Privacy

Your data stays on your Mac.

Last updated: 29 July 2026

Muse is built so that we cannot see what you collect. It runs entirely on your Mac, with no account and no servers involved. The browser extension only ever communicates with Muse on the same Mac. This policy sets out exactly what Muse touches, where its few network requests go, and your rights under the UK GDPR.

The short version

Anonymous, minimal analytics
Muse records a small number of anonymous events, like app launches and trial-to-purchase conversion. It never tells us what you save or what's in your library.
No account, no cloud
No sign-up, no login. Your library lives only on your Mac.
Extension stays local
It sends what you choose to save only to the Muse app on your own machine, over a loopback address (127.0.0.1) that never reaches the internet.
Nothing read without you
The extension only packages the page, image or link you choose to save. It never reads your browsing history, passwords or messages, and never sends anything online.
All AI is on-device
Auto-tagging, text-in-image search and colour search run entirely on your Mac. Nothing you save is ever sent to any AI service.
Optional link previews
If you turn them on, Muse asks each saved page for its preview image. Those sites see your IP address, but we never do.
No cookies
The website uses Umami, a cookieless, privacy-first analytics tool that can't identify you (details below).

Who is the data controller?

The data controller for any personal data we hold about you is:

Entity
TJH/CO LIMITED (trading as THEODORE HQ)
Registered
A company registered in England and Wales. Company number 16589593.
Office
Fairway House, Links Business, Fortran Rd, St. Mellons, Cardiff, CF3 0LT, United Kingdom.
Email
support@theodorehq.com

Given the small scale and low-risk nature of our processing, we are not required to appoint a Data Protection Officer and have not done so. For any data question, contact us at the email above.

What does Muse store on your Mac?

Everything you collect stays on your Mac. Your items - images, bookmarks, video, files and notes - are kept as real files in a visible "Muse Library" folder, alongside a local database that holds their details: titles, sources, the collections and tags you organise them into, and the tags and text that Muse's on-device intelligence generates for search. It also keeps your settings, and your licence key and activation ID (stored in the macOS Keychain, encrypted by the operating system). None of this is ever transmitted off the device.

Does Muse use AI?

Yes, and all of it runs on your Mac. The built-in intelligence - automatic tagging, text-in-image search and colour search - runs on-device. The optional Pro AI pack, which adds semantic visual search and image descriptions, is a one-time download of model files that also run entirely on-device. Nothing you save is ever sent to any AI service, any cloud, or us.

The browser extension, and what it sends

The companion clipper extension is optional. It does nothing unless the Muse app is installed and running on the same Mac, and it collects nothing until you act. When you save something - with a right click or the in-page clipper - it packages only the item you chose:

The thing you picked
The image, link, selection or page you chose to save.
Where it came from
The page's title and URL, so Muse can record the source and take you back to it later.

The extension does not read your browsing history, passwords, form contents, messages, keystrokes, or anything on pages you have not chosen to save from, and it never sends anything online.

Why a small script runs on pages

The extension includes a content script that runs on web pages for one purpose: to draw the in-page clipper when you invoke it, and to package the item you selected. It acts only when you use it. It does not read or transmit page content on its own.

Where the extension sends data

Only to your own Mac. The extension hands what you chose to save to the Muse app's local server at http://127.0.0.1:17894, a loopback address reachable only from your computer that never travels over the internet. That loopback address is the only host the extension is permitted to talk to. We run no remote servers that collect this data. Nothing is uploaded, shared, sold or transferred to us or any third party. Muse contains no advertising and no third-party analytics or tracking SDKs.

Permissions the extension requests, and why

Context menus
To add the right-click "Save to Muse" option in your browser.
Scripting
To show the in-page clipper and package the item you selected when you invoke it.
Storage
To remember the extension's own small settings in your browser.
Local connection
127.0.0.1: the only network destination, the Muse app on your own Mac.

Does Muse make any network requests?

Yes, four kinds, and none of them carries anything about your library.

