The short version
Who is the data controller?
The data controller for any personal data we hold about you is:
Given the small scale and low-risk nature of our processing, we are not required to appoint a Data Protection Officer and have not done so. For any data question, contact us at the email above.
What does Muse store on your Mac?
Everything you collect stays on your Mac, unless you turn on iCloud sync. Your items - images, bookmarks, video, files and notes - are kept as real files in a visible "Muse Library" folder, alongside a local database that holds their details: titles, sources, the collections and tags you organise them into, and the tags and text that Muse's on-device intelligence generates for search. It also keeps your settings, and your licence key and activation ID (stored in the macOS Keychain, encrypted by the operating system). Muse never sends your library to us. Beyond the few requests listed under "Does Muse make any network requests?" below, nothing leaves your Mac unless you choose one of the optional features described here: iCloud sync, Muse Vision, the Claude features, or connecting an AI app to your library.
If you choose folders under Watched Folders, in Muse's Settings > Collect + Find, Muse reads only those folders, to copy new files that land in them into your Inbox. It never moves or changes the files in them.
What happens if I turn on iCloud sync?
Sync With iCloud, in Muse's Settings > Sync, is off until you turn it on. When it is on, Muse keeps a copy of your library in the private iCloud storage that belongs to your Apple Account, so your iPhone and your other Macs stay up to date from it: your items with their titles, notes, tags and collections, and the text Muse found in your pictures. Pictures go as smaller copies unless you also turn on Full-Size Pictures. Apple holds that copy under your iCloud account and Apple's privacy policy. We have no access to it, and it uses your own iCloud storage. To remove it, choose Delete the iCloud Copy from the Sync Now menu in Settings > Sync; your library on your Mac stays as it is. The words Muse reads from pages after the first of your PDFs stay in your library on your Mac and are not part of what syncs.
Does Muse use AI?
The AI that Muse ships with runs on your Mac. The built-in intelligence - automatic tagging, text-in-image search, reading the words inside your PDFs and colour search - runs on-device. The optional Pro AI pack, which adds semantic visual search and image descriptions, is a one-time download of model files that also run entirely on-device. None of that sends anything you save to us or to anyone else.
Two optional features are different: they send some of what you have saved off your Mac. Both are off until you choose to use them, and neither is needed to use Muse.
- Muse Vision finds visually similar images from around the web. When you use it on an item, that image is sent to Pinterest's visual search so it can be matched (see Pinterest's privacy policy). Muse never signs you in to Pinterest, so a search is not linked to any Pinterest account: Pinterest receives the image and your internet address, and nothing else. If you never use Muse Vision, no image is ever sent.
- The Claude features (AI art prompts, richer tagging and full-sentence search) only work if you add your own Anthropic API key in Settings. When they run, the relevant item or query is sent to Anthropic's API under your own account and billing, not ours. Once you add a key, each new picture you save is sent to Anthropic to be tagged, and longer searches are sent to be read as a sentence; each has its own switch in Settings. Without a key they stay off, and search falls back to the ordinary on-device query.
AI apps and scripts on your Mac
Muse can let AI apps and your own scripts on this Mac use your library, through its MCP Server and Local API. Both are off until you turn them on in Settings > Intelligence, and only apps running on your own Mac can connect, never the internet, other devices or web pages. Muse sends nothing anywhere itself. An AI app you connect, such as Claude, can read whatever it asks Muse for and may send that to its own servers as part of your conversation, under that app's privacy policy, not ours. Items you've hidden are never shared. Before the first change an AI app or script makes each day, Muse keeps a copy of your library's database on your Mac, keeping the last seven.
The browser extension, and what it sends
The companion clipper extension is optional. It does nothing unless the Muse app is installed and running on the same Mac, and it collects nothing until you act. When you save something - with a right click or the in-page clipper - it packages only the item you chose:
The extension does not read your browsing history, passwords, form contents, messages or keystrokes, and it never sends anything online. It does not read anything on pages you have not chosen to save from, with one optional exception: if you turn on the X bookmarks or Instagram saved-posts reader, it reads the bookmark or saved-post data those sites load into your browser. Both are off by default; see the extension privacy page.
