Privacy Policy

Canonical address: https://musen.live/privacy

Privacy should create confidence, not hidden dependency.

This Policy explains what personal data the current musen service processes, why it is processed, who may receive it, how long it is kept, and what choices and rights people have. It reflects the current public product rather than planned or research features.

This version replaces Privacy Policy v4.6 from its effective date. Compared with v4.0 it adds section 7's description of musen dojo, the optional achievements layer, and it describes listening without an account (guest listening) in sections 1, 3, 5, 7, 10, 14 and 15. Compared with v4.2 it describes push notifications in sections 3, 5, 9, 12, 14 and 15: the notification token, who delivers the messages, how long the token is kept and how to turn notifications off. Compared with v4.3 it describes, in sections 3, 5, 7, 9, 14 and 15, the sign-up invitation sent to a phone that listens without an account: when its token is registered, how many reminders are sent and how to stop them. Compared with v4.4 it describes, in sections 3, 5, 7, 10, 12, 14 and 15, the Audiences switch in Account: with your permission, and only then, musen tells its own Google Ads account whether you are an active or returning listener so that musen's own advertising reaches people like you or stops reaching you. Compared with v4.5 it describes Radio Memory in sections 3, 5, 7, 8, 12, 14 and 15: what musen remembers for your radio, the two switches in Account, the Radio Memory screen, Forget everything, how long each part is kept and the providers behind the AI Host. Compared with v4.6 it describes, in sections 3, 5, 14 and 15, the record musen keeps when an account is deleted and the optional reason for leaving that you can give when you delete your account in the app.

1. Purpose, scope and current service

This Privacy Policy explains how personal data is processed when you use musen operated websites and applications that link to this Policy. It applies to the current public musen listening service and to supporting account, analytics, security and customer support functions.

The current public release is a free personal Live Radio experience available on iPhone and Android. You can listen to the musen radio without creating an account (guest listening). A free account gives you a personal radio that you can shape through text, voice or picture requests, likes and dislikes, settings and optional AI Host speech. An internet connection is required. The current public release does not offer paid subscriptions, in app purchases, creator uploads, user broadcasting, Segment creation, or a separate public AI DJ mode.

Status discipline. A reference in this Policy to a possible future feature does not mean that feature is currently available. Where a new feature materially changes personal data processing, this Policy and relevant notices will be updated before or when that processing begins.

2. Controller identity and contact details

For purposes of the UK General Data Protection Regulation, the EU General Data Protection Regulation where applicable, and other applicable data protection laws, the controller responsible for the processing described in this Policy is:

musen is a trading name and is not a separate legal entity. The controller identity in this Policy is intended to match the legal operator identified in the Terms, app store information, contracts and other binding notices.

3. Information we process

The information processed depends on the features you use. We seek to limit collection to information reasonably necessary for the stated purposes and to avoid collecting information simply because it is technically available.

Account and authentication information

• Email address, account identifier, display name and profile information you choose to provide.
• Authentication tokens and provider identifiers used to sign in or maintain a session.
• Information received from supported authentication providers such as Apple or Google when you choose those sign in methods.
• Eligibility or age related information where reasonably necessary for access, safety or legal compliance.
• If you delete your account: the record of the deletion described in section 15 and, if you choose to give them, your reason for leaving and your comment.

Device, network and application information

• IP address and approximate location inferred from network information.
• Device type, operating system, app version, browser where relevant, language, time zone and similar technical information.
• Network, performance, crash, authentication and security events.
• Device or advertising identifiers only where the platform, law and your choices permit their use.
• A push notification token for your device, registered while you are signed in or, on a phone that listens without an account and allows notifications, to invite you to create a free account (see Guest listening below), together with the platform, app version, language and time zone used to address and time the messages. The token identifies the app on your device to the notification service; it is not an advertising identifier and is not used for measurement. When you open a notification, the app tells us so that your other signed-in devices stop being sent the same one; a notification that was only delivered or shown is not treated as opened.

