Privacy policy

1. Who we are and how to contact us

Muster is an AI-agent workspace built by Tharun Ramagiri at Orazen. This policy explains how Muster handles information on the hosted service at https://muster.today (also reachable at https://muster.orazen.online) and in the Muster desktop app. For privacy questions, access requests or deletion requests, contact ramagiritharun@gmail.com.

If you connect to a Muster server that someone else runs, that server's operator manages the data stored there. Contact that operator about its retention, hosting and security practices.

2. Information we collect

• Account information. Your account stores your name, email address, sign-in records and sessions (including the device's browser description and network address for each signed-in session). You sign in with Google or with a one-time code emailed to you; Muster does not ask for a password. Accounts created before passwords were retired may still hold a stored password record that no sign-in route reads.
• Google sign-in. Signing in with Google requests only basic profile access (openid, email, profile): your Google account identifier, email address, name and profile picture. Sign-in never requests access to Drive, Calendar or Gmail; those are separate permissions you grant later, if at all.
• Workspace content. We process the teammates you configure, tasks, conversations, uploaded files, notes, memories and settings you provide. The Muster server stores these records and may keep model request and response logs.
• AI provider keys. Muster runs on AI provider keys you bring (for example OpenAI or Anthropic). Keys you save on the hosted service are stored encrypted for your account and are never shown back to you or other users.
• Google Drive data. If you connect Google Drive for backup, Muster requests the drive.file permission and keeps backups in a visible Muster folder in your Drive. With that permission Muster can only see and change files and folders it created or that you open with it, not the rest of your Drive. Earlier backups used the drive.appdata permission, a private app-data folder hidden from the Drive interface. Separately configured integrations can read other Drive files if you provide credentials with those permissions.
• Google Calendar data. If you connect Google Calendar, Muster requests read-only access (calendar.readonly) and reads your events when you or a teammate you asked plans your day or week. Muster does not create, change or delete calendar events.
• Connected apps. Optional app connections (such as Gmail) go through a connection service and only after you review and approve the permissions on that service's page.
• Product analytics. The web and desktop apps send a small set of named product events (for example "app opened", "teammate created", "onboarding completed") to PostHog, our analytics provider. When you enter your email during setup it is used to link those events to you. Message text, conversation content and clicked-element text are not sent. You can turn analytics off in Settings → General → Analytics.
• Technical data. Server request and diagnostic logs and connection information help operate and troubleshoot the Service. Authentication uses session cookies; local application storage keeps preferences and drafts.
• Public beta waitlist. If you join the waitlist for a Muster app, we store your email address, the platforms you chose and when you joined or updated your choice, and send one confirmation email. We use the address only to tell you when your platform is ready.
• Feedback, bug reports and votes. If you post a feature request or bug report while signed in, we store its title and text, the account that posted it and when it was posted. Public requests show the nickname you choose in the feedback board, or "Muster user" if you have not chosen one, never your account name or email address. Bug reports can also include the page you were on and the app version. If you vote on a request, we store which account voted on which request and when.
• Status checks and abuse limits. The public status page stores the results of the server's own health checks; these contain no information about you. To limit abuse, we count recent requests to the waitlist (by network address) and to feedback and voting (by account). These counters are stored as one-way hashes, not as the raw address or account identifier.
• Billing information. Where you purchase a paid service, payment providers process payment details. Muster may receive customer, subscription and transaction identifiers and payment status, rather than your full card number.

3. How we use information

• Authenticate you and maintain your account and sessions.
• Run the tasks and integrations you request, generate teammate responses and show your workspace history.
• Back up and restore your workspace when you use those features, and read your calendar when you ask for planning help.
• Send sign-in codes and service email, including the waitlist confirmation and the notice that your platform is ready.
• Collect and prioritise feedback and bug reports, and show public feature requests and their vote counts.
• Understand which features are used (product analytics, unless you turn it off).
• Operate, troubleshoot and secure the Service, manage billing where applicable, and respond to requests.

We do not sell personal information or Google user data. We do not use Google user data for advertising or to train generalized AI or machine-learning models. The AI provider you choose receives task content, as described below.

4. Google user data and Limited Use

Muster's use and transfer to any other app of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements.

• Permissions and purpose. Google sign-in uses basic profile access to identify your account. Drive access (drive.file, and drive.appdata for earlier backups) is used only to save, list and restore your Muster backups. Calendar access (calendar.readonly) is used only to show and plan around your schedule when you ask. Each is requested separately, when you turn on that feature.
• Scope of access. With drive.file, Muster cannot see Drive files it did not create or that you did not open with it. This restriction does not apply to other Drive integrations that you separately configure with broader permissions.
• Sharing. Google data is used for the user-facing features you authorize, not advertising, sale to data brokers or generalized model training. Calendar details are shared with your chosen AI provider only as part of a planning request you make. Transfers are otherwise limited to providing those features, permitted security purposes, legal obligations or other transfers allowed by Google's Limited Use requirements. Human access to Google data is limited to the circumstances permitted by that policy, such as your affirmative consent to review specific data or a security investigation.
• Revoking access. You can remove Muster's authorization in your Google account connections. Revocation prevents further authorized access; it does not automatically erase credentials or copies already stored by Muster. Disconnecting Drive in Muster's settings deletes Muster's stored Drive tokens for your account; deleting your account (section 7) deletes all stored Google tokens. Neither removes backups already in your Drive — manage those in Drive.

