Privacy Policy

Effective date: July 10, 2024 · Last updated: October 16, 2026

Mume (mume.ai, the Mume apps for Android and iOS, and the Mume API) is run by Muse Mesh Private Limited, a company registered in India ("we", "us"). This policy explains what we collect, why, who else receives it, where it is processed, how long we keep it, and how you can see or delete it.

The short version

• Your chats are sent to the AI model you choose.To answer you, your messages and files go to that model's provider, usually through OpenRouter. They are listed below.
• Your chats and generated media are saved to your account so you can come back to them, until you delete them or your account.
• Your chats may be used to improve Mume's models.Paid plans can turn this off in Settings → Privacy. We don't sell your data and we don't show ads in Mume.
• Everything is processed in the United States, on Google Cloud.
• You can delete your account in the app (Settings → Profile → Delete account) or at mume.ai/account-deletion. Access ends at once and your data is deleted within 30 days.

What we collect

Your account

You sign in with Google or Apple. We receive your name, email address and profile picture from them (with Apple you can hide your email, and we then receive a relay address). We also keep your plan, your credit balance and its history, and your settings.

What you create in Mume

• Chats and agent runs:your messages, the model's replies, the files you attach, the tools an agent used and their results, and the run's log.
• Generated media: images, audio and video you create, with the prompt that made them, in your media library.
• Agents, schedules and connections you set up, including the address of any MCP server you connect. Sign-in tokens for those servers are stored encrypted.
• Cloned voices:the voice's name and your consent statement. The audio sample you record is passed to the voice provider to create the voice and is not kept by us.
• Reports you send with the Report button: your reason, any details you add, and an excerpt of the reported reply, so we can review it.

Security and abuse prevention

• Sign-in history: for each sign-in, the time, your IP address, the approximate city and country we derive from it, your time zone, language and browser. You can see it in Settings → Security.
• Free-credit abuse checks: to stop one person collecting free credit many times, we keep the email you signed up with, the sign-up time, your IP address and device signals, and compare them with other accounts. See mume.ai/fair-use.
• Request logs: for every request to our servers, the time, address, size, status, duration, your IP address and user agent. Not the content of your messages.
• Usage records: for every model request, the model, which provider served it, token counts, cost and status, so we can bill credits and show you your usage.

In the Android and iOS apps

• Notifications: if you turn them on, a notification token for your phone, its platform, the app version, your language, and which notifications you want (finished runs, approvals, videos). Turning notifications off deletes the token.
• Dictation:the microphone button uses your phone's own speech recognition (Google on Android, Apple on iOS), which may process your voice on the phone or on Google's or Apple's servers under their terms. We receive only the text, and only if you send it.
• Camera, photos and files: used only when you attach something or save generated media to your photos. Nothing is read from your library on its own.
• Sharing to Mume (Android): what you share from another app is held on your phone until you pick where it goes, and is uploaded only when you send it.
• Purchases: subscriptions in the apps are handled by Google Play or the App Store, and RevenueCat, which receive your Mume account id and the purchase receipt. We never see your card details.

The apps do not collect your precise location, and do not track you across other apps.

On the website

mume.ai uses Google Analytics in Google's Consent Mode, with analytics cookies off by default. Until you answer the cookie banner, and after you choose Decline, Google Analytics sets no cookies and receives only cookieless pings: that a page was viewed or that something happened on it (such as a sign-up, a first chat, or a purchase and its amount), with the page address stripped of conversation ids, your browser and device type, and an approximate region derived from your IP address, which Google Analytics does not store. Nothing in these pings links one visit to the next. If you choose Accept, Google Analytics may also set first-party cookies so that visits from the same browser are counted together. Advertising cookies are never turned on, and your conversations, prompts, email address and account id are never sent to Google Analytics. The Mume apps show the same choice. Our own team marks its browsers so that its visits can be left out of the numbers. You can change your answer here at any time:

Credit purchases on the website are processed by Razorpay, which receives the order amount, your name and email for the checkout, and your payment details. We receive the payment reference, never your card or UPI details.

How we use it

• To answer your chats and run your agents, and to keep your history.
• To bill credits, run subscriptions and show you your usage.
• To keep your account secure and stop abuse of free credit.
• To send the notifications you turned on, and account emails such as a new sign-in alert.
• To fix problems and understand which parts of Mume are used (aggregate analytics).
• To review reports about harmful or illegal output, and to meet legal obligations.
• To train and improve Mume's own AI models, if "Help improve Mume" is on (see below).

We do not sell your personal data and we do not use it for advertising.

Improving Mume's models

"Help improve Mume" (Settings → Privacy) is on for every account. On the free plan it stays on; with a paid plan (a subscription or purchased credit) you can turn it off at any time. While it is on, your chats may be used to train and improve the AI models Muse Mesh builds, and we may keep them for up to 5 years for that purpose. Before chats are used for training we remove the details that identify your account.

• Chats you delete are not used for any future training.
• Turning the setting off (paid plans) stops your chats from being used for any future training.
• A model that has already been trained cannot forget what it learned, so turning the setting off or deleting a chat does not change models trained before you did.
• This is about Mume's own models. The providers that run the models you chat with handle your chats under their own terms (see who else receives your data).

