Skip to the summary

PROJECT: OPERATOR REQUIRED DOCUMENT: PRIVACY POLICY UPDATED: 2026-09-01

OR // PUBLIC

PRIVACY POLICY

Operator Required is a project of Mt. Wizard Studios, LLC. This page describes what this website does, and what the Operator Required Control Center — the desktop application used to produce and publish the series — actually does with information when it is connected to a publishing platform.

LAST UPDATED: 1 SEPTEMBER 2026

AT A GLANCE

RESPONSIBLE OPERATOR
MT. WIZARD STUDIOS, LLC
APPLICATION
OPERATOR REQUIRED CONTROL CENTER (LOCAL, WINDOWS)
PUBLIC SIGN-UP
NONE — THERE ARE NO USER ACCOUNTS
WHERE DATA IS STORED
ON THE OPERATOR'S OWN MACHINE
ANALYTICS IN THESE PAGES
NONE
SALE OF PERSONAL DATA
NONE
CONTACT
OPERATOR-REQUIRED@MTWIZARDSTUDIOS.COM

Contents:

WHO THIS COVERS

Operator Required is an operation of Mt. Wizard Studios, LLC, which is responsible for this policy and for the practices described here.

Two separate things are covered, and they behave differently:

  • This website — the public Operator Required pages at mtwizardstudios.com.
  • The Operator Required Control Center — a Windows desktop application that Mt. Wizard Studios uses to produce episodes of the series and to publish them to platforms it has connected. It runs on the operator's own computer.

The application is not a hosted service and has no public sign-up. There are no member accounts, no customer records, and no visitor profiles. Where this page says operator, it means the person running the application on their own machine — in normal operation, Mt. Wizard Studios itself.

THIS WEBSITE

The Operator Required pages are static HTML and CSS. They set no cookies, contain no analytics script, no tracking pixel, no advertising code, and no cross-site tracking technology. Nothing on these pages asks you to sign in or fill in a form.

  • Hosting. The site is served by Netlify. Like any web host, Netlify processes the network requests needed to deliver a page, under its own terms and privacy policy.
  • Web fonts. These pages load the Archivo and JetBrains Mono typefaces from Google Fonts, so your browser makes a request to Google's servers when the page loads. That request is handled under Google's own policies. The text of this page is readable without those fonts and without JavaScript.
  • Email. If you write to the contact address below, your message and your address are received and kept as ordinary correspondence, for as long as needed to deal with it.

THE APPLICATION IS LOCAL-FIRST

The Control Center is a local program. Its web interface binds only to the loopback address 127.0.0.1 on the operator's own machine; it is not exposed to a network and there is no remote administration. It does not report usage back to Mt. Wizard Studios: there is no telemetry, no crash reporting service, and no analytics SDK in the application.

Operational state lives on that machine, in a local data folder:

  • a SQLite database holding episode records, production and review history, job records, publication packages, per-destination delivery state, connection records, and timing metrics;
  • content-addressed artifacts — the video masters, derivatives, images, captions, manifests, and evidence files produced by the pipeline, stored and referenced by SHA-256 hash;
  • an encrypted credential store, described below, which is kept outside the database.

Episode material comes from Mt. Wizard Studios' own production work and from public sources. When the topic scout runs, it records public signals from GitHub's public issue search — the issue title, its public URL, the repository name and issue number — and captures copies of the official documentation pages it used as evidence, together with the URL fetched and the response status. It does not collect contact details, account holders' names, or private repository content.

Language and image models used during production run locally. The revision planner refuses any model endpoint that is not on loopback, and image generation refuses remote endpoints by policy, so no episode material and no credential is sent to a third-party AI service.

CONNECTED PUBLISHING PLATFORMS

Nothing below happens until the operator deliberately connects a platform. Each connection is made through that platform's own official authorization flow, using the narrowest permission that will do the job. This is what each connection requests and what comes back.

YOUTUBE (GOOGLE)

  • Requested permission: youtube.upload only. That covers uploading a video with its title, description, tags, and thumbnail.
  • Received and stored: the OAuth access and refresh credentials, the list of scopes Google actually granted, and timestamps. No channel name, subscriber count, email address, or profile information is requested or read.
  • The broader youtube.force-ssl scope is deliberately not requested, which means the application cannot read back the state of a video it uploaded, and caption files are prepared locally for the operator to attach by hand.

