Privacy
Last updated 27 October 2026
Who we are
Muzzle is provided by aabergkvist AB, operating as Brilliant Rebels, the controller of the personal data described here.
aabergkvist AB · Org. no. 559317-4948 · VAT SE559317494801Ormastensvägen 9, Halmstad, Sweden
support@usemuzzle.com
On your Mac
Muzzle's checks run on your Mac. The email, phone number and name you enter at setup, and the keys and secrets it finds, stay there. The app needs no account.
What the app sends
Update checks
At launch and every 6 hours the app asks usemuzzle.com for the latest version and downloads it when there is a new one. We count these requests with the app version, when the request includes it, and the country of the connection.
Shared rules
Once a day the app downloads the signed Threat Feed rules from api.usemuzzle.com. The request carries no identifier.
Licence checks (Pro)
When you activate a key, and about once a day after that, the app sends:
- the licence key
- a device id, computed on your Mac as a one-way hash of its hardware UUID
- the Mac's computer name, so you can tell your Macs apart on the account page
We store a salted hash of the device id, the computer name and when the Mac was last seen.
Threat Feed (only while you contribute)
Contributing registers the Mac with its device id. After that the app sends, at most every 6 hours, signals of these kinds:
- Blocked request: the check that fired, the domain the request was going to (such as example.com) and where in the request it was found (such as body or URL)
- Injection attempt: the kind of attempt, a SHA-256 fingerprint of the text and the domain it came from
- Cleared false alarm: the check and where it was found
- Trusted site: the domain
- Secret format: the name of the check
Signals never contain your values, files, paths or code. We store them per day with a salted hash of the device id and a salted hash of the network the signal came from (its provider's AS number, or the IP prefix). Turning contributing off stops the signals.
Contact address (Pro)
When you turn the contact address on, the app sends the email address mail should be forwarded to. We store it with the contact address, its status and how many messages it has forwarded. Mail sent to your contact address passes through Cloudflare Email Routing and Resend to your inbox. We don't store its content.
The website and your account
Buying Pro
Stripe runs the checkout and handles your payment details. We receive your email address, your Stripe customer and subscription ids and your plan, store them with your licence key, and email the key to you.
Account page
When you ask for a sign-in link, we check whether the email address you enter has a Pro key and, if it does, email a one-time link that works for 15 minutes. Signing in sets a cookie on api.usemuzzle.com that keeps you signed in for 30 days. It is the only cookie we set.
Enterprise quotes
The quote form sends your work email, name, job title, team size, tools, needs and timing, plus the country of your connection. We store it and email it to ourselves so we can reply.
Email to us
Mail to support@usemuzzle.com or hello@usemuzzle.com is forwarded to our inbox through Resend.
Analytics
We use Umami, hosted by us on Hetzner in the EU, to count page views, downloads, update checks, sign-ups and purchases. It sets no cookies and doesn't store IP addresses. It records the page, referrer, browser, operating system, device type and country.
Abuse limits
To stop abuse we count requests per day by IP address, email address or sender. The counters hold a salted hash instead of the address and are deleted after two days.
Why we use it
- To provide what you ask for (licences, the contact address, the account page, the Threat Feed, quotes and support): performance of a contract, or steps before one.
- To count usage and keep the service running and protected: our legitimate interest.
- To keep accounting records: legal obligation.
Who processes it for us
- Cloudflare: hosting of the website and API, database and email routing
- Resend: sending email, including forwarded mail
- Stripe: payments. Muzzle subscriptions are sold through Stripe Managed Payments: Stripe is the merchant of record and reseller and handles payment and tax. Stripe uses your payment details under its own privacy policy.
- Hetzner: hosting of our Umami analytics, in the EU
Where these providers process data outside the EU/EEA, they do so under safeguards such as the EU standard contractual clauses.
How long we keep it
- Threat Feed signals: 91 days
- Abuse counters: 2 days
- Sign-in links: 1 day
- Contact addresses that were never confirmed: 7 days
- Licences: while the subscription exists, and 24 months after it is cancelled
- Macs on a key: 12 months after the Mac was last seen
- Contact addresses: 12 months after the last forwarded email or status check
- Enterprise quote requests: 24 months
- Threat Feed registrations: until you ask us to delete them
- Email to support: as long as we need it to handle your request
Your rights
You can ask for a copy of your data, have it corrected or deleted, restrict or object to how we use it, and receive it in a portable format. Email support@usemuzzle.com and we will answer within one month.
You can also complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, imy.se).
Changes
When this policy changes, we update this page and the date at the top.