MugibotPrivacy Policy
Template — have a lawyer review this before you launch. Replace the [bracketed] parts with your business details.
Last updated: [date]
What we collect
- Account: your username, email address (optional), name (optional) and a scrambled (hashed) version of your password. We never store the password itself.
- Delivery details you choose to save: name, checkout email, phone and address. Encrypted with a key unique to your account.
- Your watchlist: the SKUs you monitor and buy, alert settings (encrypted) and an activity log.
- Discord (if you connect it): your Discord user ID and username, and the sign-in tokens Discord gives us (encrypted) so our bot can add you to the members' server and message you.
- Connected browsers: the name and version of each browser you connect the extension to.
- Membership: payments are handled by Whop. We keep your Whop membership ID, its status and renewal date, and the Whop username and email Whop sends us — not your card.
What we don't collect
Your payment card. If you save a card in the Mugibot extension, it stays in that browser only. It's encrypted with a passphrase you choose and is never sent to us. We don't see your store logins or passwords, and we don't track your browsing. The extension only runs on the supported stores' pages, on payment boxes inside those pages, and on Mugibot itself. To check your own SKUs at stores that refuse server checks, it loads those SKUs' product pages from your browser about once a minute (you can switch this off).
How we use it
Only to provide Mugibot to you: filling in checkout when you ask, sending the alerts you set up, billing, account emails such as password resets, and keeping the service secure. We don't sell your data and don't use it for advertising.
Who can see it
Your data is tied to your login. Other users can never see it. Our admins can see your username, email, membership, Discord username and usage counts to provide support, but not your delivery details, watchlist or activity. They can see how many members watch each SKU in total, not who. Service providers we use: [hosting provider] (servers), Whop (payments), Discord (pings and the members' server), [email provider] (emails).
Security
Passwords are hashed with scrypt. Delivery details, alert settings and Discord tokens are encrypted with AES-256 under a key unique to your account. Connections use HTTPS. Logins and browser connections can be revoked at any time.
Your choices
You can see and change your details in your dashboard and download everything we hold about you (Account → Download my data). If you delete your account, all of your data is deleted, including your encryption key, so backups of it can't be read. To ask a question, or to complain under the Australian Privacy Principles, contact you@example.com. If we can't resolve it, you can contact the OAIC (oaic.gov.au).
Where data is stored
[Region of your hosting, e.g. Sydney, Australia].