mug Privacy Policy
Effective date: November 4, 2026
mug is provided by SCHELL CONSULTORIA PALESTRA E EVENTOS LTDA, a Brazilian company (CNPJ 49.241.699/0001-70) (“mug”, “we”, “us”). We are the controller of the personal data described here under Brazil’s LGPD and the EU/UK GDPR. Our founder is the person in charge of data processing (encarregado / data protection officer) and can be reached at diego@getmug.dev. This policy covers the mug macOS app, the small server behind it, and getmug.dev.
If you are in Brazil, the Portuguese-language rights under LGPD apply; contact us in Portuguese if you prefer.
The short version
- Your library is stored on your Mac. Saved sources, notes, files, patterns, analytics and agent usage records are stored locally. We do not sync or back them up, and there is no mug account.
- You choose the AI. What mug analyzes goes from your Mac to the AI you connected, under that provider’s terms. It doesn’t pass through us.
- Our server does two things: it checks your license and fetches the pages of links you save.
- We do not sell your data, show ads, or use your content to train AI models. mug has no analytics or telemetry, and crash reports stay on your Mac.
What we process and why
| Data | Why | Legal basis |
|---|---|---|
| Purchase details: your name, email, payment details and tax details, collected by Creem at checkout. We can see your order and license in Creem’s dashboard; we never see your card. | Sell and deliver your license, keep tax records | Contract; legal obligation |
| License checks: your license key and this Mac’s name (as set in macOS, for example “Ana’s MacBook”), and the activation ID Creem returns. These are stored at Creem, so you can see which Macs use your license. | Activate, validate and deactivate your license, up to its limit of Macs | Contract |
| Links you save: the link’s URL and a signed license receipt, sent to our server so it can fetch the page and the images in it. The receipt holds a hash of your key, not your name or email. | Read the page and its images so your AI can analyze them | Contract |
| Request records: Cloudflare, which runs our server, handles your IP address and request details, and may keep them in short-lived operational logs. These can include the address of a page or image we fetched. | Run, secure and rate-limit the service | Legitimate interests |
| Waitlist email (website) | Send launch news | Consent (unsubscribe anytime) |
Our server has no accounts and no database of users or content. It doesn’t write the links you save or the pages and images it fetches to any storage of ours.
What happens on your Mac
Your library, in-app analytics, agent usage records and error log stay on your Mac. The error log holds technical codes rather than your content, and it leaves your Mac only if you send it to us. Your license and AI keys are encrypted with the macOS Keychain. For a saved link, your library keeps the AI’s description of each useful image as part of the page’s text, rather than the image itself.
When a connected coding agent (such as Codex or Claude Code) asks mug for patterns, the lookup happens on your Mac, and so does the matching of what you type in that agent against your patterns. Patterns delivered to an agent become part of that agent’s conversation and are handled by its provider under its own terms.
The AI you connect
mug sends what you ask it to analyze directly to the AI you connected: page text and images from saved links, your notes, text from your files, images, and the names of your folders. That provider is responsible for that data under its own terms and privacy policy, and your settings with it apply. We are not a party to it, and we don’t receive it.
- API key (Anthropic or OpenAI): your Mac calls that provider directly with your key.
- Claude plan, through Claude Code; ChatGPT plan, through Codex: mug starts the program you installed and signed in to, and hands it the content. What mug analyzes goes through it under your plan’s terms, including your data settings. mug reads whether you’re signed in and, for Claude Code, your plan and email, to show them to you. It doesn’t read or keep your credentials. See the Terms about using a plan this way.
- Backup AI: if you set one, the same content goes to it when your main AI fails.
The mug browser extension
The mug extension for Chrome and other Chromium browsers has one job: saving the page, link or X post you choose to the mug app on your Mac.
