Privacy Policy

Last updated 23 October 2026. This policy describes what MuseWick does with personal data today. It is written against what the service actually does, and it changes before a feature ships, not after.

Who is responsible

The data controller is Maryia Naskevich, an individual based in Poland. Contact: marianaskevich@gmail.com. Because the controller is established in the EU, the GDPR applies to everyone using the service, wherever they are.

What is collected, and why

If you sign in

Sign-in is through Google. MuseWick asks Google for two things only — the permission scope requested is openid email:

Your Google account identifier. An opaque string. It is the identity: changing your email address keeps your account and your videos.
Your email address. Kept so the service can show whose session is signed in and reach you about your account.

Your name, profile picture, contacts, Google Drive and everything else in your Google account are not requested and are not received.

Staying signed in

A single cookie holds a signed token containing your account identifier and an expiry, 30 days from sign-in. There is no session database. The cookie is not used for advertising or analytics, and MuseWick sets no other cookies.

What you make

For each video the service stores the settings you chose (niche, visual style, voice, language, captions, schedule, and any description, example script or reference links you typed), the subject the episode is about, and a record of what was sent to the suppliers who made it — the narration’s angle and the description of each shot. The finished video file is stored so you can download it, together with its title, description, hashtags, planned date and your thumbs up or down. This record exists so an episode can be looked at afterwards and so a series does not repeat itself.

So a video can be edited later without being made again, each scene’s picture, narration and word timings are kept with it. Music and pictures you upload are kept so they can be used in your videos. Reference links are stored as text and are never visited or downloaded.

If you connect a YouTube channel

Connecting a channel is optional and is how MuseWick posts your videos for you. It goes through Google, which asks your permission for two things:

Upload videos to YouTube (youtube.upload) — used only to upload videos you made in MuseWick, to the channel you chose, with the title, description and hashtags shown on the video’s page, when you approve the post or at the date you scheduled. Uploads are marked as containing synthetic media.
View your YouTube account (youtube.readonly) — used only to list your channels so you can pick one. MuseWick keeps each channel’s identifier and name.

To keep posting on your schedule, MuseWick stores the long-lived permission Google issues (a refresh token). It is encrypted before it is stored, is never shown on any page, and is never shared. For each posted video MuseWick keeps the YouTube video identifier, its link and the visibility YouTube reported.

MuseWick does not read your existing videos, comments, subscribers or analytics; does not edit or delete anything on your channel; and does not use data from YouTube for advertising, to train AI models, or for any purpose other than posting the videos you asked it to post.

MuseWick’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. MuseWick uses the YouTube API Services; by connecting a channel you also agree to the YouTube Terms of Service, and Google’s handling of the data is described in the Google Privacy Policy.

Disconnecting. Remove the channel on its series page (“Disconnect”), which deletes the stored permission straight away, and/or withdraw MuseWick’s access at any time in your Google account at myaccount.google.com/permissions. Deleting your MuseWick account deletes every stored permission with it. Videos already posted stay on your channel — they are yours.

If you connect a TikTok account

Connecting TikTok is optional and works the same way. TikTok asks your permission for two things:

Read your profile info (user.info.basic) — used only to show which account is connected. MuseWick keeps the account’s TikTok identifier and display name.
Post content to TikTok (video.publish) — used only to post videos you made in MuseWick to that account, with the caption and hashtags shown on the video’s page, when you approve the post or at the date you scheduled. Posts are labelled as AI-generated.

MuseWick stores the long-lived permission TikTok issues (a refresh token, which TikTok replaces each time it is used); it is encrypted before it is stored, never shown on any page and never shared. For each posted video MuseWick keeps the identifier TikTok returns, its link and the visibility it was posted with. MuseWick does not read your videos, followers, messages or analytics, and does not edit or delete anything on your account. By connecting you also agree to TikTok’s Terms of Service; TikTok’s handling of the data is described in its Privacy Policy.

Disconnecting. Remove the account on its series page (“Disconnect”), which deletes the stored permission straight away, and/or withdraw MuseWick’s access in the TikTok app under Settings and privacy → Security and permissions → Apps and services permissions. Videos already posted stay on your account.

If you connect an Instagram account

Connecting Instagram is optional and works with professional (Business or Creator) accounts. Instagram asks your permission for two things:

Basic profile (instagram_business_basic) — used only to show which account is connected. MuseWick keeps the account’s Instagram identifier and username.
Publish content (instagram_business_content_publish) — used only to post videos you made in MuseWick to that account as Reels, with the caption and hashtags shown on the video’s page, when you approve the post or at the date you scheduled. Reels are labelled as AI-generated.

