A straightforward privacy note.
This privacy note describes MuteThis, updated October 14, 2026.
Words are unlocked for one session and one pairing or check at a time. Temporary access records expire automatically and are removed during routine cleanup. In Settings, use Sign out other devices to revoke your other sessions.
What MuteThis stores
MuteThis stores your display name, profile ID, email if provided, salted password hash if you choose password sign-in, passkey public key and metadata if you choose a passkey, sessions, contacts, pairing details, and check outcomes. It never receives your passkey private key or biometric data. It does not upload your address book. MuteThis checks do not use your microphone.
Email and recovery
Resend processes email delivery for verification links, password resets, and feedback alerts to the project owner. Verification links expire in 24 hours; reset links expire in 15 minutes. MuteThis stores only hashes of these tokens. Links are single use. Existing unverified email addresses are not eligible for password recovery. Feedback alerts contain the submitted message and optional reply email. Account creation does not subscribe you to marketing.
Optional launch notifications
When you request updates, MuteThis stores your email, selected tools, consent wording and version, language, source, and timestamps in separate launch-interest tables. These records are not linked to your verification profile, contacts, or checks.
Resend delivers your confirmation link. Only after you confirm do we synchronize your choices to the dedicated MuteThis launch list and matching product topics. Unselected topics stay off. Existing email unsubscribes are respected. Signing up does not subscribe you to other brands or general marketing.
Use Manage notifications to request a private link, change your interests, or unsubscribe. Links expire after 24 hours; only token hashes are stored. Your changes are saved before success is shown. Provider synchronization failures are retried on site visits; until synchronized, we retain your saved choices and show the pending status.
Unconfirmed requests are removed after seven days. Consent records and inactive subscriptions are retained for up to 12 months after their applicable timestamps; active subscriptions remain until you unsubscribe. Cleanup runs when forms are used. Short-lived IP hashes and form challenges help limit abuse. Contact us through feedback for deletion requests.
Optional browser research survey
After confirming browser-extension updates, you can optionally share experiences, filtering preferences, websites or apps you would like supported, concerns, and pricing or sponsorship preferences. Skip any question or the whole survey. Nothing is stored until you choose Send feedback. Responses are linked to your launch signup email, separate from your verification profile, contacts, checks, and browsing activity.
Survey responses include the question version, the sponsorship frequency shown, language, submission source, timestamps, and your separate research follow-up choice. Follow-up permission is optional and unchecked by default. Answers are available only through your private email link and the private owner report; they are not sent to the email provider or advertising platforms. We do not automatically email survey invitations or follow-ups.
You can edit or delete your response through a current Manage notifications link. Deleting a response also removes its research follow-up permission; it does not unsubscribe you from tool updates. Unsubscribing from tool updates does not delete a separately submitted survey response. Responses expire 12 months after their last update and are removed when signup forms are used; expired responses are excluded from reads and reports. You can also request deletion at support@mutethis.com.
Retired voice demo
The optional voice demo was retired on October 5, 2026. MuteThis no longer records, uploads, or generates audio and no longer contacts Cartesia. MuteThis did not store recordings or generated audio in its database or public files. Consent and cleanup records from earlier demos may remain. Cartesia may retain earlier processing records or backups under its own privacy policy.
Optional camera scanning
If you choose to scan a pairing code, MuteThis asks for camera permission. QR codes are read on your device. Camera images are not recorded, uploaded, or stored. Only the invitation token is sent to MuteThis to continue pairing. The camera stops when a code is accepted, you leave the scanner, or you put MuteThis in the background.
Temporary words and invitations
QR pairing invitations last five minutes; shared invitation links last 24 hours. Each invitation can be accepted by one person. Pairing words are cleared when the invitation completes, is canceled, or expires. Check requests allow two minutes for approval, then a separate two minutes to compare words. Check phrases are available only to the two participants during comparison. They are erased when a check ends or its expiry is processed and never appear in history. Expiry blocks access immediately.
MuteThis browser extension
If you connect the optional Chrome extension, MuteThis stores your filtering preferences, thresholds, browser name, connection expiry, and a hash of its access token. You explicitly approve each browser and can remove its access in connected-browser settings. Password changes, password resets, and signing out other devices revoke extension connections.
For each AI check, selected page text and image previews are sent to MuteThis and OpenAI Decisions. MuteThis does not save those raw page contents or image previews. It stores evidence hashes, rule identifiers, decisions, request identifiers, and usage records to avoid duplicate charges and enforce account allowances. Decisions and detailed usage are removed after 30 days when Safe Space is next used; minimal accounting and duplicate-request records remain while your account exists. Unconfirmed provider charges retain a spending reservation until reconciled. Deleting your account removes its Safe Space records; an anonymous aggregate spending total remains.
Sampled animation frames and video posters do not represent a complete animation or video check. Failed or incomplete checks remain covered. OpenAI processes submitted content under its applicable API data policies. Safe Space pilot access does not start a subscription.