Listening and radio activity

• Listening sessions, duration, continuity and playback events.
• Music or radio elements presented during a session and interactions with available controls.
• Request history, explicit preferences and other signals used to shape the radio.
• Optional AI Host settings and interactions relevant to operating the radio.
• Radio Memory: what you tell musen to remember for your radio, the routines musen notices from your own Requests and the Host's proposals, each with its origin, status and dates, and the list of your recent Requests that musen uses. See section 7.
• musen dojo progression: validated listening time per local day, counts and timestamps of Requests, likes, dislikes and Train Radio votes, whether radio and profile identity fields are set, and the Kata, Ki, Belts and player skins earned from them. See section 7.

Guest listening (no account)

• When you listen without an account there is no account identifier. The stream is delivered to your device, and our streaming servers process the IP address and connection information needed to deliver it, as for any listener.
• The device, network and application information and the analytics and diagnostic events described in this section are processed under a device based identifier rather than an account. Advertising measurement follows your platform choices: App Tracking Transparency on Apple devices and the measurement choice shown in the app on Android.
• The app chooses which musen radio a guest hears from a small set of listening profiles. That choice is made on your device from the local time and day, the number of languages configured on the device and the device type. It is stored only on your device and removed when you sign in. The name of the chosen profile is included in analytics events as an aggregate product signal.
• Guest listening is not recorded as the listening session of any account and is not used for musen dojo. Events sent before you sign in do not carry an account identifier.
• If your device allows notifications, the app registers its push notification token without any account identifier, together with the platform, app version, language and time zone, so that we can invite you to create a free account: at most two reminders, one and three days after the phone first registered as a guest, in the evening of your time zone, and none if you used the app in the previous twenty-four hours. The invitation shown in the app after ten minutes of listening explains this and offers a Stop reminders control; the notification setting of your phone stops them as well. Opening such a reminder is not reported to us. If you create an account on that phone the token is attached to your account. A phone that has ever been signed in is not invited.

Text, voice and picture requests

• Text that you enter into a request.
• Audio that you deliberately submit when you choose a voice request, and a transcript or interpreted representation where generated.
• Images that you deliberately submit or capture when you choose a picture request, and descriptions or other derived representations where generated.
• Limited technical and request context needed to interpret the request and deliver the radio experience.

Support, safety and legal information

• Messages you send to support or privacy contacts.
• Reports, complaints, moderation information and records needed to investigate safety, rights or abuse concerns.
• Information needed to comply with lawful requests, resolve disputes, establish legal claims or protect the Service.

Analytics and advertising measurement information

• App events and aggregate usage information used to understand reliability, activation and feature performance.
• Crash and diagnostic information.
• Campaign attribution events and, where permitted, advertising identifiers used to measure musen advertising campaigns.
• If you turn on the Audiences switch in Account: the record of your choice (the time, the version of this Policy you were shown and the surface you used) and, for musen's own campaigns only, your account email address in hashed form together with the audience you belong to (for example active listener or returning listener), derived from your validated listening time. See section 10.

4. Information we do not seek by default

• Ordinary listening does not require continuous microphone or camera access.
• We do not use submitted voice recordings or pictures to create voiceprints or facial recognition templates for the purpose of uniquely identifying you.
• The current public service does not process payment card or bank account information because it does not currently offer paid features or in app purchases.
• The service is not directed to children under 13, and we do not knowingly seek personal data from children under 13.
• We do not require you to provide sensitive personal information in free form requests. Please avoid submitting health, identity, financial, intimate or other sensitive information unless it is genuinely necessary for the feature you choose to use.

5. Why we process information and the legal bases we use

The lawful basis depends on the specific purpose. We do not rely on one legal basis as a universal fallback. The table below describes the main processing purposes for the current service.

Legitimate interests

Where we rely on legitimate interests, the relevant interests may include service security, fraud prevention, reliability, proportionate analytics, abuse prevention and protecting legal rights. We balance those interests against your rights and reasonable expectations. You may have a right to object to processing based on legitimate interests.