- What it handles. When you click the mug button on an X post, click the mug toolbar button, press Alt+Shift+M, or choose “Save page to mug” or “Save link to mug” from the right-click menu, the extension takes the address (URL) of that post, page or link, and notes which of those controls you used. It sends nothing until you take one of these actions.
- Where it goes. The extension sends that address only to the mug app on the same computer, using the browser’s native messaging. The extension itself sends nothing over the internet, whether to mug’s servers, to us, or to anyone else.
- What it reads on X. On x.com and twitter.com, the extension adds a mug button to each post. To place it, the extension reads each post’s link and the color of X’s own buttons. It does not read the text of posts, your account details or your messages. It runs on no other website, except when you use the toolbar button, the shortcut or the right-click menu on a page.
- What it keeps. Nothing. The extension stores no browsing history, cookies, identifiers or analytics. It remembers whether a post was saved only while that tab is open.
- What happens in mug. The mug app accepts only public web addresses. Before saving, it removes user names, passwords,
#fragmentsand common secret parameters (such astokenorcode) from the address. Once saved, the link is part of your mug library and is handled like any other link you save in mug, as this policy describes. That includes page fetching, where mug’s server fetches the saved page on request for a licensed app; the analysis itself runs with the AI you connect to mug. - Sharing. We do not sell this data or share it with third parties, and we do not use it for advertising or creditworthiness.
- Removing it. Uninstalling the extension removes it and everything it holds. Links you already saved stay in mug until you delete them there.
How long we keep data
- Pages and images we fetch: returned to your Mac and not stored by us.
- Operational logs: kept by Cloudflare for a short period, then deleted.
- License and purchase records: kept by Creem while your license is in use and as long as tax and accounting law requires.
- Waitlist email: until you unsubscribe or ask us to delete it.
- Your library: on your Mac, until you delete it.
Service providers
| Provider | Role | Data |
|---|---|---|
| Creem | Merchant of record: sells you the license, handles payment and tax, issues and checks license keys | Purchase details, license key, Mac name |
| Cloudflare | Runs our server, serves app updates and the website, bot protection on the website | IP address, request details, URLs of links you save and of the images in them |
| Websites you save | We request the page and the images in it from them on your behalf, so they see our server rather than your Mac. Your Mac also asks a saved site for its icon directly, without cookies, so that site sees your IP address. | The page and images requested; your IP address for icons |
| Hugging Face | Your Mac downloads the local search model from it once. No content is sent. | IP address |
| Resend | Website waitlist email | Email address |
These providers may process data outside Brazil (for example in the US) under their standard contractual protections. The AI provider you connect is your own choice, not our service provider.
Deleting your data
There is no mug account to delete. Deactivate this Mac in Settings removes this Mac from your license. To delete your purchase details or a waitlist email, write to diego@getmug.dev; we keep what tax law requires. Your library on your Mac is yours to delete.
Your rights
Under the LGPD and GDPR you can ask us to confirm whether we process your data, give you access or a copy, correct it, delete it, port it, restrict or object to processing, tell you who we share it with, or withdraw consent. Write to diego@getmug.dev. We answer within 15 days (LGPD) or 30 days (GDPR) and may ask you to confirm you hold the license. You can also complain to your data protection authority, such as the ANPD in Brazil.
Security
Traffic is encrypted, your license and AI keys are encrypted with the macOS Keychain, and our server keeps no copy of your content. If a breach affects your data, we will notify you and the authorities as the law requires.
Age
mug is for people 18 and older. We don’t knowingly collect data from minors.
Cookies
The app has no tracking or advertising cookies. The website uses Cloudflare Turnstile for bot protection on the waitlist.
Changes
We’ll post updates here. For material changes we’ll tell you in the app or by email 30 days before they take effect.
Contact
SCHELL CONSULTORIA PALESTRA E EVENTOS LTDA, CNPJ 49.241.699/0001-70, Alameda Vicente Pinzon, 54, Vila Olímpia, São Paulo - SP, 04547-130, Brazil. diego@getmug.dev