INSTAGRAM (META)

  • Requested permissions: instagram_business_basic and instagram_business_content_publish. No messaging, comment, insights, or audience permission is requested. The Instagram Login route is used, so no linked Facebook Page is involved.
  • Received and stored: the account's Instagram user ID, its username, and its account type — which is checked because Meta's publishing API serves only professional (Business or Creator) accounts — plus the access credential, the granted permissions, and timestamps.
  • Before a release, the account's own content-publishing quota usage is read so that a post that would be refused for quota is reported in advance. Followers, comments, direct messages, insights, and other people's content are never accessed.

TIKTOK

  • Requested permission: video.publish only. video.upload is not requested.
  • Received and stored: the account's open_id, its creator username and display nickname, the privacy levels TikTok currently offers this app, the maximum post duration TikTok reports, and whether public posting is currently permitted — plus the access and refresh credentials, the granted scope, and timestamps.
  • That privacy-level answer is read before every delivery and taken at face value. If TikTok is not offering public visibility to this app and account, nothing is uploaded at all and the destination reports that it is waiting on platform approval.

GITHUB

  • Used as an evidence and reproducibility surface, not a social account. It requires a least-privilege GitHub App installation or a fine-grained token limited to one repository with Contents: write.
  • Received and stored: the repository name in owner/name form, whether it is private, and the commit or blob identifiers returned when a file is written — plus the token itself, encrypted, and timestamps. The repository is verified before anything is stored.
  • What is written there is the episode's own reproducibility package — a README and fixture data — under a per-episode path.

Each of these services is an independent third party. YouTube and Google, Instagram and Meta, TikTok, GitHub, and Netlify each process data under their own terms and privacy policies, which govern what they do with anything they receive.

CREDENTIALS AND SECRETS

  • No platform password is ever entered into Operator Required, and none is stored. The application has no password field for any platform. Sign-in happens on the platform's own site, in the system browser.
  • What it holds instead is application credentials the operator creates in each provider's developer console — a client ID and secret, an app ID and secret, a client key and secret, or a repository token — and the OAuth access and refresh credentials the platform returns after authorization.
  • Those secrets are encrypted at rest with Windows DPAPI (CryptProtectData, with an application-specific entropy value) and written to files kept outside the database. DPAPI ties the protection to the Windows account and machine that stored it, so a copied file does not decrypt elsewhere. This is the operating system's own credential protection, not an additional guarantee offered by Mt. Wizard Studios.
  • The database holds only references to those encrypted files, along with connection status, the granted scopes, the account label, the non-secret configuration such as the redirect address and API version, and timestamps. Secrets are not written into publication packages, manifests, or delivery receipts.
  • Authorization attempts are short-lived. The one-time value used to match an authorization response is stored only as a hash, expires within minutes — ten for the Google flow, thirty for the platforms that need a forwarding address — is accepted once, and the associated secret is deleted from the encrypted store as soon as the exchange completes.
  • Because Meta and TikTok both refuse loopback redirect addresses, the operator registers an ordinary https address they control to carry the authorization code back. Where that forwarding page is used, the one-time code appears once in that host's request logs; it is single-use, short-lived, and worthless without the client secret, which never leaves the local encrypted store. Pasting the returned address into the Control Center avoids even that.

HOW INFORMATION IS USED

Everything held is used for one of these purposes and no other:

  • to authorize and maintain the publishing connections the operator set up;
  • to check what a platform will currently allow before a release is offered;
  • to prepare platform-specific publication packages from one accepted master;
  • to upload and publish content after the operator has explicitly authorized that exact plan;
  • to reconcile what actually happened after a delivery, including after an interruption;
  • to prevent duplicate posting — a recorded remote ID is what stops a retry becoming a second post;
  • to keep a durable record of every attempted external action;
  • to make an episode reproducible, and to keep the production history the series is built on.

WHAT LEAVES THE MACHINE

Publication is not automatic. Preparation is entirely local, and no external action is taken until the operator types an authorization phrase against a specific displayed plan. That authorization is bound to a hash covering the master file, every derivative, the exact public wording, and the accounts involved, so if anything changes in the meantime the authorization is refused rather than applied to something else.

When a release is authorized, what goes to the platform is the material being published and the authorization needed to publish it: the video or image file, the title, description, tags, chapters, and caption text, and the access credential for that platform. That is content the operator has decided to make public. Once a platform holds it, that platform governs it under its own terms.

What comes back is recorded locally as a receipt: the platform, the action, its status, the authorizing event, the file hashes involved, the attempt count, the remote post or video ID, the public URL, the visibility, the platform's response, any failure code, and the start and end times. Deliveries that were interrupted before the platform answered are marked as unresolved for a person to check, rather than retried into a possible duplicate.