6. Text, voice and picture requests

Requests are deliberate inputs used to shape the radio. Different request modes involve different data.

• Text requests. We process the text you submit and limited account, radio and technical context needed to interpret it.
• Voice requests. When you choose a voice request, we process the audio you deliberately submit, together with limited technical and request context, to transcribe or interpret the request and provide the radio experience.
• Picture requests. When you choose a picture request, we process the image you deliberately submit, together with limited technical and request context, to interpret the request and provide the radio experience.
• Derived information. A provider or musen system may create a transcript, description, classification or other representation from a submitted request. Derived information can be personal data even if the original media is later deleted.

Depending on how a feature is implemented, authorised service providers may process request information on behalf of the controller or under another role described in the provider information. We do not claim that voice or picture requests are processed only on the device, and we do not claim that raw media is never retained unless the verified retention practice supports that statement.

Device permission is not blanket permission. Microphone, camera and photo library access is requested through device controls when needed. Granting a device permission does not authorise unrelated processing. Ordinary listening does not require continuous microphone or camera access.

7. Listening personalisation and preference inferences

musen may use listening activity, request history, explicit preferences and permitted contextual signals to adapt radio over time. These records can be used to infer preferences, such as likely interest in certain moods, topics, formats or listening patterns.

Personalisation records are limited according to their purpose and applicable retention criteria. Where controls are available, you can change, reset or remove relevant preferences. Personalisation is used for entertainment and does not make decisions that produce legal effects or similarly significant effects about you.

The design principle is continuity without captivity: personalisation should help the radio evolve with you rather than freeze you into a permanent identity. This principle does not replace the concrete retention, deletion and access rules in this Policy.

Guest listening. For a listener without an account, the only personalisation is the on device listening profile described in section 3, which picks one of the musen radios. No personalisation record is kept on our servers for a guest, and nothing from guest listening is carried into an account created later. The push notification token registered for the sign-up invitation (section 3) is not listening data: if you create an account on that phone it is attached to your account so that the account's notifications reach the device, and the invitation stops.

Audiences. If you turn on the Audiences switch in Account, your validated listening time per local day (the same record musen dojo uses) decides which of a small set of audiences you belong to, for example active listener or returning listener. That membership, and nothing else about your listening, is shared as described in section 10. It is not used to decide anything about your account or your radio, and it stops being computed for you when you turn the switch off.

Radio Memory. musen keeps, for your radio, what you tell it to remember, the routines it notices in your own Requests and the proposals the AI Host makes from your listening. Items musen notices are shown labelled "musen noticed", carry a confidence and expire after 180 days unless you keep them; the Host's proposals wait under "To confirm" for 30 days. Routines are noticed only from your own Requests to your own radio, never from anything outside musen, and never about health, religion, politics, sexuality, ethnicity, finances or precise location. Choosing Not this on an item erases it and that pattern is never noticed again. Radio Memory is never used for advertising and is never sold or shared for anyone else's purposes: the memories your switches allow reach only the language model provider that writes the Host's words, as our processor, for that purpose (section 8). It makes no decision with legal or similarly significant effects. Two switches in Account control it, both on until you turn them off: Remember what I tell musen and Let musen notice my habits. Automatic noticing starts only once this Policy describes it and the app offers the switch; until then nothing is noticed.

musen dojo. The app includes an optional achievements layer called musen dojo. It is computed by musen's own progression service from records the Service already holds: validated listening time per local day, counts and timestamps of Requests, likes, dislikes and Train Radio votes, and whether radio and profile identity fields are set. It never stores the text of a Request, a biography, an image or a transcript, and it does not infer health, relationships, beliefs or other sensitive characteristics. The result (Kata, Ki, Belts, Shuriken and player skins) is private to your account, is not shown to other listeners, and is never used for advertising or for decisions with legal or similarly significant effects. Progression records are kept for the life of the account and deleted within thirty days of account deletion. You can hide the Dojo card and its celebrations in the app at any time; the radio never requires it.