To post, MuseWick gives Instagram a temporary link to the finished video, which Instagram downloads. MuseWick stores the long-lived permission Instagram issues (renewed as it is used); it is encrypted before it is stored, never shown on any page and never shared. For each posted Reel MuseWick keeps the identifier Instagram returns and its link. MuseWick does not read your posts, followers, messages, comments or insights, and does not edit or delete anything on your account. Meta’s handling of the data is described in the Instagram Privacy Policy.

Disconnecting. Remove the account on its series page (“Disconnect”), which deletes the stored permission straight away, and/or remove MuseWick in Instagram under Settings → Apps and websites. Reels already posted stay on your account.

What is not collected

No analytics, no tracking pixels, no advertising identifiers.
No payment card details ever reach MuseWick — see below.
No data is sold, rented or shared for anyone else’s marketing.

Legal bases

Performance of a contract — your account, your videos, and running your schedule. Without this data there is no service to provide.
Legitimate interests — keeping the service working and secure, and keeping records of what was generated so faults can be diagnosed.
Legal obligation — records the seller of record is required to keep for tax purposes.

Who else processes your data

Making one video passes text through several suppliers. They act as processors on MuseWick’s instructions:

Anthropic — writes the script from the subject and the settings.
ElevenLabs — turns the script into narration.
OpenAI — aligns the narration to the words so captions can be timed.
fal.ai — generates the images for each shot, and the short moving opening when that option is on.
Google — sign-in, and posting to YouTube for channels you connect.
TikTok — posting to TikTok accounts you connect.
Meta (Instagram) — posting Reels to Instagram accounts you connect.
Amazon Web Services — stores the finished video files.

These suppliers receive the text of the script and the descriptions of the shots. They do not receive your email address or your account identifier. YouTube, TikTok and Instagram receive the videos you post to them and their title, description and hashtags.

Payment

Payment is handled by Polar, which is the merchant of record — Polar is the seller for the transaction, collects the money and handles sales tax and VAT. Your card details are given to Polar and never to MuseWick, which receives only the fact that a subscription is active. Polar’s own privacy policy governs what it does with your payment data.

Where data is held

The service and its storage run in the European Union. The suppliers listed above are mostly established in the United States, so text sent to them leaves the EU. Those transfers rely on the European Commission’s standard contractual clauses in each supplier’s terms.

How your data is protected

The data MuseWick treats as sensitive is the permission each connected platform issues to post for you (Google’s refresh token for YouTube, and the TikTok and Instagram tokens), your email address, and the videos you make. They are protected like this:

Encrypted in transit. Every page and request on musewick.com is served over HTTPS (TLS), and every call MuseWick makes to Google, TikTok, Instagram and the suppliers listed above is made over HTTPS.
Platform permissions encrypted at rest. Each token is encrypted with AES-256-GCM before it is written to the database. The key is not stored in the database: it is held only in the hosting provider’s secret store for the running service, so a copy of the database alone cannot be used to post anything. Tokens are never shown on any page, never written to logs, and never sent anywhere except back to the platform that issued them.
Sign-in. Your session is a signed cookie marked Secure and HttpOnly, so scripts on a page cannot read it; it ends after 30 days or when you sign out. MuseWick never sees or stores your Google password.
Your videos. Finished videos and their pictures are kept in private storage that is not publicly listable. They are reached only through signed links that expire, issued to you or to the platform you are posting to.
Minimum access. MuseWick asks each platform only for the permissions listed above. Access to the production database, storage and keys is limited to the person responsible for MuseWick named at the top of this policy. No one reads data received from Google APIs except when you ask for help with your account, when it is needed for security, or when the law requires it.
Separation between accounts. Every request for a video, a series or a connected channel is checked against the signed-in account, and one account cannot read or use another’s.
If something goes wrong. If a breach affects your personal data, MuseWick will tell you and the supervisory authority without undue delay, and within 72 hours where the GDPR requires it.

How long it is kept

Account and videos — for as long as you have an account. Delete your account and they go with it.
A connected channel’s permission — until you disconnect it, withdraw it at Google, or delete your account.
The session cookie — 30 days, and it can be ended at any time by signing out or clearing it.
Operational logs — short-lived, and kept only for diagnosing faults.

Your rights

You may ask for a copy of your data, ask for it to be corrected or erased, object to processing, or ask for it in a portable form. Write to marianaskevich@gmail.com and you will get an answer within 30 days. You may also complain to a supervisory authority; in Poland that is the President of the Personal Data Protection Office (UODO).

Children

MuseWick is not for people under 16 and no account should be created by one. If you believe a child has an account, write to the address above and it will be removed.

Changes

When this policy changes the date at the top changes with it. Changes that affect what is collected or who receives it will be told to account holders by email before they take effect.