Privacy Policy

This Privacy Policy explains what information Muse collects, how it is used, and the security principles that Muse is built on. It is written to be honest and readable — not buried in legal language.

Muse is operated by Faiz Khan, based in Georgia, United States. If you have any questions, you can reach me directly at faiz@usemuse.dev.

The Core Privacy Principle

Muse is built to hold as little of your data as possible, and to protect what it must hold. Two rules define how it works.

Your code and data are never stored. When a task runs — reading a file, listing database rows, checking a deployment — the result passes through Muse to your phone and is not kept afterward. Muse records that a task ran, never the contents it touched.

Your connection credentials are encrypted at rest. When you connect GitHub, Supabase, or Vercel, those tokens are encrypted with AES-256-GCM before they are stored, and decrypted only in memory, for the moment it takes to run a task you started or a scheduled health check. They are never returned to your browser, and every connection can be revoked instantly from Settings — which cuts off access right away.

There is nothing to install. Muse acts on your projects by calling the official APIs of the services you connect — GitHub, Supabase, Vercel — with the scoped permissions you granted, and relays the result back to you.

Phase 1 — Waitlist (Current)

During the current waitlist phase, Muse collects only:

• Email address — submitted voluntarily through the waitlist form on usemuse.dev, stored securely in a Supabase database, used only to notify you when Muse launches and to send occasional product updates, never sold, rented, or shared with third parties for marketing purposes. You can request removal at any time by emailing faiz@usemuse.dev.
• Analytics via Google Search Console — used for domain verification and search performance monitoring. This tracks aggregate search impressions and clicks related to usemuse.dev. No personal browsing data or individual user tracking is collected through this.

That is everything collected during the waitlist phase. Nothing else.

Phase 2 — Full Product (Post-Launch Outline)

When Muse launches, additional data will be collected to operate the service. This section is an honest outline of what that looks like so there are no surprises.

Account data

• Email address and authentication credentials (managed via Supabase Auth)
• Account creation timestamp

Workspace and connection metadata

• Names of workspaces you create
• Which integration types you have connected (e.g. "GitHub connected", "Supabase connected"), along with the credentials needed to run your tasks — stored encrypted at rest (see "The Core Privacy Principle" above)
• Guardian monitoring records: the issues Muse detects in your connected projects (e.g. "RLS disabled on a table"), when they were first seen, and when they were resolved or dismissed

Task records

• A log of tasks dispatched through Muse: which skill was used, which action was taken, when it ran, and whether it succeeded or failed
• Task parameters may include references like repository names, table names, or file paths — but never raw credential values
• Task logs are used to display your history in the app and to diagnose issues

What is never stored on Muse servers

• The content of your database rows (beyond what is needed to display a result back to you during an active session — it is not persisted afterward)
• File contents from your repositories
• Anything from the services you connect beyond what a task result needs to be shown to you

Connection credentials (API keys and tokens) are the one sensitive thing Muse does store, because the backend needs them to act on your projects when you ask it to. They are encrypted at rest and never returned to your browser, as described above.

How Your Data Is Protected

In transit: All communication — between your browser and the Muse backend, and between Muse and the services you connect — uses encrypted HTTPS connections.

At rest: Waitlist emails and account data are stored in Supabase, which encrypts data at rest. Task records are scoped by workspace with row-level security enforced at the database level — meaning your data is only accessible to you.

Credentials: Your integration credentials are encrypted with AES-256-GCM before being stored, using a key held only by the Muse backend. They are decrypted in memory only to execute a task you initiated or a scheduled health check, and are never returned to your browser. Disconnecting an integration in Settings deletes its stored credentials, and you can additionally revoke Muse's access from the provider's side (GitHub, Supabase, or Vercel) at any time.

Third-Party Services

Muse uses the following third-party infrastructure:

Each of these services has its own privacy policy. Muse does not control their data practices and encourages you to review them independently.

Data Retention

• Waitlist emails: Retained until you request removal or Muse shuts down.
• Account data (post-launch): Retained for the life of your account. You can request full deletion at any time by contacting faiz@usemuse.dev. Deletion will be processed within 30 days.
• Task logs (post-launch): Retained for 90 days by default, then automatically purged.

Your Rights

Regardless of where you are located, you have the right to:

• Know what data Muse holds about you
• Request a copy of your data
• Request correction of inaccurate data
• Request deletion of your data
• Withdraw consent for email communications at any time

To exercise any of these rights, email faiz@usemuse.dev. I will respond within 14 days.

Children's Privacy

Muse is not directed at children under the age of 13. I do not knowingly collect personal information from children under 13. If you believe a child has submitted their information, please contact me and I will remove it promptly.

Changes to This Policy

If this Privacy Policy changes materially, waitlist members and active users will be notified by email before the changes take effect. The "Last Updated" date at the top of this page will always reflect the most recent revision.

Contact

Privacy questions, data requests, or concerns:

Faiz Khan
faiz@usemuse.dev
usemuse.dev

I read every email and will respond personally.