Detailed usage telemetry records provider-call counts, measured input tokens, classifier versions and coarse rule/media categories. It contains no page text, image pixels, full page addresses or feedback excerpts. Account telemetry is retained for 30 days; anonymous daily cohorts for up to 90 days. Fixed expiry cleanup runs during service use and the daily retention check. Expired telemetry is excluded from reports immediately. Minimal financial costs, unresolved spending holds and duplicate-request records follow the account-lifetime policy above. Token-based reference estimates and conservative settled amounts are not provider invoices or customer prices. Actual hosting charges and unavailable provider costs are reported as unknown.
Optional filtering reports
Filtering reports remain on your device until you explicitly choose Send to MuteThis. A submitted report is linked to your account and selected rule. Reported observations are stored separately from available server classification records. Notes and optional text excerpts are untrusted review material. Excerpts require a separate choice; images and full page addresses are not attached automatically.
Server reports expire 30 days after receipt and are removed by daily cleanup. You can delete a submitted report; only a content-free account/report marker remains until expiry to prevent a delayed retry from restoring it. Account deletion also removes these reports. Review requires a recently verified owner session. Sending feedback makes no AI call, changes no rules and does not automatically train a model or add examples to production prompts.
Storage and retention
Application data is stored in the site’s managed relational database. Development data is separate from production. A maintenance task runs at most hourly when the app receives traffic. It deletes outcomes older than 30 days, expired sessions, and invitations and challenges expired for more than a day. If no one uses the site, cleanup waits for the next request; expiry still blocks access immediately.
Session cookies are secure, HTTP-only, and valid for at most 30 days. Sign-out revokes your current session. A separate temporary cookie binds a passkey prompt to your browser. A pending invitation token may be held in your tab’s session storage while you sign in and is removed after it is claimed. A link you create is also held in that tab’s session storage so you can share it again while it remains open. Its local copy is removed when you view its completed, canceled, or expired state. Invitation tokens are stored as hashes on the server.
Language preferences
A language preference cookie lasts up to one year. Your notification language is also stored on this device. The shared word language is saved with an invitation and contact pairing so both people always compare the same words. Language preferences are not used for tracking.
Optional notifications
If you enable alerts, MuteThis stores your browser’s push subscription address and encryption keys, linked to your profile and current session. Your browser’s push provider (such as Apple, Google, Mozilla, or Microsoft) delivers encrypted alerts. Alerts contain a check identifier and expiration time, never names, contact labels, or comparison words.
Turn off notifications in Settings to remove this device’s subscription. Sign-out removes subscriptions linked to that session; deleting your profile removes all of them. Expired sessions are excluded from delivery immediately and removed during cleanup. The home-screen app caches only public icons and an offline message, not your contacts, checks, or words.
Campaign measurement
MuteThis uses first-party campaign labels and a random tab identifier to measure visits, signups, pairing, and the first successful check. The identifier stays in your tab’s session storage for up to 30 days or until the tab closes or signup finishes. Campaign records contain no names, email addresses, comparison words, full URLs, or address-book data and are not sent to advertising platforms.
At signup, campaign information can be linked to your profile ID and the profile that invited you. Invited signups are counted separately. Campaign records are kept for up to 90 days, with traffic-triggered cleanup. Deleting your profile removes its linked campaign records. MuteThis skips new visit and signup measurement when your browser signals Global Privacy Control or Do Not Track.
Campaign measurement also records whether a visit starts or finishes the practice check, opens setup, views or starts the signup form, submits it, or encounters a signup error. It records timestamps only, never form entries or error messages. These records follow the same 90-day retention and browser privacy choices.
Beta signup measurement
For beta-list requests, short campaign labels from your measured visit may be copied into the separate email consent record. This lets MuteThis count requests and confirmed subscribers by campaign, including when you confirm on another device. These labels are not sent to Google or included in the email-provider contact. They are removed from consent records after 90 days when forms are used. Global Privacy Control and Do Not Track prevent new campaign attribution.
Google Ads
With your permission, public pages load the Google Ads tag to measure advertising. Google can receive technical information such as your IP address, browser details, and ad interactions, and use advertising cookies. The tag does not load on sign-in, pairing, or private app pages. MuteThis does not send Google names, emails, invitation tokens, comparison words, or its internal campaign records. Ad personalization is disabled. You can change your choice below; the choice is stored on this device for up to six months. Global Privacy Control and Do Not Track prevent the tag from loading.
Feedback
Feedback includes the category, message, optional reply email, and submission time. It is private and retained for up to 12 months, subject to the same traffic-triggered cleanup. A hash of the connection IP is used for short-lived rate limiting; feedback records do not contain that hash. Feedback is independent of your MuteThis profile.
Deleting your profile
Settings → Delete profile requires fresh confirmation when needed. It deletes the profile, login credentials, sessions, pairings, invitations, and checks. Contacts lose the pairing. Separately submitted feedback is not automatically linked or deleted.
Hosting and access
This site is publicly accessible through ChatGPT Sites. Your contacts and checks require a signed-in MuteThis session. The hosting provider processes technical data to deliver and protect the site. MuteThis’s server validates sign-in and manages checks; verification depends on that server.
Questions?
Use the feedback form. Don’t include passkeys, check phrases, or private information about another person.
Back to MuteThis