Update checks
About once an hour Muse checks https://www.theodorehq.com/muse/appcast.xml for a new version. The request contains your current Muse version and your macOS version, so we can serve the right update. It carries no unique identifier and is verified by Apple's Sparkle framework. You can turn update checks off at any time.
Licence checks
Muse talks to Polar.sh, our licensing provider, in three situations: once when you activate your licence, periodically to revalidate it, and if you deactivate it to move Muse to another Mac. Each call sends only your licence key and a device label (your Mac's local name, for example "Theodore's MacBook Pro"). After activation Muse caches the result and keeps working offline.
Optional Pro AI pack
If you choose to install the Pro AI pack, Muse downloads the model files. The download is something you trigger yourself, and it carries nothing about you or your library.
Anonymous usage analytics
Muse records a small number of anonymous events (such as app launches and whether a trial converts to a purchase) using a self-hosted analytics server that we run ourselves on our own infrastructure. This data contains no personal information and no identifier that can be traced back to you or your library, and it is never shared with any third party. It exists only so we can understand how many people use Muse.
Site icons
Muse fetches each bookmarked site's favicon once per domain so your bookmarks are recognisable, and stores it in your library. The site sees only a request for its icon.
Link previews (optional)
Off unless you switch it on in the ••• menu. Then, for the bookmark cards on screen as you scroll, Muse asks that page for the picture it publishes about itself and stores it in your library. Those sites see your IP address, exactly as if you had opened the page yourself. Nothing is ever sent to us, and nothing is fetched while the setting is off.

What personal data do we hold, and on what basis?

Three categories. The law requires us to name a lawful basis under Article 6 of the UK GDPR for each.

Purchase email
& licence record
Held so we can deliver and verify your licence. We receive your email from Polar.sh, the Merchant of Record that processes your purchase.Lawful basis: contractual necessity (Art 6(1)(b))
Newsletter
subscription
The same email, used to send occasional product updates about Muse. You opt in at checkout via an unticked box (never pre-ticked), and every email has a one-click unsubscribe.Lawful basis: consent (Art 6(1)(a) UK GDPR), by ticking the opt-in box at checkout
Licence-activation
logs
Timestamp, country and the IP address of the activation request, kept to detect fraud and licence abuse.Lawful basis: legitimate interests (Art 6(1)(f))

How long do we keep it?

Purchase email
& licence record
While your licence is active, plus seven years after your last purchase, to meet HMRC tax-record requirements (Schedule 11 of the VAT Act 1994 and corresponding income-tax rules).
Newsletter subscription
Until you unsubscribe, plus thirty days while we process the unsubscribe.
Licence-activation logs
Twelve months from activation, then automatically deleted by Polar.
Support emails
Two years, then deleted, unless you ask us to keep them for an open issue.

Storage and your control

Your library lives on your Mac, under your control. You can remove individual items or collections from within the app, and you can export your whole library at any time - it is yours, and your files are never held hostage, even if your trial ends or you stop using Muse. Removing Muse removes its stored data. The extension keeps no lasting record of its own; uninstalling it stops all clipping immediately.

Crash reports

Muse does not send crash reports or diagnostics automatically. Nothing about a crash leaves your Mac unless you choose to send it. If macOS itself shows a "Send to Apple" dialog, that is Apple's standard system, not us, and you control it in System Settings > Privacy & Security > Analytics & Improvements.

Cookies and this website

No cookies, no third-party trackers, no advertising scripts, no fingerprinting. Our web fonts are self-hosted (served from this site), so loading a page makes no third-party requests. Website analytics is handled by Umami (see the next section), which is cookieless.

We do save one small item in your browser's local storage: a first-touch attribution record, made up of the page you first landed on, the site that referred you, any campaign tags in the link you arrived through, and a first-visit timestamp. We use it only to understand which links lead to purchases if you later buy Muse. It is not a cookie, it stays in your own browser, it is never shared with anyone else, and it is not used to track you across other websites. Lawful basis: our legitimate interests (Art 6(1)(f) UK GDPR) in understanding how people find Muse. You can remove it at any time by clearing this site's data in your browser, or by using any standard content blocker.