5. AI model providers

Prompts and relevant context pass through the Muster server and are sent to the AI provider whose key you configured. That provider processes the content under its own terms and privacy policy, and bills you for usage. Review those policies before including sensitive information in a task. Connected tools may also send data to services you authorize.

In the desktop app, a local model runs on the machine hosting its endpoint. Using a local model does not prevent logging or transfers through other enabled integrations.

6. Sharing and service providers

We use service providers to run Muster: our hosting infrastructure, Resend to deliver sign-in and service email, PostHog for product analytics, the AI and integration providers you select, and payment providers when you buy a paid service. We disclose data as necessary to provide the requested functions, protect the Service or comply with applicable law. Processing may take place outside your country, including in the United States.

Feature requests are public: anyone can read their title and text and see the display name of the person who posted them, but not that person's email address. Bug reports, including the page and app version, are visible only to the Muster team. Waitlist email addresses are visible only to the Muster team and to Resend, which sends the email.

7. Retention and deletion

Your account and workspace are kept until you delete them. You can delete your hosted account yourself in Settings → General → Delete account. Deletion immediately removes your teammates, rooms, conversations, memory files, saved AI provider keys and custom providers, your stored Google tokens and permissions, and your account record, and signs out every device. Server diagnostic logs that may mention your account are not part of that removal; ask us if you want them reviewed. Signing out alone does not erase anything.

If you cannot use Settings, or want anything else removed, contact ramagiritharun@gmail.com. We may need to verify account ownership. Any legally required retention is handled separately. Backups in your Google Drive are your own copies; deleting your Muster account does not remove them. Delete them in Google Drive.

Public beta data is kept separately from your workspace. Status check results are deleted after 7 days. Abuse-limit counters are deleted after 24 hours without activity. A waitlist entry is removed once we have told you your platform is ready, or after 12 months, whichever comes first; you can remove it at any time with the link in your confirmation email. Deleting your account in Settings deletes your votes, your bug reports and your feedback nickname, and keeps your public feature requests anonymised as "Muster user" so the board stays readable; to have those removed too, contact ramagiritharun@gmail.com. The Muster team may also hide or merge posts.

For the desktop app, your data lives on your computer; uninstalling the app and deleting its data folder removes it.

8. Security

The public Muster websites use HTTPS. Muster encrypts workspace backup bundles and hosted per-user AI provider keys. Other application records are stored in files and databases without uniform application-level encryption. Session and OAuth tokens are not uniformly hashed or encrypted in storage. No system can guarantee absolute security.

9. Children

Muster is not intended for children under 16. Contact us if you believe a child has provided personal information so that we can investigate and address removal.

10. Your rights and choices

Depending on your jurisdiction, you may have rights to access, correct, erase or restrict processing of personal data, obtain a portable copy, object to processing, withdraw consent, or complain to a data-protection authority. Send requests to ramagiritharun@gmail.com. Applicable legal requirements govern how requests are handled.

In Settings you can change your name, turn product analytics off, see and sign out your signed-in devices, disconnect Google Drive and delete your account. Workspace export is a partial backup of supported workspace records, not a complete personal-data export; ask us for anything else.

11. The MusterMobile iPhone app

MusterMobile is the iPhone companion for Muster. It has no advertising, no analytics or tracking SDKs, and it does not use your data to track you across other companies' apps or websites.

• Muster account (optional). If you sign in, Google sign-in runs in a browser sheet on https://muster.today. The hosted service then holds the account information described in section 2 (your name, email address, account identifier and Google profile details, and a session record with the device description and network address), and the app shows your account email in Settings. The app keeps its session cookie in this iPhone's Keychain, on this device only. Signing out on the iPhone ends that session.
• Your paired computer. Messages you send, approvals you answer, transcripts, search, exports and screen previews travel between the iPhone and the computer you paired, over your network or your own Tailscale network. They are not sent to muster.today, and we do not receive a copy. The Muster installation on that computer stores your conversations and sends task content to the AI providers you configured there. The app keeps the computer's address in iOS preferences and its pairing token in the iPhone's Keychain.
• Cloud desktop (optional). If your computer is set up with a cloud box, opening its live desktop asks your computer for a short-lived viewer link and shows that provider's page in the app. That provider processes the session under its own terms.
• Ask Muster history. If you connect Google Drive from the iPhone, Muster requests the drive.file permission described in section 4. Assistant history is kept as encrypted files in the Muster folder of your Drive. The iPhone downloads those encrypted files through muster.today and decrypts them on the phone with a key derived from your recovery code; muster.today does not receive the recovery code or that key. If you choose to remember the key, it is saved in this iPhone's Keychain.
• Demo. "Try a demo" shows sample teammates bundled with the app. Nothing is sent or saved.
• Notifications. Alerts are created on the iPhone from what your paired computer sends while the app is connected. The app does not use a push-notification service.
• Removing data. Unpair the phone in Settings to remove its pairing from the iPhone, and remove the device in the computer's Companion settings to revoke it there. Sign out to remove the account session from the iPhone. Your hosted account and its data are deleted as described in section 7.

12. Changes to this policy

Updates will appear on this page with a revised date. Where required by law, material changes will be accompanied by additional notice or a request for consent. This policy does not limit your statutory privacy rights.