Muse Privacy Policy

Last Updated: October 16, 2026

1. Introduction

Welcome to Muse ("we," "our," or "us"). Muse is a social discovery and dating app for people 18 and older that helps you meet people through music, in the app and at live music events. This Privacy Policy explains how we collect, use, disclose, and protect your information when you use the Muse app on iPhone or Android and the Muse App Clip on iPhone, and when you visit our websites at museapp.co, including the event organizer portal and the campus ambassador dashboard (Section 2.9).

By using Muse you agree to the practices described here. If you do not agree, please do not use Muse. Questions go to privacy@museapp.co.

2. Information We Collect

2.1 Information you give us

Account: your first name, birthdate (we compute and store your age from it), gender, and email address. Email is required on both ways in: verifying an email from a US college or university, and applying with another email for review, each send a one time code to the address you type. Your name and birthdate are locked after sign up for safety reasons; Section 6.1 explains how to correct them.
Profile: at least three photos, a bio, the artists and genres you pick, and three prompts with a song each. These are required to build a profile. Optional fields: height, ethnicity, religious beliefs, political beliefs, job, education, and college details. Who you are interested in is used to decide who you see and who sees you.
Wall selfies, captions and songs: the front camera selfies you post to an event photo wall (Section 2.7), and the photos you post to your campus wall, taken with your camera or chosen from your photo library, each with an optional caption and an optional song you choose from Spotify. A photo from your library is cropped to a square on your phone and sent without its location or other photo details.
What you send: messages to matches, reactions, tracks you share in chat, the note you attach to a like, and any reports or feedback you send us, including when you tell us a message bothered you.
Referral code: the referral code on your profile and any code you enter at sign up (Section 2.10).

2.2 Information collected automatically

Location: with your permission we collect your precise location for two purposes. First, discovery: we store your most recent coordinates on your private profile record and use them to show you people nearby and to show others your approximate distance. We keep only the latest fix, never a history, and we never show anyone your coordinates or address. Second, event check in: your device location is used for a moment to confirm you are at the venue, then discarded; we store only a flag saying you were verified at the venue. Location is optional and you can turn it off at any time in your phone's settings (Section 6), but without it you will not appear in discovery or see new people.
Device information: device model, operating system (iOS or Android) and its version, app version, language, and the identifiers our analytics and push tools assign to the app install.
Network information: your IP address reaches our servers with every request. We use it for security and rate limiting and keep only short lived logs of it. Our analytics provider also sees it and estimates an approximate country, region, and city from it (Section 4.2).
Device integrity signals: we use Apple App Attest and DeviceCheck on iPhone, and the Google Play Integrity API on Android, to generate a device attestation that helps us spot bots, fake accounts, and abuse. It does not identify you personally.
Usage data: which screens you open, which features you use, cards viewed, likes sent, matches made, and similar product events, sent to our analytics tool (Section 10.1). Muse does not record your screen or your sessions.
Purchases: if you buy Peeks, Spotlights, or Super Stars we receive transaction records and purchase status from Apple (iPhone) or Google Play (Android) through RevenueCat, and the country of your store account, which we use only for analytics. We never receive or store your payment card details.
In app music playback: songs you play inside Muse, which power your Recently Played section, Live Mode, and the campus Top Tracks of the Day board.

2.3 Spotify

What we collect: a Spotify sign in (so we know you have a Spotify account), playback events for songs you play through Spotify while using Muse, on iPhone, the OAuth tokens that let Muse control playback, and, when you add a song to a selfie, that song's Spotify id, title, artist and cover image, which Muse looks up from Spotify when you post. On iPhone, tokens are stored in the iOS Keychain. On Android, Muse controls playback through the Spotify app on your phone and does not keep a Spotify token.

What we do not collect: your Spotify listening history outside of Muse, your saved playlists or library, your top artists or tracks from Spotify servers, your followers, or any Spotify account data beyond the sign in. Your top artists and genres on Muse are ones you pick yourself.

