Privacy Policy
Effective 30 October 2026
Media and profile archives
Bluesky records and media are processed in your browser. Archive files are written directly to your device. The payment service does not receive handles, post text, media, filenames, tags, boards, or the contents of your ZIP.
Signing in and bookmarks
Signing in is optional and uses Bluesky’s official browser sign-in; your session stays in your browser. One sign-in serves the whole site. It asks only for your account’s identity and the narrow proof used to attach or restore Premium. If you choose to import your private bookmarks, Bluesky asks you to allow one more permission, reading bookmarks; they are read in your browser and never sent to us. Musepile never asks for permission to post, edit or delete anything.
Public Bluesky data
To download a profile, the extension and the web app look up the handle at Bluesky and the account’s identity in the public identity directory, then read the account’s public posts and media from its own data server. Those services receive the requests and your IP address; our servers receive nothing. The creators listed in your library show their Bluesky profile pictures, which are asked for from Bluesky’s public profile service and image network, so they also receive those requests; the pictures are not copied into your library.
Email updates
The library no longer asks for an email address. An address given earlier is kept only to send one email when sync and sharing launch, with where it was given and the date; library contents were never sent with it. Ask us through the Support page and we will remove it.
Anonymous usage counts
The site counts how often features are used, for example that a library was opened, that something was sent to it, or that a shared board link was opened. Each count is a daily total with a short label, such as how something was saved or how long ago a browser first visited (like “7 to 29 days”). On its first library open in a UTC calendar week or month, the browser also adds one to that period's active-browser total. The dates used to avoid counting it again stay on the device; they are not sent. The counts contain no identifier, email address, IP address, browser details or anything about your library. Your browser sends them only if Do Not Track and Global Privacy Control are off and you have not switched them off in Settings.
To understand useful return visits, the browser also keeps a local record of its first successful save, first-day feature use, and a randomly assigned follow-invitation group. It sends only aggregate counters labelled by the Monday of that week, a fixed save-source or invitation-group label, and an action such as a meaningful return during days 7 to 13. The exact save date, assignment record, deduplication flags, artist identity, searches and saved content stay on the device. Existing libraries are excluded from new-library activation counts. The same Settings switch and browser privacy signals apply; switching counts off discards queued retention counts. The invitation remains optional and does not require sending analytics.
Feedback
If you choose to send feedback in the app, we store your message, which question you answered, the time and a random message reference in Cloudflare D1. No account details or library contents are attached. Please leave out private information. Messages are kept while needed to understand and improve Musepile. The returning-visitor prompt keeps its visit-day count and dismissal only in your browser; it sends nothing until you submit a message.
Account recovery
When you attach Premium to your Bluesky account, your PDS supplies a short-lived cryptographic proof of the account DID. The payment service verifies it, converts the DID into a one-way pseudonymous account reference, and discards the raw DID. Cloudflare D1 stores that account reference with Stripe transaction identifiers and active product entitlements so paid access can be restored on another device. Stripe also receives the pseudonymous reference with your Customer and purchase. Neither service receives your Bluesky handle or raw DID from this app.
Purchases
Stripe processes Checkout and receives the information you provide there, including contact, billing, tax, and payment information. The extension never receives card details. The payment service receives Stripe transaction identifiers and payment-status events needed to issue, restore, and revoke a signed Premium entitlement.
Local storage
The extension keeps its download history and the list of posts you sent to your library in the browser. The web library keeps your saved media, tags, collections, moodboards, settings and a signed entitlement token in the browser’s own storage on your device. Clearing site data removes the library, so keep a backup; signing in again restores an active purchase.
Infrastructure and retention
Cloudflare hosts the payment service and its pseudonymous account database and may process ordinary request metadata such as IP address, timestamps, and security logs. Account and entitlement records are retained while needed to provide purchase recovery, prevent fraud, and meet applicable legal obligations. Stripe and Cloudflare process data under their own privacy terms.
Analytics choices
Website usage and retention counts are described above and can be switched off in Settings. Those feature counts exclude media, searches and direct Bluesky identifiers.
Cloudflare Web Analytics
The website also uses Cloudflare’s free Web Analytics beacon to measure page views, visits and performance, including page-load times and Core Web Vitals. Cloudflare receives page paths, referring page paths, coarse browser and device information, and performance diagnostics that can include resource addresses. Query strings and URL fragments are removed from reported page addresses. Saved media files, captions and searches are not uploaded. The beacon does not use analytics cookies or a persistent visitor identifier, so visits are not a count of distinct people. It runs only on musepile.com, respects Do Not Track and Global Privacy Control, and shares the usage-count switch in Settings. Switching it off reloads the page to stop the already-loaded beacon.
Emailing support
If you email support@musepile.com, Cloudflare’s email routing passes the message on to the developer’s mailbox. We receive your address and what you write, and use them only to answer you.
Your choices
You can use the free downloader without purchasing Premium. To request access to or deletion of the app’s pseudonymous account record, or for extension questions, email support@musepile.com or see Support. Some transaction records may need to remain with Stripe or be retained to meet legal obligations.