Feedback:when you give a reply a thumbs up or down, we keep that conversation with your rating for up to 5 years and may use it to improve Mume's models, even if "Help improve Mume" is off, because you chose to send it. Taking the rating back deletes it.

Who else receives your data

Mume connects you to AI models made by other companies. To answer a request, we have to send it to the company that runs the model you picked. These are the companies that receive your data, and what they receive:

Each model can be served by several providers, and they handle prompts differently.Some keep nothing (zero data retention), some store prompts for a period, and some may use them for training. Each model's page in Mume lists its providers with what each one does; the zero-retention ones come from OpenRouter's list, which we check daily. A request can be served by any of a model's providers.

OpenRouter states that it does not store prompts or replies unless an account opts in to logging, and that it samples a small share of prompts, anonymously, to categorise usage. Model providers typically keep requests for a limited time (for example, Anthropic keeps API requests for up to 30 days, longer for content flagged for abuse, and does not train on them under its commercial terms).

Some things you choose to do send data elsewhere, under your control: an MCP server or Google account you connect receives what your agents send it, and a link you share opens on the site it points to. Yaarcade, the games site linked from Mume, is a separate site with its own privacy policy; Mume shares only your theme and cookie choice with it, never your account or chats.

We may also disclose data when the law requires it, or to protect people's rights and safety or investigate fraud.

Where your data is processed

Our servers run on Google Cloud in Iowa, USA, and your data is stored in Google Cloud's United States locations. Nothing is processed in India today. By using Mume you agree to your data being processed in the United States and by the providers above in the countries listed.

How long we keep it

• Chats, agent runs and generated media:until you delete them or your account; deleted items are removed from our systems within 30 days. With "Help improve Mume" on, chats may be kept for up to 5 years for training (deleted chats are still removed and never used).
• Feedback (thumbs up or down, with the conversation): up to 5 years, even after you delete the chat or your account.
• Content reported or flagged for violating our usage policy: up to 2 years, and the record of the safety classification up to 7 years, even after you delete the chat or your account, so we can act on abuse and improve our safety systems.
• Request logs: 30 days.
• Usage records and credit history: while your account exists. After you delete your account, usage costs are kept for our accounting with your account removed from them, and payment records are kept as long as tax and accounting law requires.
• Sign-in history: while your account exists.
• Notification tokens: until you turn notifications off, sign out, or the token stops working.
• A record that your email address had an account (the address, when the account was created, its final credit balance, and whether it was disabled for abuse): kept after deletion, with no end date, so the same person is not given free credit again.

Deleting your data

You can delete a chat or a generated file at any time. To delete your account and the data that belongs to it, use Settings → Profile → Delete account in the app or on the website, or follow the steps at mume.ai/account-deletion.

Deleting your account ends access at once: you are signed out everywhere, your API keys stop working and notifications stop. We keep the account's data for 30 days in case it is needed for a legal claim or to investigate abuse, and then delete it permanently. The exceptions are the feedback and safety records described above, the record that your email address had an account, and payment records the law requires us to keep. The full list is on mume.ai/account-deletion.

The Mume API

If you use the API at mume.ai/api/v1 with an API key:

• For chat completions, responses, embeddings, rerank, moderation and transcription, we do not store your prompts or the model's output. They pass through our servers in memory to the provider.
• For image, speech and video generation, the prompt and the result are saved to your media library (speech is not saved if you send "store": false).
• If you send an Idempotency-Key header or Cache-Control: max-age, we keep the full response for up to 24 hours so we can return it again.
• When a provider rejects a request, we log its error message for 30 days. These are usually about rate limits, but a provider could quote part of your request in one.
• We store only a one-way hash of each API key, never the key itself.

Children

You must be at least 13 to use Mume, and if you are under 18 you need the permission of a parent or guardian. We do not knowingly collect data from children under 13. If you believe a child has given us their data, contact kushal@muse-mesh.com and we will delete it.

Security

Data is encrypted in transit (HTTPS) and at rest (Google Cloud's default encryption). Provider keys are kept in Google Secret Manager, connection tokens are stored encrypted, and access to our cloud project is limited to a small number of staff accounts. No system is perfectly secure; if a breach affects your data we will tell you and the authorities as the law requires.

Your rights

Wherever you live, you can ask us to: tell you what data we hold about you and give you a copy; correct it; delete it; and stop processing it for a purpose you previously agreed to. Email kushal@muse-mesh.com from the address on your account. We reply within 30 days and do not charge for it.

• India (Digital Personal Data Protection Act, 2023): you can withdraw consent, nominate someone to exercise your rights if you are unable to, and complain to our Grievance Officer below. If you are not satisfied, you can complain to the Data Protection Board of India.
• California (CCPA) and Virginia (VCDPA): you have the rights to know, access, correct, delete and obtain a portable copy of your data, and not to be treated differently for using them. We do not sell or share personal information for advertising, and we do not profile you in ways that produce legal effects. We honour Global Privacy Control signals. Virginia residents can appeal a refusal by replying to it; we answer appeals within 60 days, and you can then contact the Virginia Attorney General.

Contact and Grievance Officer

• Company: Muse Mesh Private Limited, India
• Grievance Officer and privacy contact: Kushal Sharma, kushal@muse-mesh.com
• Languages: English and Hindi

Changes to this policy

When we change this policy we update the date at the top. If a change affects how we use data you have already given us, we will tell you in the app or by email before it takes effect.