Why a small script runs on pages
The extension includes a content script that is present on every page you visit, for one purpose: to draw the in-page clipper when you invoke it, and to package the item you selected. On x.com a second small script draws the Muse button on posts. Both stay idle until you use them, and neither reads or transmits page content on its own.
Where the extension sends data
Only to your own Mac. The extension hands what you chose to save to the Muse app's local server at http://127.0.0.1:17894, a loopback address reachable only from your computer that never travels over the internet. That loopback address is the only host the extension is permitted to talk to. We run no remote servers that collect this data. Nothing is uploaded, shared, sold or transferred to us or any third party. Muse contains no advertising and no third-party analytics or tracking SDKs.
Permissions the extension requests, and why
Does Muse make any network requests?
Yes. These are the ones below, apart from the optional AI features described above. None of them sends us anything about your library.
https://www.theodorehq.com/muse/appcast.xml. The request contains your current Muse version and your macOS version, so we can serve the right update. Like visiting any website, it shares your IP address with our web host. It carries no unique identifier and is verified by Apple's Sparkle framework.https://support.theodorehq.com. See Crash reports and diagnostics below.cdn.syndication.twimg.com) for the post's text and its pictures or video. X sees your IP address and which post you saved. Nothing is sent to us.What personal data do we hold, and on what basis?
Three categories. The law requires us to name a lawful basis under Article 6 of the UK GDPR for each.
& licence record
subscription
logs
How long do we keep it?
& licence record
Storage and your control
Your library lives on your Mac, under your control, and in your own iCloud only if you turn on sync. You can remove individual items or collections from within the app, and you can export your whole library at any time - it is yours, and your files are never held hostage, even if your trial ends or you stop using Muse. Deleting the Muse app does not delete your Muse Library folder, which stays on your Mac until you remove it. Muse also keeps a small trial record on purpose, so that deleting and reinstalling does not start a second trial. It holds only dates (when your trial started, the furthest date Muse has seen, and the trial's length in days) and it lives in three places: an item in your login Keychain, a hidden file in ~/Library/Application Support/.thq/, and a preferences file named com.theodorehq.state. Email us if you would like help removing it. The extension keeps no lasting record of its own; uninstalling it stops all clipping immediately.
Crash reports and diagnostics
If Muse ever quits unexpectedly, it asks the next time you open it whether to send us a crash report. This includes Muse's Share menu extension, its Safari extension and its connection for AI apps. Nothing is sent unless you choose Send or Always Send, and you can turn Always Send off at any time with Automatic Crash Reports in Settings > About.
A crash report holds only technical details about the crash: the Muse version and build, your macOS version, your Mac's chip, the kind of crash, and the names of the parts of Muse where it happened. It also holds a short record of what Muse was doing just before, such as launches, sync steps and failed downloads with their error codes. Names in quotes, links, email addresses and file paths are removed before anything leaves your Mac, Muse never includes the contents of your library, and the full crash report macOS keeps on your Mac never leaves it.
If Muse stops responding for a couple of seconds, it notes where in Muse it was stuck. With Always Send on, it sends us that note with how long it lasted and the same technical details. Otherwise the note is not sent. If you quit Muse while it is not responding, Muse asks the next time you open it, just as it does after a crash.
When you choose Report a Bug, Muse asks whether to include diagnostics. Muse sends them with your report only if you choose Include. They hold the Muse version and build, your macOS version, your Mac's chip, your licence status, how many items of each kind and how many collections you have, which features and settings are switched on, and Muse's record of recent activity. They never include the names, links, notes or files in your library. Diagnostics go privately to our Support Centre and are never shown on it.
Muse keeps its record of recent activity on your Mac, about the last 500 lines and no more than 14 days, and it leaves your Mac only inside a crash report or diagnostics you choose to send. Your internet address is kept only in memory, is not saved or logged by us, and is used only to limit how many reports one address can send.
If macOS itself shows a "Send to Apple" dialog, that is Apple's standard system, not us, and you control it in System Settings > Privacy & Security > Analytics & Improvements.
Cookies and this website
No cookies, no third-party trackers, no advertising scripts, no fingerprinting. Our web fonts and the checkout script are self-hosted (served from this site), so loading a page makes no third-party requests. The one exception is deliberate: if you move towards the Buy button, your browser connects to Polar so the payment window can open on the page rather than sending you elsewhere. Website analytics is handled by Umami (see the next section), which is cookieless.
