Privacy policy
Muse Privacy is built so that the records it works on stay on hardware you own. This page says exactly what goes where.
Last updated November 3, 2026. Muse Privacy is made by Offline Base.
On your device
Your documents, the text read from scans, the names and identifiers found in them, the tag map that links tags to real values, the finished files, your share and keep decisions and the router's learned rules are stored on your device, in a folder only your user account can read. In the reviewed configuration every model runs on the device too. We, Offline Base, cannot see any of it.
The device deletes decisions, finished jobs, scan text and unknown-name tag entries after 90 days. Results waiting for your OK stay until you answer.
What Muse receives
When Muse calls a tool, the device sends back only text with names and identifiers replaced by tags such as [Student A], or a summary, and only after its privacy checks and your rules allow it. Some results wait for you to tap Share it or Keep it here on the device. Anything sent to Muse is then held under Meta's terms and privacy policy, not ours, and deleting it on the device does not delete Meta's copy.
What Muse sends us, and what we do with it
Muse's requests (search queries, questions, task instructions and the files it asks the device to save) are processed on your device only to answer that request. They are kept on the device with your decisions for up to 90 days so you can review them and so the device's nightly "dreaming" job can relearn your share and keep rules. That job runs on the device and writes plain rules; in the reviewed configuration it trains no model and sends nothing anywhere.
We do not sell this data, use it for advertising, build profiles, infer sensitive characteristics from it, or use it to train models.
The relay
Muse reaches your device through our relay, which runs on Modal. It passes each request and answer through without storing or logging their content. It keeps only: device ids, a hash of each device secret, OAuth clients, grants and hashed tokens, including whether a link is read only; hashed pairing codes; and hashed IP addresses in counters that reset every 10 minutes. Modal keeps the relay's service logs, which never include request or answer content.
Traffic between Muse, the relay and your device is encrypted in transit (HTTPS and WSS).
Sharing
We share nothing with anyone. Modal hosts the relay as our processor. Muse is operated by Meta.
Your choices
- Link Muse as Read only, so it can list, search and ask but not start tasks or save files.
- Revoke every Muse link with
relay_client unlinkon the device. The relay then deletes those grants. - Delete any decision on the device's approval page, or delete the app's folder to remove everything.
- To have the relay forget your device, email us your device id.
Children
Muse Privacy is used by adults, such as teachers. Student records stay on the device; with the COPPA or GDPR settings on, it deletes more and sooner, as the app's retention settings list.
Security incidents
If an incident affects user data we will tell affected users and Meta within 48 hours. Report a vulnerability privately to team@offlinebase.com.
Contact
team@offlinebase.com. Changes to this policy are posted on this page with a new date.