8. AI Host and contracted AI services

The optional AI Host is synthetic speech within the radio experience. To generate or deliver Host speech, musen may process the current request, limited radio context, language or voice settings, and text generated for speech. Contracted language, search, speech or infrastructure providers may receive the limited information needed to perform their function.

The Host is produced by contracted providers acting on our instructions: language model providers (Anthropic, OpenAI) write what the Host says from the current Request, the programme, the memories your switches allow and the Host's own recent editorial notes; a web search provider (Perplexity) looks up topical facts about the music and the day from the current Request, the radio's name and description as you wrote them, the programme and the time, and never receives your account details, your memories or your listening history, so it sees personal information only if you put it in a Request or in the radio's name or description; speech providers (VibeVoice on Modal, ElevenLabs, Fish Audio) turn the text into voice and receive only that text. The Host's scripts are kept for thirty days; when a memory they used is erased, their text is removed through the same delivery queue as the erasure, normally within minutes. Host recordings are produced by one of two pipelines during a transition. The previous pipeline is still in use at the date of this version: it publishes each recording to public IPFS storage, a public network where removing our copy does not remove copies other nodes may keep, and recordings made that way stay there. The newer pipeline keeps each recording as a private file on our own servers and removes it after it has aired, through a cleanup that runs every fifteen minutes once an hour has passed; it takes over when we switch the Host to it, and this Policy will be updated when that happens.

The AI Host is not used to make decisions about your legal rights, eligibility for essential services, credit, employment, health care or similar matters. Host speech may be incomplete or incorrect and is provided for entertainment rather than professional advice.

Permission to stream or analyse music does not, by itself, create permission to use that music for model training. Music rights and training permissions are governed separately by the applicable rights basis and contracts. This Privacy Policy does not grant a provider permission to use personal request content for unrelated training.

9. Device permissions

• Microphone permission may be requested when you choose a voice request.
• Camera or photo library permission may be requested when you choose to capture or select a picture request.
• Notification permission is requested when you first play Live Radio on iPhone; Android asks at first launch. On iPhone a listener without an account is asked only after answering the in-app invitation described in section 3, never at first play. The permission lets the app show the playback controls and the notifications described in section 5. Without it no notification token is registered.
• App Tracking Transparency permission may be requested on Apple devices where tracking or access to the advertising identifier requires it.
• Platform permission choices can usually be changed in your device settings. Changing a permission may limit the feature that depends on it but should not prevent unrelated core listening functions.

10. Analytics, diagnostics, advertising measurement and cookies

musen uses analytics and diagnostic tools to understand reliability, product use and campaign performance. The exact configuration can differ between the website and mobile applications.

The current stack includes Firebase Analytics for product analytics, Sentry for crash and error monitoring, and Meta App Events for measurement of musen advertising campaigns. Apple and Google may also process platform, authentication or store related information under their own terms and privacy roles.

• We do not serve third party advertising inside the current public musen service.
• We do not treat App Tracking Transparency permission as a substitute for consent required under data protection or electronic privacy law, and we do not treat legal consent as a substitute for Apple platform permission.
• Where an advertising identifier is used, it is accessed only where platform rules and applicable consent requirements permit it.
• Website cookies and similar storage used for non essential analytics or measurement are used only where the required choice has been obtained.
• Declining optional measurement should not disable unrelated core listening functionality.
• Audiences for musen's own advertising are built only from accounts that turned on the Audiences switch in Account. For those accounts musen sends Google Ads, for musen's own advertising account only, the account email address hashed on our systems before it leaves them, the audience the account belongs to and the consent signals that record your choice, through Google's Data Manager interface (Customer Match). Google matches the hashed address against its own signed-in accounts to form an audience that only musen can use and, under its Customer Match terms, does not share the uploaded data with other advertisers. Turning the switch off, or deleting your account, removes you from those audiences at the next synchronisation, normally within seven days. No advertising identifier, no listening history and no Request content is sent for this purpose, and nothing is sent while the switch is off.
• On iPhone the Audiences switch can be turned on only while App Tracking Transparency permission is granted for musen, because Apple treats this sharing as tracking; the switch tells you when that permission is missing.
• Analytics events sent while you listen without an account are recorded under a device based identifier and do not carry an account identifier. Signing in later does not retroactively attach those events to your account.