When you first visit, your browser keeps a small note of the page you landed on, the site that sent you and any campaign tags. If you buy, this note is passed to Polar, our payment provider, with your order so we can see which pages lead to sales. It is never used for advertising. If you turn analytics off with the button on this page, no note is kept or sent. The note is kept in your browser's local storage, not in a cookie. Lawful basis: our legitimate interests (Art 6(1)(f) UK GDPR) in understanding how people find Muse. You can remove it at any time by clearing this site's data in your browser, or by using any standard content blocker.
Download clicks. When you click Download, our server is told which page you came from, the site that sent you and any campaign tags, so we know a download happened. Nothing is stored beyond an email to us. Turning analytics off stops this. Lawful basis: our legitimate interests (Art 6(1)(f) UK GDPR) in knowing which of our writing brings people here.
Website analytics (Umami)
To understand which pages people find useful, this website uses Umami, a privacy-friendly analytics tool we self-host on our own server at analytics.theodorehq.com.
Umami records aggregate, non-identifying information: the page URL, page title and referrer, the country your visit came from (derived from your IP address, which is then immediately discarded and never stored), and your browser, operating system, device type and screen size. It sets no cookies, does not fingerprint your device, does not follow you across other websites, and shares nothing with any third party. We cannot identify you from it.
Lawful basis: under PECR (as amended by the Data (Use and Access) Act 2025), this aggregate, cookieless analytics falls within the "statistical purposes" exception, which requires us to tell you about it and to give you a simple, free way to opt out (both done here). The brief processing of your IP address to derive a country relies on our legitimate interests (Art 6(1)(f) UK GDPR) in understanding aggregate traffic without identifying you. Retention: aggregate figures indefinitely; raw event records for twelve months.
How to opt out. Use the button below and we will save a small flag that tells Umami to ignore this browser on this site permanently. Any standard content blocker (uBlock Origin, Ghostery, Brave's shields) also blocks it automatically.
Who handles your data, and international transfers
We keep suppliers to a minimum. Where one outside the UK handles your purchase, licence or support data, an approved UK transfer safeguard is in place:
United States
United States
support@theodorehq.com mailbox. For UK and EU users this is controlled by Apple Distribution International Limited in Ireland (within the EEA), with Standard Contractual Clauses for any onward transfer.support@theodorehq.com.United Kingdom
United States
United States
You can ask us for more detail on any of these safeguards at support@theodorehq.com.
Your rights under UK GDPR
To exercise any of these, email support@theodorehq.com. We respond within fourteen days, free of charge.
Do Not Track and US visitors
We don't track you across other websites and we don't run advertising, so there is nothing for a Do Not Track signal to switch off. If you are in the United States, including California: we do not sell or share your personal information, and you can ask to see or delete what we hold by emailing support@theodorehq.com.
Complaints
If you are unhappy with how we have handled your personal data, you have the right to complain to us directly (a right under section 164A of the Data Protection Act 2018). The easiest way is to email support@theodorehq.com. We will acknowledge your complaint within 14 days, investigate it, and tell you the outcome.
You also have the right to complain to the UK Information Commissioner's Office (ICO): Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. Helpline: 0303 123 1113. ico.org.uk/make-a-complaint. You can contact the ICO at any time, though we would appreciate the chance to resolve things for you first.
Chrome Web Store Limited Use
Muse's use of information received from Google APIs and the Chrome Web Store adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements. The extension uses the information it handles only to provide Muse's save-to-library feature on your own device; it does not transfer that information to any server, use it for advertising, or sell it.
Children
Muse is a general-purpose productivity tool and is not directed at children under 13 (the UK age of digital consent under section 9 of the Data Protection Act 2018). We do not knowingly collect any personal data from anyone under 13. If you believe we hold such data in error, email us and we will delete it promptly.
Changes to this policy
If we change this policy we will update the date at the top, and email anyone on the customer list a plain-English summary of what changed at least fourteen days before it takes effect. We will not start collecting more from existing users.
Contact
For any questions or concerns, email support@theodorehq.com. Every message is read by a person on our team.
Messages sent through the support button on this site are different: they are posted publicly on our Support Centre, get an automatic first reply, and then a person follows up. Email us instead if you would rather not post publicly.
See also our Terms of Service.