Technical detail: we use Spotify's iOS and Android SDKs to integrate with the Spotify player. When you play music through Spotify while using Muse, we receive and store playback events from the SDK. That data powers your Recently Played section (visible to anyone who can view your profile, Section 4.1) and Top Tracks of the Day (what people at your college are playing, in aggregate). We do not call the Spotify Web API to read your listening history, playlists, or other account data.

2.4 Information from third parties

Sign in with Apple (iPhone): an identity token and, if you choose to share them, your name and email (or an Apple relay email).
Sign in with Google (Android): an identity token, your Google account email, and your Google account identifier.
Age signals from Apple and Google: on supported iPhones we ask Apple's Declared Age Range, and on Android where Google offers it we ask Google Play Age Signals, whether your account says you are 18 or older. We receive only that answer, never your birthdate. We use it only for the age gate, and we keep only the date it confirmed you are an adult.

2.5 Information we do NOT collect

Recordings of your screen. Muse does not record your screen or your sessions.
Microphone or audio recordings (we do not request microphone access)
Video (we capture still photos only: event selfies and the photos you choose for your profile)
Contacts from your address book
Browsing history outside of Muse
Health or fitness data (Section 11)
Biometric identifiers. Our photo screening classifies image content; it does not identify faces.

2.6 Sensitive information and your control

Some profile fields are considered sensitive under certain privacy laws (ethnicity, religious or political beliefs, sexual orientation, precise location). Please note:

What is required: every profile needs a first name, birthdate, gender, at least three photos, top artists and genres, three prompts, and a bio. Those are always visible to people who can see your profile.
What is optional: ethnicity, religious beliefs, political beliefs, height, job, education, and college details are optional. You can use Muse without filling in any of them, and each has its own visibility toggle in Settings. A field you hide is never copied into the profile data other users can read.
How we use them: only to show the profile you built and to run the features you chose. We never use them to infer anything else about you, and never for advertising.
Edit anytime: you can update or remove optional fields at any time from Settings. Name and age cannot be changed after sign up (Section 6.1).

2.7 Event participation and photo walls

Muse hosts experiences at live music events. When you take part, we collect:

Check in: when you scan an event QR code, your device location is used for a moment to confirm you are at the venue (Section 2.2). We store only that you checked in, not your coordinates.
Event selfies, captions and songs: front camera photos you post to an event photo wall, with any optional caption and an optional song.
Wall interactions: likes and views on event photos.

Public by design: photos you post to an event wall are visible to other attendees viewing that wall, not only to your matches. You can delete a photo you posted at any time.

Automated screening: every photo is screened by an automated image classifier (Section 4.2) before it appears. The classifier looks for content that breaks our rules; it is not facial recognition and does not identify people. Photos that fail screening are never published.

Event photos are stored in Cloudflare R2 object storage (Section 4.2).

2.8 Anonymous event accounts (App Clip)

On iPhone, you can preview a live event and post to its photo wall through the Muse App Clip without creating a full account. When you do, we create an anonymous account so you can check in and post. Tied to it are your event selfies and captions, your check in, your wall interactions, and a device integrity attestation (Section 2.2). An anonymous account has no name, birthdate, or gender.

If you later install the full app on the same device, your anonymous account and its event activity carry over so you keep the same identity. If you never convert, we delete unclaimed anonymous accounts and their photos after a retention period (currently 31 days). See Section 5.3.

2.9 Websites, organizer portal, and campus ambassador dashboard

Our websites at museapp.co collect a small amount of information, separate from the app:

