Privacy Policy
Last updated 4 August 2026
Muster is a tool for checking servers, which means the interesting question is not what we collect but what we refuse to. We store what Muster observed — never the credentials it used or the secrets it saw. There is no column in our database for a cloud key, an SSH private key, or the value of an application secret.
1. What we collect
| Data | Why |
|---|---|
| Email address | To create your account and send single-use sign-in codes. It is the only thing required to sign up. |
| Name | Optional. Shown in the console so teammates can tell each other apart. |
| Billing identifiers | A Stripe customer and subscription id, your plan, and its renewal date. Card details are handled by Stripe and never reach our servers. |
| App metadata | The name you give an app, its repository URL, and the address Muster connects to (for example user@host) — the address only, never the credentials. |
| Inferred Intent | A YAML description of your app’s services, datastores and required environment keys. Key names only; values are never read or stored. |
| Project files | If you add files for Muster to analyse, their path and contents are stored against that app so inference can run. Delete the app and they are deleted with it. |
| Check history | Each readiness run: which gates passed, which failed, the failure reason, timings, and the estimated monthly cost at that moment. |
| Product events | That something happened and when — signed up, connected a server, ran a check, subscribed. Tied to your account, never to a device or an IP address. |
| Sign-in codes | Stored hashed, single-use, and expiring. Attempts are counted to stop brute force. |
| Rate-limit counters | Coarse counters keyed by action, so abuse limits survive a restart. |
2. What we never collect
These are absent from our schema by design, not by policy:
- Cloud provider access keys or secret keys
- SSH private keys — connections use your own SSH agent on your own machine
- The value of any environment variable or application secret. Muster verifies that a key is present; it never reads what it contains
- The contents of your database
- Payment card numbers
We do not use advertising trackers, third-party analytics, session recording, or marketing scripts, and we do not sell or rent personal data to anyone.
We do record product events — that an account signed up, connected a server, ran a check, or subscribed — in our own database, so we can see where the product is confusing and fix it. These are counts and timestamps tied to an account, and nothing else: no IP address, no device or browser fingerprint, no referrer, and no cross-site identifier. Nothing is shared with a third party, and none of it can follow you anywhere else on the internet. Because we collect none of those things, the console sets no tracking cookies and needs no consent banner.
3. Cookies
One cookie: muster_session. It keeps you signed in, is marked HttpOnly and SameSite=Lax (and Secure in production), and expires after 30 days. It holds a signed reference to your member record — no personal data is stored in the cookie itself. Signing out invalidates every existing session immediately.
It is strictly necessary to operate the service, so it requires no consent banner. We set no other cookies.
4. Who processes your data
- Stripe — payments and subscriptions. Card data goes directly to Stripe; we receive only identifiers and status.
- Resend — transactional email, i.e. your sign-in codes. No marketing email is sent through it.
- Our hosting and database provider — stores the data described above.
- A model provider (Anthropic or OpenAI) — only when you ask the assistant a question about a check result, and only then. What is sent is your question plus the result of that run: gate names, pass/fail states, and failure reasons. Credential-shaped text is stripped before it leaves our servers. Your files, env values, and account details are not sent. If you never use the assistant, nothing is ever sent.
We do not transfer your data to anyone else. If that ever changes, this list changes with it before the transfer happens.
5. How long we keep it
Account and app data are kept until you delete them. Deleting an app deletes its Intent, stored files, and full check history. Deleting your account deletes everything associated with it, including its product events. Sign-in codes are deleted once used or expired; rate-limit counters reset on their own schedule.
6. Your rights
Depending on where you live, you may have the right to access, correct, export, restrict, or delete your personal data, and to object to processing. You can delete apps and your account from the console at any time. For anything else — including a full export — email us and we will respond within 30 days.
7. Security
Sign-in codes are hashed and single-use. Sessions carry a version that is bumped on sign-out, so logging out revokes existing tokens rather than leaving them valid for their full 30 days. The application sets a strict Content-Security-Policy, denies framing, and sends HSTS in production. Stored project files are scoped per app and per account, with no filesystem path involved.
No system is perfectly secure. If you find a vulnerability, please report it to info@thebotss.com before disclosing it publicly.
8. Children
Muster is a developer tool and is not directed at anyone under 16. We do not knowingly collect their data.
9. Changes
If we change this policy materially we will update the date above and notify account holders by email before the change takes effect.
10. Contact
Questions about this policy, or about data we hold: info@thebotss.com. See also our Terms of Service.