PRIVACY POLICY

Contraband

EFFECTIVE 2026-05-19 · BRANDED MAYHEM COLLECTIVE LLC · RICHARDSON, TX

TL;DR

Five of our six plugins transmit nothing to Branded Mayhem Collective. No telemetry, no analytics, no error reporting, no third-party SDKs. Everything they generate stays on your machine or in your Claude session.

One exception: SEO & Visibility Toolkit calls the DataForSEO API on your behalf using your DataForSEO credentials (which you provide at install and we never see). The calls and their responses pass between your machine and DataForSEO; they do not pass through us. Detailed disclosure below.

1. What this policy covers

This policy describes how the six Contraband plugins — humanize-kit (free), Brandprint Engine, Content & Creative Lab, SEO & Visibility Toolkit, Conversion Architecture, and Sales Accelerator — handle data when you install them in Claude Code, Claude.ai web, or Claude Cowork. It also covers the contraband.brandedmayhem.com storefront and related infrastructure.

It does notcover (a) Anthropic's handling of your conversations with Claude — see Anthropic's Privacy Policy for that, or (b) DataForSEO's handling of API requests if you use the SEO & Visibility Toolkit — see DataForSEO's Privacy Policy.

2. What we do not collect through the plugins

Across every Contraband plugin, we — Branded Mayhem Collective — do not collect:

  • //Your voice profile, writing samples, or any text you ask a plugin to rewrite
  • //Brand strategy inputs, audience descriptions, competitor URLs, or research outputs
  • //DataForSEO credentials, API call contents, or API responses
  • //Sales roleplay transcripts, outreach campaign data, or pricing inputs
  • //Telemetry, error reports, crash logs, plugin-usage analytics, or feature-flag pings
  • //Anything else — the plugins ship no networking code that points at our servers

The repos are MIT-licensed for the free humanize-kit (publicly inspectable at Branded-Mayhem-Collective-LLC/humanize-kit) and source-available to paying buyers for the five paid plugins. Network behavior is verifiable by reading the code.

3. Per-plugin data flows

Each plugin has slightly different processing surface area. Here's the truth on each.

humanize-kit (free)

Three skills (voice-profiler, humanize, humanize-ig) plus one Python post-processor (de_emdash.py, stdlib-only). The voice-profiler interview happens entirely between you and Claude (under Anthropic's privacy terms). The resulting profile file lives at ~/.claude/voice-profile.md (Claude Code) or /mnt/user-data/outputs/voice-profile.md (Claude.ai web / Cowork). humanize and humanize-ig read that file to color their rewrites. No network calls.

Content & Creative Lab

Eight skills, three of which (humanize, humanize-ig, voice-profiler) are syncs of the humanize-kit versions. The remaining five (ai-focus-group, creative-thinking-ai, linkedin-authority, mayhem-method-ai-use, story-spine) are pure methodology in Markdown — no scripts, no network calls. Same voice-profile file handling as humanize-kit. No telemetry.

Brandprint Engine

Ten skills plus a research engine with Python validation scripts (validate_report.py, verify_citations.py, md_to_html.py). All scripts run locally. A SessionStart hook checks for Python and weasyprint; a PostToolUse hook auto-runs the report validator when a brandprint deliverable is written. Neither hook makes network calls.

The deep-research skill conducts multi-source research using Claude's built-in WebSearch / WebFetch tools and (optionally) the user-installed Tavily MCP. Those tools belong to Claude/Anthropic, not to us; we never see the queries or results. All report files write to ~/Documents/[Topic]_Research_YYYYMMDD/ (Code) or /mnt/user-data/outputs/ (web).

SEO & Visibility Toolkit (the one exception)

This is the only Contraband plugin that has its own network behavior. The bundled dataforseo_client.py issues HTTPS requests to api.dataforseo.comon your behalf, authenticated with credentials you provide at install time. The credentials live in your system keychain (via the plugin's sensitive userConfig block) or in your shell environment variables — never in our systems.