THE TEMPORARY INSTAGRAM MEDIA COPY

On the Instagram Login route, Meta does not accept an uploaded file. It fetches the media from a public address at the moment of publication, so the reel has to be publicly retrievable for the length of one publication. Rather than introduce a new service or a new credential for that, the reel is staged in the public GitHub repository the operator already connected for evidence, using the same least-privilege token.

The lifecycle is deliberately narrow:

  • only the already-authorized derivative is staged, at a path named after its own hash, and only from inside an authorized delivery;
  • the file is re-hashed from disk first, so a file altered after authorization is never staged;
  • the staged copy is then downloaded back anonymously, exactly as Instagram would fetch it, and compared byte for byte against the authorized hash — a URL serving anything else is never handed over;
  • the copy is removed once Instagram holds its own, and it is removed after a failed delivery as well;
  • a private repository is refused for this purpose, because Instagram could not fetch from it.

Two honest notes. The staged file is the same reel that is about to be published publicly on Instagram, so it is public material either way. And because the staging area is a Git repository, removal takes the file out of the repository's current contents; the commit that added it remains in that repository's history until the operator removes the history or the repository itself.

HOW LONG THINGS ARE KEPT

  • Local production history, artifacts, and evidence — kept indefinitely, on purpose. The series is evidence-based, and an episode's record is what makes its claims checkable. There is no automatic deletion; the operator removes them by deleting the local data folder or the files in it.
  • Publication receipts, remote IDs, and public URLs — kept with the episode for the same reason, and because a recorded remote ID is what prevents a duplicate post.
  • Access and refresh credentials — kept in the encrypted store until they expire, until the platform's authorization is revoked, or until the connection is removed in the Control Center. Instagram's long-lived credential is refreshed before expiry; TikTok's is refreshed as needed; both stop working when access is revoked at the platform.
  • Authorization session records — the one-time secret is deleted as soon as the exchange completes, and the session record itself expires after ten to thirty minutes depending on the flow, and cannot be reused.
  • Temporary staged media — removed after the transfer succeeds or fails, subject to the Git history note above.
  • Published content — once published, it lives on that platform and is governed by that platform's retention, not by this policy. Disconnecting a platform here does not remove anything already posted.

CONTROLS

  • Disconnect in the application. The Control Center has a disconnect control for Instagram, for TikTok, and for the media origin. Disconnecting deletes the local connection record and the stored credential for that platform, and any destination waiting to send stops claiming it is ready.
  • Revoke at the platform. Access can always be withdrawn from the platform's own side — Google Account permissions, Instagram's apps and websites settings, TikTok's connected apps, or by deleting the GitHub token or uninstalling the GitHub App. Revocation invalidates the connection here immediately; a stored credential that has been revoked simply stops working.
  • Delete the local data. Because everything operational is on the operator's machine, deleting the local data folder removes the database, the artifacts, and the encrypted credential files.
  • Ask us. If you believe Mt. Wizard Studios holds information about you, or you want something published by Operator Required reviewed or taken down, write to the address below and say what it concerns. We will answer. Where a request is really about data held by YouTube, Instagram, TikTok, or GitHub, it has to be made to that platform, and we will say so plainly rather than pretend otherwise.

WHAT IS NOT DONE

  • Personal information is not sold, rented, or traded.
  • Nothing is shared with advertising networks, data brokers, or marketing partners.
  • No advertising profile is built, and there is no cross-site tracking.
  • The application sends no usage telemetry to Mt. Wizard Studios.
  • No credential is shared with any AI or model provider; model inference is local only.
  • No password for any platform is requested or stored.
  • No platform data is accessed beyond the narrow scopes listed above — no messages, comments, follower lists, or audience insights.

The one thing that is deliberately not claimed is that data is never shared at all. Publishing means handing content and an authorization to a platform: YouTube, Instagram, TikTok, and GitHub necessarily receive what is published to them, and they process it under their own terms.

Operator Required is a professional publishing project and is not directed to children. It does not knowingly collect information from children.

CHANGES AND CONTACT

This policy is updated when the system changes. The date at the top of the page is the date of the current version, and it is the version in force.

operator-required@mtwizardstudios.com

Mt. Wizard Studios, LLC — Operator Required. This page describes how the project actually operates today. It was written by Mt. Wizard Studios from the system's own implementation, not by a lawyer, and it makes no claim of certification or audit under any privacy or security standard.