Business applications: if you apply through our website, we collect the organization name and business email you submit.
Job applications: if you apply for a role at museapp.co/careers, we collect your name, email, phone number, school, class year and expected graduation, where you live during the semester, your answers to the application questions, a link if you choose to give one, and your resume, together with the IP address and browser used to submit. We use them only to consider you for the role and to investigate abuse of the form, and we keep them for six months after we last updated your application, then delete them.
Organizer accounts: event organizers sign in with Google and give us organization details: name, type, contact email, website, Instagram handle, and a description, used to set up and run your events.
Campus ambassadors: ambassadors sign in with Google. We keep the Google email on file for you, the campus you represent, the results of your referral code, and the campaign notes you add. Ambassadors see aggregate signup counts for their campus, never individual students.
QR codes: when you scan a Muse QR code (a museapp.co/go link, or a campus contest flyer), we count the scan: which code, when, and for go links whether the phone is an iPhone, an Android phone, or something else, which we also use to send you to the right app store. We do not store your IP address, your browser details, or anything that identifies you with the scan.
IP addresses: we keep the IP address of website form submissions, together with the email submitted, for up to 48 hours for rate limiting and abuse prevention.
Cookies: the website sets sign in cookies to keep organizers, ambassadors, and administrators signed in, and, when you scan a Muse QR code, a cookie that lasts one hour and holds no identifier, so a second scan of the same code within the hour is not counted twice. It sets no analytics or advertising cookies and does no tracking across other sites.

Organizers and ambassadors can exercise the rights in Section 6 by contacting privacy@museapp.co.

2.10 Daily Ballot, Likes You, Music Feed and Live Mode, Super Stars, and referrals

Daily Ballot. The Daily Ballot is part of discovery. If your college has it turned on, your first name, age, photos, and the profile details you have set to visible may be shown as one of the day candidates to other verified students at your college, and those students may vote for you. Candidates are drawn automatically from active, college verified profiles at that college; there is no separate signup. Paused and banned accounts are never drawn. We record who voted for whom and use it only to count that ballot and show the result to your college. Results are shown by candidate, never by voter, so nobody learns who you voted for. We may send you a push when your campus ballot opens or when you are on it.
Likes You. When you like someone, they can see your first name, your verified badge, and a blurred version of your photo before they decide. Whoever is at the front of their line, and anyone who sent them a Super Star, is shown unblurred. They see your full profile when they open your card with a Peek, when you reach the front of their line, or when you match.
Music Feed and Live Mode. Songs you play inside Muse appear in the Recently Played section of your profile, which anyone who can view your profile can see (Section 4.1), and in the Music Feed of people you have liked. In Live Mode, people playing the same song at the same time can see that you are listening too.
Super Stars. A Super Star is a like that goes to the top of someone list and can carry a short note. The person you send it to sees your profile, the note, and that it was a Super Star.
Referrals. Your profile has a referral code. If someone enters it during signup we record that they were referred by you, and each of you gets a Super Star. Neither of you learns anything about the other beyond what the app already shows.

2.11 Campus contests and chapter competitions

Campus contests. When your college runs a contest, you earn entries from things you already do in Muse: finishing your profile and reaching the app, posting a campus wall selfie, and a friend you referred becoming verified. We record each entry as it happens. You can also enter by mail as the contest's official rules describe; for a mail in entry we keep the name and email written on it. After the contest closes we draw a winner at random, weighted by entries, and keep a record of the draw that lists each entrant's account identifier and number of entries, so the draw can be checked later. We tell the winner by email at their verified school address and with one push notification. Winners are never named publicly.
Chapter competitions. Chapters at a college, such as fraternities and sororities, can compete for the most signups through a chapter code. A chapter code is a referral code with no account behind it. If you enter one on the last screen of signup, we record which code you entered and you get one Super Star. Your signup counts for that chapter while you are a college verified student at that college with an active account, inside the competition's dates. Each competition has its own public page on museapp.co, which shows each chapter's name, code, and number of counted signups, never who signed up, and the numbers on it can be up to a minute old. Deleting your account removes your signup from the count.

