Privacy Policy
Last updated 15 September 2026
Muster is a tool for checking servers, which means the interesting question is not what we collect but what we refuse to. We store what Muster observed — never the credentials it used or the secrets it saw. There is no column in our database for a cloud key, an SSH private key, or the value of an application secret.
1. What we collect
| Data | Why |
|---|---|
| Email address | To create your account and send single-use sign-in codes. It is the only thing required to sign up. |
| Name | Optional. Shown in the console so teammates can tell each other apart. |
| Billing identifiers | A Stripe customer and subscription id, your plan, and its renewal date. Card details are handled by Stripe and never reach our servers. |
| App metadata | The name you give an app, its repository URL, and the address Muster connects to (for example user@host) — the address only, never the credentials. |
| Inferred Intent | A YAML description of your app’s services, datastores and required environment keys. Key names only; values are never read or stored. |
| Project files | If you add files for Muster to analyse, their path and contents are stored against that app so inference can run. Delete the app and they are deleted with it. |
| Check history | Each readiness run: which gates passed, which failed, the failure reason, timings, and the estimated monthly cost at that moment. |
| Product events | That something happened and when — signed up, connected a server, ran a check, subscribed. Tied to your account, never to a device or an IP address. |
| Sign-in codes | Stored hashed, single-use, and expiring. Attempts are counted to stop brute force. |
| Rate-limit counters | Coarse counters keyed by action, so abuse limits survive a restart. |
2. What we never collect
These are absent from our schema by design, not by policy:
- Cloud provider access keys or secret keys
- SSH private keys — connections use your own SSH agent on your own machine
- The value of any environment variable or application secret. Muster verifies that a key is present; it never reads what it contains
- The contents of your database
- Payment card numbers
We do not use advertising trackers, third-party analytics, session recording, or marketing scripts, and we do not sell or rent personal data to anyone.
We do record product events — that an account signed up, connected a server, ran a check, or subscribed — in our own database, so we can see where the product is confusing and fix it. These are counts and timestamps tied to an account, and nothing else: no IP address, no device or browser fingerprint, no referrer, and no cross-site identifier. Nothing is shared with a third party, and none of it can follow you anywhere else on the internet. Because we collect none of those things, the console sets no tracking cookies and needs no consent banner.
3. Cookies
One cookie: muster_session. It keeps you signed in, is marked HttpOnly and SameSite=Lax (and Secure in production), and expires after 30 days. It holds a signed reference to your member record — no personal data is stored in the cookie itself. Signing out invalidates every existing session immediately.
It is strictly necessary to operate the service, so it requires no consent banner. We set no other cookies.
4. Who processes your data
- Stripe — payments and subscriptions. Card data goes directly to Stripe; we receive only identifiers and status.
- Resend — transactional email, i.e. your sign-in codes. No marketing email is sent through it.
- Our hosting and database provider — stores the data described above.
- A model provider (Anthropic, OpenAI, Google or Groq) — only when you use one of Muster’s AI features, and only then:
- Asking about an app sends your question, the last check’s result (gate names, pass/fail states and failure reasons), and the passages that bear on the question from the app’s stored files and — when its repository is connected — its recent commit messages and pull request titles and descriptions. Commit authors are not read. Files that exist to hold secrets are never indexed, and credential-shaped text is stripped from everything else before it is stored.
- Meaning search, when this deployment has an OpenAI or Google key for it, sends the text of those passages to that provider once, to index them.
- Generating a file, in the console or the IDE, sends your instruction, the app’s Intent, and the contents of project files: the file you are working on and, in the IDE, other files from your project that your request names or that bear on it (open tabs, manifests, entry points), with the list of your project’s file names. Files that exist to hold secrets, such as
.envfiles and private keys, are never sent, and credential-shaped text is stripped from everything else before it leaves our servers. - With your own API key, the request goes to the provider you chose, under your account with them. We pass the key on with that request and do not store it.
muster ide, under your own sign-in to them, which they keep; nothing they send passes through Muster.
We do not transfer your data to anyone else. If that ever changes, this list changes with it before the transfer happens.
5. How long we keep it
Account and app data are kept until you delete them. Deleting an app deletes its Intent, stored files, and full check history. Deleting your account deletes everything associated with it, including its product events. Sign-in codes are deleted once used or expired; rate-limit counters reset on their own schedule.
6. Your rights
Depending on where you live, you may have the right to access, correct, export, restrict, or delete your personal data, and to object to processing. You can delete apps and your account from the console at any time. For anything else — including a full export — email us and we will respond within 30 days.
7. Security
Sign-in codes are hashed and single-use. Sessions carry a version that is bumped on sign-out, so logging out revokes existing tokens rather than leaving them valid for their full 30 days. The application sets a strict Content-Security-Policy, denies framing, and sends HSTS in production. Stored project files are scoped per app and per account, with no filesystem path involved.
No system is perfectly secure. If you find a vulnerability, please report it to info@thebotss.com before disclosing it publicly.
8. Children
Muster is a developer tool and is not directed at anyone under 16. We do not knowingly collect their data.
9. Changes
If we change this policy materially we will update the date above and notify account holders by email before the change takes effect.
10. Contact
Questions about this policy, or about data we hold: info@thebotss.com. See also our Terms of Service.