Privacy Policy

Muselist is a private library for the creatives you admire. This page explains what data the Muselist web app and the Muselist for Instagram Chrome extension collect, why, and how to remove it.

What the web app stores

• Your account email and display name (from sign-in).
• Contacts you save: name, handle, bio, discipline, location, notes, folders, and images you choose to attach.
• Billing metadata when you subscribe (handled by our payment provider — we never see your card number).

Your library is private to your account. We do not sell, share, or advertise against it.

What the Chrome extension does

The extension is opt-in. It only runs on instagram.com and on muselist.app. When you click the Muselist button on an Instagram profile, it reads publicly visible information from the page you're already viewing:

• The profile handle, display name, and bio
• The profile avatar URL
• Up to 20 post-thumbnail URLs from the profile grid

Nothing is sent anywhere until you press Import. The extension does not use Instagram's private API, does not use Apify or any third-party scraping service, and does not read your DMs, private posts, or browsing history.

How images are stored

When you select thumbnails to import, the server downloads each one from Instagram's CDN and re-hosts a copy in Muselist's own image storage (Cloudflare R2). Your library never points back to Instagram URLs — that way images don't break when Instagram rotates its CDN tokens.

Authentication

The extension reads your existing Muselist session from muselist.app so you don't have to sign in twice. It stores the access token in Chrome's session storage (cleared when you close the browser) and a refresh token in extension-local storage. You can clear both at any time by clicking Log out in the extension popup, or by removing the extension.

Instagram DM integration

Muselist offers an optional Instagram Direct Message integration so you can send Instagram profile links to our account and have them queue up in your library. When you use it, we receive the following from Meta's Instagram Graph API webhooks:

• Your Instagram-scoped sender ID (an opaque ID Meta issues per app — it is not your public handle).
• The text of DMs you send to the connected Muselist Instagram account, which we parse for a 6-digit linking code and for Instagram profile URLs.

We use this data only to (a) link your Instagram account to your Muselist account when you send the 6-digit code shown in your settings, and (b) queue the Instagram profiles you send for one-click import into your library. We do not read DMs to other accounts, we do not access your followers, posts, or private content, and we do not message you unsolicited.

You can disconnect Instagram at any time from Account settings, which deletes the link between your Instagram sender ID and your Muselist account. To delete queued Instagram data along with your account, follow the deletion instructions below.

Third parties

• Supabase — database, authentication, file storage.
• Cloudflare R2 — image storage.
• Stripe — payments for Pro plans.
• Apify — used server-side only as a fallback to re-fetch fresh Instagram CDN URLs when our originals expire. The extension itself does not call Apify.

Deleting your data

You can delete any contact or folder at any time from your library. To delete your entire account and all associated data, email hello@muselist.app and we'll remove everything within 7 days.

Changes

If we make material changes to this policy we'll update the date at the top and, where appropriate, notify you in the app.