3. How We Use Your Information

3.1 Core app functionality

Create and manage your account and verify your way in
Show your profile to other people through discovery, the Likes You list, the Daily Ballot, Music Feed, Live Mode, and event walls
Show you people who match the preferences you set (age, distance, gender, and optionally a genre)
Enable conversation between matched users
Run live event experiences, including check in and photo walls
Show Top Tracks of the Day based on what people at your college are playing in the app

3.2 Personalization

Apply the discovery filters you set
Show relevant content in your Music Feed
Remember your settings

3.3 Safety and security

Detect and prevent fraud, abuse, spam, and violations of our Terms of Service and Community Guidelines
Automatically screen everything you publish, before it appears, for content that breaks our rules: your bio, your prompts, your profile photos, your event and campus wall selfies and their captions, and the note on a like
Automatically screen messages between matches for harassment, scams, and attempts to exploit minors, both before a message is sent and in a periodic sweep afterwards, and use pattern detection (for example, spotting when contact or payment details are shared) as a safety signal. Screening is used only for safety and enforcement, never for advertising or profiling. By using Muse chat you consent to this screening. Muse chat is not end to end encrypted.
Review content that automated screening flagged, that another user reported, or that someone told us bothered them. Authorized Muse staff may read that content to decide whether it breaks our rules. We do not read your conversations otherwise
Verify device integrity (App Attest on iPhone, Play Integrity on Android) to spot bots and duplicate accounts
Process reports. Reporting someone also blocks them (Section 6.1)
Keep the platform secure

3.4 Communication

Send push notifications about matches, messages, likes, your campus ballot, and events. You can turn notifications on or off for Muse at any time in your phone's settings, and on Android by type (Section 6)
Send transactional email: one time codes, application decisions, and safety notices
Respond to your support requests and feedback
Send important service and policy updates

3.5 Analytics and improvement

Understand which features people use and where the app is confusing or broken
Test new features
Fix bugs

3.6 Legal and compliance

Comply with legal obligations and law enforcement requests
Enforce our Terms of Service and Community Guidelines
Protect our rights, property, and safety, and those of our users

4. How We Share Your Information

4.1 With other Muse users

Your profile is visible to other users so they can discover you, decide whether to like you, vote for you on your college Daily Ballot, and connect with you. The people who can view your profile are the people you appear to in discovery, people you have liked (through Likes You and Music Feed), verified students at your college during a ballot you are on, people in Live Mode playing the same song, and your matches. They can see:

Always visible: first name, age, photos, bio, prompts, music selections, and Recently Played
Approximate distance: for example "5 miles away". We never show your coordinates or address
Optional fields you turned on: ethnicity, religious beliefs, political beliefs, height, job, and education, each with its own toggle in Settings. Your college is shown alongside a verified badge, because the badge means you verified an email from that college
Event walls: photos you post to a live event wall are visible to other attendees viewing that event

Phone numbers, email addresses, and coordinates are never part of the profile data other users can read. Those columns do not exist in it at all.

4.2 Categories of third parties: service providers and data processors

We share information with service providers who help us run Muse. They may use it only to provide their service to us. Here is each one, what it receives, and why:

