Privacy Policy

Muselist is a private library for the creatives you admire. This page explains what data the Muselist web app and the Muselist Chrome extension collect, why, and how to remove it.

What the web app stores

• Your account email and display name (from sign-in).
• Contacts you save: name, handle, bio, discipline, location, notes, folders, and images you choose to attach.
• Billing metadata when you subscribe (handled by our payment provider — we never see your card number).

Your library is private to your account. We do not sell, share, or advertise against it.

What the Chrome extension does

The extension is opt-in and only reads a page when you open the Muselist panel on it — by clicking the toolbar icon, the Muselist button on an Instagram profile, or Add to MuseList on an Instagram post. It never reads pages in the background.

It works on Instagram profiles and on websites such as portfolios and studio sites. From the page you're viewing, it reads only publicly visible information:

• Name and bio or description
• Profile picture or site icon
• Website link and, on Instagram, the profile handle
• Image thumbnails from the page (on a website, also from a few of the same site's pages, such as its About or project pages)

Nothing is sent anywhere until you press Save contact. The extension does not use Instagram's private API and does not read your DMs, private posts, form fields, or browsing history.

How images are stored

When you select images to save, the server downloads each one from Instagram or the website it came from and re-hosts a copy in Muselist's own image storage (Cloudflare R2). Your library never points back to the original URLs — that way images don't break when Instagram rotates its CDN tokens or a website changes.

Authentication

You connect the extension by clicking Connect this browser on your Muselist account page, which gives the extension its own access token, stored in the extension's local storage. Each browser you connect appears on your account page.

Disconnect (in the extension's menu, or next to the browser on your account page) revokes that token on our server. Log out in the extension removes it from that browser only. Removing the extension also deletes it from the browser.

Instagram DM integration

Muselist offers an optional Instagram Direct Message integration so you can send Instagram profile links to our account and have them queue up in your library. When you use it, we receive the following from Meta's Instagram Graph API webhooks:

• Your Instagram-scoped sender ID (an opaque ID Meta issues per app — it is not your public handle).
• The text of DMs you send to the connected Muselist Instagram account, which we parse for a 6-digit linking code and for Instagram profile URLs.

We use this data only to (a) link your Instagram account to your Muselist account when you send the 6-digit code shown in your settings, and (b) queue the Instagram profiles you send for one-click import into your library. We do not read DMs to other accounts, we do not access your followers, posts, or private content, and we do not message you unsolicited.

You can disconnect Instagram at any time from Account settings, which deletes the link between your Instagram sender ID and your Muselist account. To delete queued Instagram data along with your account, follow the deletion instructions below.

Third parties

• Supabase — database, authentication, file storage.
• Cloudflare R2 — image storage.
• Stripe — payments for Pro plans.

Deleting your data

You can delete any contact or folder at any time from your library. To delete your entire account and all associated data, email hello@muselist.app and we'll remove everything within 7 days.

Changes

If we make material changes to this policy we'll update the date at the top and, where appropriate, notify you in the app.