Ghostwood Software LLC (“Muddled”, “we”, “us”) operates the Muddled mobile application and trymuddled.com (collectively, the “Service”). This Privacy Policy describes what we collect, how we use it, who we share it with, and the choices you have. We wrote this in plain language because we think you should be able to read it without a lawyer.
1. Data we collect
We collect only what we need to operate the Service. The table below lists every category of personal data Muddled touches.
| Data type | Purpose | Where it lives |
|---|---|---|
| Email address | Account creation, sign-in, transactional email | Supabase Auth |
| Display name & username | Showing authorship on recipes and profile pages | Supabase database |
| User ID | Linking your data to your account; access control | Supabase Auth |
| Apple Sign In identifier | Signing you in via “Sign in with Apple” | Supabase Auth |
| Recipe content (text, ingredients, method, notes) | The core function of the app — storing your bar book | Supabase database |
| Recipe photos | Displaying images on your recipe cards | Supabase Storage (private bucket) |
| Avatar photo | Showing your profile picture | Supabase Storage (public bucket) |
| Camera image / pasted text (AI import) | Extracting structured recipe fields via OCR or text parsing | Transient — sent to Anthropic Claude API, not stored by us |
| Purchase history (subscription status) | Granting Pro / Bar entitlements | RevenueCat |
| Workspace memberships & roles | Bar-tier team collaboration | Supabase database |
What we do not collect
- We do not collect precise or coarse location.
- We do not use the Advertising Identifier (IDFA) and we do not show ads.
- We do not run cross-app or cross-website tracking.
- We do not collect contacts, health data, financial information (card details go directly to Apple / RevenueCat, never to us), or browsing history.
- We do not currently run a crash or analytics SDK. If we add one in the future, this policy will be updated before it ships.
2. How we use your data
- Operate the Service — store and display your recipes, sync between iOS and web, share recipes you publish, build menus and pour-cost reports.
- Authenticate you — verify sign-in via email link, password, or Apple Sign In; gate paid features by checking your RevenueCat entitlement.
- AI import features — when you paste a URL, photo, or text into the AI import flow, the content is sent to Anthropic’s Claude API to extract structured recipe fields. The response is returned to your device and stored only if you choose to save the resulting recipe.
- Communicate — send transactional emails (password resets, sign-in links, subscription receipts). We do not send marketing email without your separate opt-in.
- Comply with law — respond to lawful requests, enforce our Terms, prevent abuse.
3. Who we share data with
We share data with the following processors, each subject to a data-processing agreement and each used only for the purposes described:
| Processor | Purpose | Data accessed |
|---|---|---|
| Supabase | Database, authentication, file storage | All Service data listed in §1, encrypted at rest |
| RevenueCat | Subscription state & entitlement | Anonymous app user ID, purchase history |
| Apple | Sign in with Apple, In-App Purchase processing | Apple ID identifier (hashed), purchase receipts |
| Anthropic (Claude API) | OCR / text parsing for AI import | Image or text you submit; deleted on response per Anthropic’s API retention policy |
| Vercel | Hosting trymuddled.com | Standard server logs (IP, user agent, request path) |
We do not sell your personal data. We do not share data with advertisers, data brokers, or analytics resellers.
4. Visibility of your recipes
- Private — visible only to you (the default).
- Workspace — visible to the members of a workspace you choose.
- Public — visible to anyone, including search engines, on the Community feed and via shareable links. You can change visibility at any time; changing from Public to Private removes the recipe from public listings within minutes but cached copies (e.g., social-media previews) may persist for a short period.
5. Your rights
You have the right to access, correct, export, and delete your data.
- Access & correction — most fields are editable directly in the app or web dashboard (Settings → Profile).
- Export — use the JSON export feature on iOS (Settings → Data → Export) to download your full recipe library.
- Deletion — Settings → Delete Account permanently removes your profile, recipes, photos, menus, workspace memberships, and pour-cost data within 30 days. The deletion is atomic and irreversible.
- Manual requests — for any rights request, including data subject access requests under GDPR or CCPA, email travis@trymuddled.com from the address on your account. We respond within 30 days.
6. Data retention
- Active accounts: your data is retained while your account exists.
- Deleted accounts: data is removed from production within 30 days; encrypted backups are retained for up to 60 additional days, after which they are overwritten.
- Server logs: 30 days.
- AI import inputs: not retained — content is forwarded to the Claude API and discarded once the structured response returns.
7. Security
All network requests use HTTPS. Data is encrypted at rest by our infrastructure providers (Supabase, Vercel). Access to the production database is restricted to authorized employees of Ghostwood Software LLC and is logged. Row-level security policies in Supabase enforce that you can only read and write your own data, regardless of any application-level bug.
8. Children
Muddled is rated 17+ on the App Store. It is not directed at children under 13, and we do not knowingly collect personal data from anyone under 13. If you believe a child has provided us with personal data, contact travis@trymuddled.com and we will delete it.
9. International transfers
Our infrastructure providers operate primarily in the United States. By using the Service, you consent to transfer of your data to the United States, which may have different data-protection rules than your country.
10. Changes to this policy
We will update this page when our practices change. The effective date at the top will reflect the most recent material revision. Significant changes will be announced in-app and by email to active accounts.
11. Contact
Questions, requests, or concerns: travis@trymuddled.com
See also our Terms of Service and Support page.