Supabase: backend infrastructure. Stores profiles, messages, matches, and app data in encrypted databases. Supabase Privacy Policy
Cloudflare: CDN, serverless workers, caching, and object storage. Processes API request metadata and stores your profile pictures and event selfies in Cloudflare R2. Cloudflare Privacy Policy
OpenAI: automated content screening. Content is sent to the OpenAI moderation service to be classified for material that breaks our rules (such as hate, harassment, threats, self harm, or sexual content involving minors). Every screened surface: your bio, your profile prompts, your profile photos, your event selfies, event captions, your campus wall selfies and their captions, the note you attach to a like, and your messages to a match, which are screened both before a message is sent and again in a periodic sweep afterwards. OpenAI receives the content and returns a classification. It does not receive your identity, your Spotify data, or the rest of your profile, and under the OpenAI API data usage policy content submitted through the API is not used to train its models. OpenAI Privacy Policy
OneSignal: push notification delivery. Receives your device push token and your Muse user id. It does not receive profile data or messages. OneSignal Privacy Policy
PostHog: product analytics. Receives usage events (screens opened, features used) linked to your Muse user id, together with a small set of segmentation properties: your college, your graduation year, your country, your gender, your trust tier, how you got into Muse, whether Spotify is connected, whether you have made a purchase, and whether the account is an app review account. It does not receive your name, your photos, your messages, or the GPS location Muse uses to work out distance, and it does not record your screen. Like any internet service, PostHog sees the IP address your device connects from, and estimates an approximate country, region, and city from it. We use that estimate to understand where Muse is being used. It is not precise, it is never shown to other users, and it is separate from the location you grant Muse for discovery. Not used for cross app tracking or advertising. PostHog Privacy Policy
RevenueCat: in app purchase management. Processes purchase records and transaction status for consumable purchases (Peeks, Spotlights, and Super Stars) linked to your user id. Does not receive profile data, messages, or your payment card details. RevenueCat Privacy Policy
Spotify: music integration. Muse receives playback state, and on iPhone OAuth access tokens, to enable music features. Muse does not store Spotify credentials, and Spotify does not receive your Muse data beyond the OAuth sign in. Spotify Privacy Policy
Apple: Sign in with Apple (an identity token and, if you share them, your name and email), Declared Age Range (Section 2.4), App Attest and DeviceCheck (device attestation), and the Apple Push Notification service (notification delivery). Apple Privacy Policy
Resend: transactional email delivery. Receives your email address and the message we send you, such as a one time verification code or an application decision. Resend Privacy Policy
Vercel: hosting for our web properties, including the organizer portal and the ambassador dashboard. Vercel Privacy Policy
Google: on Android, Sign in with Google (an identity token, your email and your Google account identifier), Google Play billing (through RevenueCat), the Play Integrity API (device attestation), Google Play Age Signals (Section 2.4), Google Play services location (your location, when you allow it), the Play install referrer (which event link, if any, brought you to the app), and Firebase Cloud Messaging (notification delivery, through OneSignal). On our websites, Google sign in for the organizer portal and the campus ambassador dashboard, and Google Fonts. Google Privacy Policy

4.3 Legal requirements

We may disclose your information if the law requires it or in response to a valid request from a public authority, such as a court order, a subpoena, or a law enforcement request. Where the law requires us to report content involving the exploitation of a minor, we do so, and we preserve the related records.

4.4 Business transfers

If Muse is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you by email or by a prominent notice in the app before your information is transferred and becomes subject to a different privacy policy.

4.5 What we do NOT do

We do not sell your personal information
We do not share your data with advertisers or data brokers
We do not use your data for advertising targeting, inside Muse or anywhere else
We do not share your Spotify playback data with anyone

5. Data Storage, Security, and Retention

5.1 Where your data is stored

Your data is stored in the United States in the Supabase cloud infrastructure, which encrypts data in transit (TLS) and at rest (AES 256), and in Cloudflare R2 for photos.

5.2 Security measures

Encryption: all traffic between your device and our servers uses TLS, and data at rest is encrypted with AES 256. Chat is not end to end encrypted, because messages are screened for safety (Section 3.3)
Authentication: signed tokens with secure storage
Access controls: database row level security, so users can only reach data they are entitled to. Fields you hide are never copied into the profile data other users can read
No passwords: you sign in with Apple or Google, and email verification uses one time codes, so there is no Muse password to steal
Token storage: sign in and OAuth tokens live in the iOS Keychain on iPhone, and in encrypted storage protected by the Android Keystore on Android
Security review: we review our access controls and our code for security issues on an ongoing basis
If a security incident affects your personal information, we will notify you, and any regulator the law requires, without unreasonable delay and within the deadlines the law sets

5.3 How long we keep it

We keep your information for as long as your account is active. When you delete your account (Settings, then Account, then Delete or Pause Account, then Delete account) we delete your profile, photos, matches, messages, and preferences. A few records survive deletion, for the reasons and periods below.