Website analytics (Umami)

To understand which pages people find useful, this website uses Umami, a privacy-friendly analytics tool we self-host on our own server at analytics.theodorehq.com. (Muse the app contains no analytics of any kind; this is the website only.)

Umami records aggregate, non-identifying information: the page URL, page title and referrer, the country your visit came from (derived from your IP address, which is then immediately discarded and never stored), and your browser, operating system, device type and screen size. It sets no cookies, does not fingerprint your device, does not follow you across other websites, and shares nothing with any third party. We cannot identify you from it.

Lawful basis: under PECR (as amended by the Data (Use and Access) Act 2025), this aggregate, cookieless analytics falls within the "statistical purposes" exception, which requires us to tell you about it and to give you a simple, free way to opt out (both done here). The brief processing of your IP address to derive a country relies on our legitimate interests (Art 6(1)(f) UK GDPR) in understanding aggregate traffic without identifying you. Retention: aggregate figures indefinitely; raw event records for twelve months.

How to opt out. Use the button below and we will save a small flag that tells Umami to ignore this browser on this site permanently. Any standard content blocker (uBlock Origin, Ghostery, Brave's shields) also blocks it automatically.

Who handles your data, and international transfers

We keep suppliers to a minimum. Where one is based outside the UK, an approved UK transfer safeguard is in place:

Polar.sh
United States
The Merchant of Record and seller of record for your purchase. For the data it collects at its own checkout (your email, country, and payment and tax details) Polar acts as a separate, independent controller under its own terms; for anything it handles purely on our behalf it acts as our processor. Polar uses Stripe as its payment processor, and we never receive your card details. See Polar's data-processing agreement and privacy policy.
Vercel
United States
Hosts this website. Vercel is certified under the UK Extension to the EU-US Data Privacy Framework, and its data-processing agreement also incorporates the UK International Data Transfer Agreement.
Apple iCloud
Runs our support@theodorehq.com mailbox. For UK and EU users this is controlled by Apple Distribution International Limited in Ireland (within the EEA), with Standard Contractual Clauses for any onward transfer.
Website analytics
Self-hosted on a server we control (Umami), so your analytics data is never shared with a third-party analytics company.

You can ask us for more detail on any of these safeguards at support@theodorehq.com.

Your rights under UK GDPR

Access
Ask for a copy of the data we hold (Art 15).
Rectification
Correct anything inaccurate (Art 16).
Erasure
Ask us to delete your data, subject to the HMRC retention above (Art 17).
Restriction
Pause our processing while a dispute is resolved (Art 18).
Portability
Receive your data in a structured, common format (Art 20).
Object
Object to processing based on legitimate interests, including marketing (Art 21).
Withdraw consent
Unsubscribe from the newsletter at any time (Art 7(3)).
No automated decisions
We make no automated decisions about you (Art 22).

To exercise any of these, email support@theodorehq.com. We respond within thirty days, free of charge.

Complaints

If you are unhappy with how we have handled your personal data, you have the right to complain to us directly (a right under section 164A of the Data Protection Act 2018). The easiest way is to email support@theodorehq.com. We will acknowledge your complaint within 30 days, investigate it, and tell you the outcome.

You also have the right to complain to the UK Information Commissioner's Office (ICO): Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. Helpline: 0303 123 1113. ico.org.uk/make-a-complaint. You can contact the ICO at any time, though we would appreciate the chance to resolve things for you first.

Chrome Web Store Limited Use

Muse's use of information received from Google APIs and the Chrome Web Store adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements. The extension uses the information it handles only to provide Muse's save-to-library feature on your own device; it does not transfer that information to any server, use it for advertising, or sell it.

Children

Muse is a general-purpose productivity tool and is not directed at children under 13 (the UK age of digital consent under section 9 of the Data Protection Act 2018). We do not knowingly collect any personal data from anyone under 13. If you believe we hold such data in error, email us and we will delete it promptly.

Changes to this policy

If we change this policy we will update the date at the top, and email anyone on the customer list a plain-English summary of what changed at least fourteen days before it takes effect. We will not start collecting more from existing users.

Contact

For any questions or concerns, email support@theodorehq.com. Every message is read by a person on our team.

See also our Terms of Service.