Specifically:

  • //The request and response bodies flow only between your machine and DataForSEO.
  • //We never see your DataForSEO login, password, queries, or returned data.
  • //DataForSEO's own privacy policy governs what they do with your queries on their side — read it here.
  • //The other three skills in this plugin (local-services-seo, ai-agent-readiness, data-density-commerce) are pure methodology and make no API calls.

Conversion Architecture

Three skills (neuro-design, ux-ui-psych, fairness-anchor-ladder). Pure methodology in Markdown. No scripts, no hooks, no network calls, no userConfig, no third-party services.

Sales Accelerator

Three skills (pitching-pivot, outreach-diagnosis, sales-simulator). Pure methodology in Markdown. No scripts, no hooks, no network calls, no userConfig, no third-party services.

4. Your conversation with Claude is between you and Anthropic

Everything you type into Claude — including writing samples during voice profiling, brand strategy inputs, the AI text you ask a plugin to rewrite, plus any output a plugin produces — flows through Anthropic's systems under their privacy terms. We have no access to those conversations. We do not receive copies. We do not log them. Anthropic may, per their own policy — read it here.

5. The contraband.brandedmayhem.com storefront

The storefront site is separate from the plugins. Its data flows:

Hosting

Served via Cloudflare Workers. Cloudflare logs standard request metadata (IP address, user agent, timestamp) for the duration required by their abuse and operational systems — see Cloudflare's Privacy Policy. We do not run our own analytics or tracking pixels.

Purchases (paid plugins only)

If you purchase one of the five paid plugins, checkout runs through Polar, which handles payment processing and GitHub repo invitations. Stripe processes the card itself; we never see card data. Polar shares your email address with us for purchase fulfillment and receipt delivery. humanize-kit is free and does not touch this flow.

GitHub access delivery

Paid plugin delivery happens by adding you as an outside collaborator on the private GitHub repo for each plugin you bought. GitHub sees your username and the invitation. We can see the same. If you uninstall a plugin from Claude, we still retain your GitHub collaborator record so you can pull updates — email hello@brandedmayhem.com to be removed.

Newsletter (opt-in only)

The footer subscribe form hands off to Substack for the M.L. Sebastian newsletter. We do not store newsletter subscriptions on our own infrastructure.

6. Your rights

Because the plugins themselves transmit no data to us, there is nothing for us to give you, correct, or delete on our side regarding plugin usage. Practical rights:

  • //Delete your voice profile or research outputs: remove the files from your machine or session sandbox.
  • //Uninstall a plugin: /plugin uninstall <name> in Claude Code, or remove the skill folders from your Claude.ai/Cowork skills directory.
  • //Revoke DataForSEO credentials (if using SEO & Visibility Toolkit): rotate the password in your DataForSEO account, or run /plugin manage seo-visibility-toolkit in Claude Code to clear the stored credentials from your keychain.
  • //Be removed as a GitHub collaborator on paid-plugin repos: email hello@brandedmayhem.com.
  • //Receive purchase data: Polar can show you your purchase history directly — or ask us and we'll pull what we have (typically email, purchase timestamp, product, amount).
  • //Anthropic-side data: for conversations with Claude, contact Anthropic per their privacy policy.

7. Children

Contraband plugins are not designed for or directed at children under 13. Branded Mayhem Collective is a B2B agency and our products target professional operators. We do not knowingly collect data from children. If a child has installed a plugin, see Section 6 above — the plugins (with the one DataForSEO exception) transmit nothing, so the practical step is to delete any local files and uninstall.

8. Changes to this policy

We will update the effective date at the top of this page when this policy changes. Because the policy lives in the same Git repository as the storefront source code, every revision is publicly inspectable in the commit history of Branded-Mayhem-Collective-LLC/contraband-storefront.

9. Contact

Privacy questions, requests, or anything that doesn't fit above:

Branded Mayhem Collective LLC
Richardson, Texas, United States
hello@brandedmayhem.com

Last updated 2026-05-19. Governed by the laws of the State of Texas, USA.