What	How long	Why
Profile, preferences, photos, music data, matches, messages	Life of your account, then deleted	To run Muse
Precise coordinates	Latest fix only, overwritten each time it refreshes, deleted with your account	Distance based discovery
Rate limit logs (IP address, email)	48 hours	Abuse prevention
Records of content that was blocked, and the blocked image itself in a private quarantine	1 year	Safety review
Content escalated for child safety, including the full text or image	Kept until one year after any report we are legally required to make, counted from the date of that report	Legal duty to preserve evidence
Reports about you or by you, including a copy of the reported conversation	Reports and the evidence attached to them are deleted one year after they are resolved, except reports that support an active ban, which we keep for as long as the ban lasts, and reports involving a minor, which we keep with the safety evidence	Enforcement
Ban records (email, phone if we had one, Apple or Google account identifier)	Life of the ban	So a banned person cannot sign up again
Records that you accepted our Terms and Privacy Policy	Kept after deletion	Proof of what you agreed to
Purchase records	7 years	Tax and accounting
Usage analytics events	13 months. The analytics profile tied to your user id is deleted with your account	Product improvement
Activity records (plays, app opens, swipes)	Up to 13 months, and passes older than 6 months are dropped sooner	Running the daily limits and the campus board
Anonymous App Clip accounts and selfies	31 days after the last selfie if never converted	Unclaimed accounts
Website applications and organizer records	Until the organizer relationship ends, or 24 months	Running the portal
Contest draw records (each entrant's account identifier and number of entries) and mail in entries (name, email)	Kept after the draw, including after account deletion	So a draw can be checked
Job applications (name, contact details, school, answers, resume)	6 months after we last updated the application, then deleted	Hiring
Backups	Up to 30 days after deletion, not accessible or used	Disaster recovery

What survives account deletion. Deleting your account does not erase our ban records, reports and the evidence attached to them, our content moderation records, contest draw records, or the record that you accepted these documents. We keep those for the periods above so that safety enforcement, legal preservation duties, and proof of agreement survive an account that does not. Everything else goes.

Email delivery logs at Resend and classification logs at OpenAI are kept under those providers own retention rules, which we cannot shorten.

6. Your Privacy Rights and Choices

6.1 Account information

Access and edit: view and update your profile any time in Settings
Correction: edit most profile information directly in the app. Name and birthdate are locked after signup; if either is wrong, email privacy@museapp.co from the address on your account and we will correct it after confirming it is you
Deletion: delete your account permanently from Settings, then Account, then Delete or Pause Account, then Delete account
Pause: pause your account from Settings to hide your profile from discovery, the Likes You list, and the Daily Ballot while keeping your matches
Report: report someone from your chat with them, or by swiping on the conversation in your inbox. Reporting also blocks: you are unmatched, your chat is removed, and you will not be shown to each other again

6.2 Location

Grant or revoke location permission in iOS Settings, then Muse, then Location, or on Android in Settings, then Apps, then Muse, then Permissions
We keep only your latest fix, never a history
Your exact coordinates are never shown to anyone

6.3 Spotify connection

Revoke Muse access to Spotify at spotify.com/account/apps
Revoking access removes music playback features but does not delete your Muse account

6.4 Communications

Manage push notifications in iOS Settings, then Muse, then Notifications, or on Android in Settings, then Apps, then Muse, then Notifications, where each type can be turned off on its own
Turn all notifications on or off at the system level

6.5 Your data rights

Wherever you live, you can ask us to:

Know and access: what personal information we hold about you and what we do with it
Get a copy: receive your data in a portable, machine readable format
Correct: fix information that is wrong or incomplete
Delete: delete your personal information, subject to the records in Section 5.3
Object or restrict: object to or ask us to limit certain processing

Email privacy@museapp.co from the address on your account. We may ask you to confirm it is you before we act, and we will respond within 45 days, or sooner where the law requires it. Appeals: if we decline your request, reply to that email and ask us to reconsider. We will review the decision and write back with the outcome, and if we still decline we will tell you how to contact your state Attorney General.

6.6 California privacy rights (CCPA and CPRA)

California residents have the right to know what personal information we collect, use, and disclose; to delete it; to correct it; to receive a copy of it; and not to be treated differently for exercising these rights. See Section 13.1 for the categories we collect and Section 6.5 for how to ask.

