app when you delete it — except for the settings an app syncs to iCloud, such as Calorie Burndown's goals, which are covered by the next point.
• Anything synced through iCloud is held in your own Apple Account, so — unlike everything above — it is not removed by deleting the app. Signing out of iCloud on a device stops that device syncing. What is already in your Apple Account stays there, under Apple's control rather than McMizzle's: there is no McMizzle copy of it, and nothing to request from McMizzle, because it never reaches us. Two things AmbientCast can take back out of iCloud for you: a synced credential, when you turn Sync Credentials off or delete the printer or camera it belongs to, and a diagnostics report, from the Apple TV that sent it.

Deleting a McMizzle app removes everything on your device. Whatever an app synced through iCloud remains in your Apple Account, where McMizzle cannot reach it. Since no copy is ever sent to a McMizzle server, there is nothing left behind for you to request the deletion of, and no deletion request to make.

Google user data (AmbientCast's optional YouTube Live feature)

This section exists specifically to satisfy Google API Services User Data Policy disclosure requirements for AmbientCast's optional YouTube Live broadcasting feature.

What's requested and why. When you turn on YouTube Live in AmbientCast's Settings and sign in, it requests the single OAuth scope https://www.googleapis.com/auth/youtube — the narrowest scope Google's device-flow sign-in (used because tvOS has no in-app browser for a standard OAuth redirect) permits for YouTube at all; the read-only youtube.readonly scope isn't sufficient because the app needs to create and manage a broadcast, not just read your channel. With that scope, AmbientCast only ever calls:

• liveBroadcasts.insert / .bind / .transition — to create a live broadcast on your own channel and start/stop it, only when you tap the record button (or the optional auto-start-with-print-jobs setting fires).
• liveStreams.insert — to create the ingest endpoint AmbientCast's own RTMP relay pushes your printer's camera feed to.
• thumbnails.set — to set the finished broadcast's thumbnail to a still frame of your own completed print, once, when a broadcast you started ends.
• liveBroadcasts.list / liveStreams.list — to read back the state of broadcasts and streams on your own channel: whether one this app created is still live, which stream is bound to it, and whether YouTube is receiving video yet.
• videos.insert — to upload a short timelapse of your own completed print to your own channel, if you've turned that on. The timelapse is assembled on your device from your own printer's camera feed, and is uploaded once, when the print finishes. It has its own visibility setting, separate from the broadcast's, so you can keep the full-length stream private while the timelapse is public (or the other way round, or neither).

Nothing else on your YouTube account is ever read, listed, or modified — no other videos, playlists, subscriptions, comments, or channel settings. Every one of these calls is a direct consequence of something you started: a broadcast you began yourself, or a print you chose to have a timelapse made of. AmbientCast never creates a broadcast, and never uploads anything, on its own — and never ends one either, with the single exception described next.

The one thing it does without being asked. At launch, AmbientCast looks for live broadcasts left running by a previous session of the app — a print that ended while the Apple TV was asleep, or the app replaced mid-stream — and ends them, telling you it has done so. Without this, a dead broadcast can sit live on your channel indefinitely. It will only end a broadcast that both carries AmbientCast's own title suffix and has nothing currently publishing to it, so a stream you are running from another device or another tool is never touched.

Data protection. Your OAuth access and refresh tokens are stored in your device's Keychain, on-device only, encrypted at rest by iOS/tvOS's standard Keychain protection. In transit they are sent only over encrypted HTTPS/TLS connections, and only ever directly to Google's own token and YouTube Data API endpoints — never to any server McMizzle operates, because there isn't one. No McMizzle employee or system can read them, since they exist nowhere McMizzle can reach.

Retention and deletion. Your OAuth tokens stay in your device's Keychain only until you either sign out of YouTube from AmbientCast's Settings (which deletes them immediately, on-device) or revoke AmbientCast's access directly from Google at myaccount.google.com/permissions (which invalidates them on Google's side even if the local copy hasn't been cleared yet). No copy of these tokens is ever retained anywhere off your device — there is no McMizzle-operated server for any of it to be retained on. One thing derived from these calls does leave your device: the list of timelapses you have published, including their video identifiers and titles, syncs through your own iCloud account as described under "What McMizzle apps store, and where". The tokens themselves never do, and nothing derived from them ever reaches McMizzle.

Limited Use. AmbientCast's use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Specifically, Google user data is used only to provide the YouTube Live broadcasting feature described above; it is never transferred to others except as necessary to provide that feature (which, since there is no McMizzle server, means it is never transferred at all), never used for advertising, never used to build profiles or for any purpose other than the one you invoked it for, and never read by humans.

This website

Everything above is about the apps. This site is worth a short note of its own, because until now this policy didn't mention it at all.

• No cookies, and no JavaScript. Every page here is plain static HTML and CSS. There is no analytics script, no tag manager, no embedded widget, and nothing loaded from a third-party domain — so there is nothing here that could follow you to another site. That stays true with Cloudflare in front of the site (next point): the Cloudflare features that would add a script or a cookie to a page are turned off.
• Two companies handle a request for a page here, and McMizzle runs neither of them. The pages are hosted on GitHub Pages, and requests for them pass through Cloudflare on the way, which delivers them and keeps a count of the traffic. Each necessarily handles your request (your IP address, the page you asked for, your browser's user agent, and the page that linked you here, if any) in order to send you the page, under its own privacy statement: GitHub's and Cloudflare's.
• What McMizzle sees is totals. Cloudflare's dashboard gives McMizzle aggregate figures: how many requests the site got, from which countries, and, where Cloudflare provides it, which pages were asked for and which sites linked to them. McMizzle uses those totals to tell which posts are being read. It doesn't keep a record of individual visits or try to identify who made them.
• This is the website only. No McMizzle app sends anything to this site or through Cloudflare. Everything in the sections above, including HealthKit data, iCloud sync and your Google sign-in, goes where those sections say and nowhere near it. The only time an app involves this site is when you open a link to one of its pages, such as this one, and that is an ordinary visit like any other.
• Google Search Console. This site is registered with it, which reports how the site appears in Google's search results — which pages are indexed, and roughly which searches showed them. It is aggregate information about Google's index, not about you: it places nothing on this site, sets nothing on your device, and cannot identify an individual visitor.

Contact

Questions about this policy: see the support page for the right place to ask, per app.