6.7 Canadian privacy rights (PIPEDA and Quebec Law 25)

If you are in Canada, you have the right to access and correct your personal information, to withdraw consent (subject to legal or contractual restrictions), and to data portability. You may file a complaint with the Office of the Privacy Commissioner of Canada or, if you are in Quebec, the Commission d'acces a l'information du Quebec. Our Privacy Officer (Section 12) is your point of contact.

6.8 Mexican privacy rights (LFPDPPP, ARCO)

If you are in Mexico, you may exercise your ARCO rights (access, rectification, cancellation, and opposition), revoke consent, and limit the use or disclosure of your data. This Privacy Policy serves as your privacy notice (aviso de privacidad). Contact our Privacy Officer at privacy@museapp.co.

7. Children's Privacy

Muse is for adults. We do not knowingly collect personal information from anyone under 18. We ask for your birthdate at signup and, on supported iPhones, ask Apple's Declared Age Range, and on Android where Google offers it, Google Play Age Signals, to confirm you are an adult; if either says you are under 18 you cannot continue. If we learn that someone under 18 has an account, we close it and delete the profile, keeping only the records in Section 5.3 that the law requires us to preserve and the record we need to stop the account coming back.

If you are a parent or guardian and believe your child has given us personal information, contact privacy@museapp.co.

8. International Data Transfers

Muse is offered in the United States, Canada, and Mexico. Your information is stored and processed in the United States, so if you use Muse from Canada or Mexico your information is transferred to and processed in the US, which may have different data protection laws than your country of residence. We protect it as described in this policy, using encrypted connections, service providers bound by contract, and contractual protections for international transfers.

9. Third Party Links and Services

Muse may link to third party websites or services (for example, Spotify). We are not responsible for their privacy practices, so please read their policies before giving them information. Your use of Spotify is governed by the Spotify Privacy Policy.

10. Analytics, Cookies, and Do Not Track

10.1 Analytics

We use PostHog (Section 4.2) to understand how people use Muse so we can improve features and fix bugs. It receives product events, such as which screens you open and which features you use, linked to your Muse user id, plus the segmentation properties listed in Section 4.2. It does not receive your name, your photos, your messages, or the GPS location Muse uses to work out distance, and Muse does not record your screen or your sessions. PostHog does estimate an approximate country, region, and city from the IP address your device connects from, which is how we see where Muse is being used. Most reporting is done in aggregate. Authorized Muse staff can also look at the activity of individual accounts (for example when one signed up, which onboarding steps it finished, how often it opens the app, and which features it used, but never who it liked, matched, or messaged, or what it said) to help that person, to look into a report or suspected abuse, and to find where people get stuck. Opening the full activity record of an account is logged. Analytics data is never used for advertising, cross app tracking, or shared with data brokers.

10.2 Cookies and local storage

The app uses local storage and device preferences (UserDefaults on iOS, DataStore and encrypted preferences on Android) to remember your settings, keep you signed in, and cache data for performance. Our websites set only sign in cookies and the one hour QR scan cookie (Section 2.9). We do not use cookies for tracking across sites or for advertising.

10.3 Do Not Track and Global Privacy Control

Our websites do not respond to browser Do Not Track signals, because they set no tracking cookies and there is nothing to turn off. We do not sell or share personal information, so a Global Privacy Control signal does not change how we treat your data. We treat both signals as a request not to be tracked, which is already how Muse works. No third party collects personal information about your activity across other sites or apps through Muse.

11. Consumer Health Data

Muse does not collect or infer health data. Please do not put health information in your profile, your prompts, or your messages. Location is used only for distance and event check in, and never to infer anything about your health or where you have been. If you are in Washington, Nevada, or Connecticut, this section is our consumer health data privacy notice, and the rights and contact details in Section 6 apply.

12. Changes to This Privacy Policy

We may update this policy as our practices, our technology, or the law change. When we do, we update the Last Updated date at the top, notify you in the app or by email for significant changes, and ask for your consent where the law requires it. Your continued use of Muse after a change takes effect means you accept it.

13. Contact Us

Questions, concerns, or requests about this policy or our data practices:

Privacy Officer: privacy@museapp.co
Support: support@museapp.co
Image removal requests: removal@museapp.co (see the removal process)
General inquiries: hello@museapp.co

Muse Labs Inc. has designated a Privacy Officer accountable for its handling of personal information (including for the purposes of Quebec Law 25 and the Mexican LFPDPPP). You can reach the Privacy Officer at the email above.

14. Additional Information for Specific Regions

14.1 California residents

Categories of personal information we collected in the preceding 12 months, where they come from, and how long we keep them:

Category	Examples	Source	Retention
Identifiers	first name, email, Apple or Google account identifier, Muse user id, device and install identifiers, IP address	You, your device, Apple, Google	Life of your account, then deleted, except the safety records in Section 5.3. IP logs 48 hours
Personal records	birthdate, purchase records	You, Apple or Google Play through RevenueCat	Life of your account. Purchase records 7 years
Protected classifications	age, gender, ethnicity, religious beliefs, political beliefs	You	Life of your account
Commercial information	Peeks, Spotlights, and Super Stars bought and used	Apple or Google Play through RevenueCat, the app	Life of your account. Records 7 years
Internet or network activity	screens viewed, features used	Your device	13 months
Precise geolocation	coordinates for distance based discovery	Your device	Latest fix only, deleted with your account. Event check in coordinates are not stored
Visual information	profile photos, event selfies	You	Life of your account
Professional or education information	college, class year, job, education	You, your college email domain	Life of your account
Inferences	none beyond the preferences you set	Not applicable	Not applicable
Sensitive personal information	precise geolocation, ethnicity, religious or political beliefs, sexual orientation (from who you say you are interested in), and the contents of your messages	You, your device	As above. Messages are deleted when either person unmatches or deletes their account, except a copy attached to a report

We use sensitive personal information only to provide the features you asked for (distance based discovery, the profile fields you chose to show, and messaging) and to keep the service safe. We do not use it to infer characteristics about you, so the right to limit its use does not apply. We disclose personal information only to the service providers in Section 4.2, for the business purposes in Section 3. We do not sell personal information and we do not share it for cross context behavioral advertising, and we have not done so in the preceding 12 months. We do not disclose personal information to third parties for their own direct marketing.

14.2 Residents of Connecticut, Texas, Virginia, Colorado, Oregon, and other states with consumer privacy laws

You may have the right to confirm whether we process your personal data, to access it, to correct it, to delete it, to get a copy of it, and to opt out of targeted advertising, the sale of personal data, or profiling that produces legal or similarly significant effects. We do none of those three. We process sensitive data (sexual orientation, ethnicity, religious or political beliefs, precise location) only with your consent, which you give when you choose to add those details or turn on location, and which you can withdraw at any time by removing the field or turning location off. We do not sell personal data, including sensitive data and precise geolocation. Email privacy@museapp.co and we will respond within 45 days. Section 6.5 explains how to appeal, and if we deny an appeal we will tell you how to contact your state Attorney General.

14.3 Nevada residents

Nevada residents may opt out of the sale of personal information. Muse does not sell personal information as defined by Nevada law. Questions: privacy@museapp.co.

14.4 Canadian residents

Accountability: Muse Labs Inc. is responsible for the personal information under its control and has designated a Privacy Officer (Section 12). We process your information to provide the Muse service (contract), with your consent (for example, location), and for our legitimate interests (safety, fraud prevention, and product improvement). You may access or correct your information, withdraw consent subject to legal or contractual limits, and lodge a complaint with the Office of the Privacy Commissioner of Canada or, in Quebec, the Commission d'acces a l'information. We retain data only as long as necessary for the purposes in this policy or as required by law.

14.5 Mexican residents

This Privacy Policy constitutes our privacy notice (aviso de privacidad) under the Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP). You may exercise your ARCO rights (access, rectification, cancellation, opposition), revoke your consent, and limit the use or disclosure of your data by contacting our Privacy Officer at privacy@museapp.co.