11. Authentication and information received from other services

When you choose a supported authentication provider, musen may receive information such as a provider account identifier, email address, display name where supplied, authentication tokens and login metadata. Apple may provide a private relay email address depending on your settings. The provider may also process your information independently under its own terms and privacy policy.

Information may also be obtained indirectly from device platforms, app stores, analytics services or security tools. Where required, this Policy explains the source or category of source and the purpose for which that information is used.

12. Who receives personal data

Personal data is disclosed only where reasonably necessary for the stated purposes, where required by law, or where you direct the disclosure. Recipient roles vary. Some providers act as processors on behalf of the controller, while others may act as independent controllers for their own platform services.

Provider register. The controller maintains a current provider register identifying enabled services, relevant data categories, privacy role, processing location, transfer mechanism and provider privacy information. Provider roles depend on the actual service and configuration, and not every provider acts only on behalf of the controller.

13. International data transfers

Some providers may process personal data outside the United Kingdom or European Economic Area. When applicable data protection law requires safeguards for a transfer, the controller uses an applicable transfer mechanism. This may include an adequacy decision or regulation, approved contractual safeguards together with supplementary measures where appropriate, or another lawful transfer mechanism.

The applicable mechanism depends on the recipient, destination, role and processing context. This Policy does not claim that one transfer mechanism applies to every provider or every transfer.

14. How long information is kept

Personal data is retained only for as long as there is a justified purpose or legal basis. Because the Service contains different data classes and service providers, retention is managed by criteria and by an internal schedule rather than by one universal period.

If musen introduces automatic inactivity deletion, the applicable rule and timing will be disclosed once implemented. This Policy does not promise an inactivity deletion process that is not operational.

15. Account deletion and your controls

You may request deletion of your account and associated personal data through available account controls or by contacting the privacy address. Where an in app deletion control is available, it should be used for the fastest account linked request.

• We may take reasonable steps to verify identity before deleting or disclosing account data.
• Deletion generally covers account identifiers, profile information, personalisation records and authentication links held by the controller, subject to lawful exceptions.
• When an account is deleted, musen keeps a record of the deletion without the name, email address or username: when it happened, whether you or musen support deleted the account, when the account was created, how you signed up, whether the email address was confirmed, whether it was a beta tester account or one of musen's own accounts, the type of phone and the app version, the home screen layout in use, when the app was last used, and counts of what the account held (radios, Requests, Host moments and memories). The account's internal identifier stays on that record for up to thirty days so that every musen service can finish removing your data, and is then removed from it.
• When you delete your account in the app you can tell us why you are leaving: one reason from a short list and, if you like, a comment. Answering is optional and never prevents the deletion. If you answer, your reason and any comment you add are kept with the record of the deletion and are used to understand why listeners leave and to improve the Service.
• Limited records may be retained where necessary for security, fraud prevention, legal claims, regulatory duties or enforcement, and are kept only for the justified purpose.
• Deletion from musen does not delete information independently held by Apple, Google or another provider under that provider relationship.
• Deletion requests are propagated to processors where required and technically applicable. Backup copies may expire through the normal protected backup cycle rather than being removed instantly.
• If you listen without an account there is no account to delete. Removing the app removes the on device listening profile and local settings. Server side stream and security logs expire under the retention criteria in section 14, and your data protection rights in section 16 apply to any personal data we still hold.
• Notifications are under your control. The Dojo rewards and Listening reminders switches in Account turn each kind off for your account; the notification setting of your operating system turns everything off for the device; signing out removes the device registration. If you listen without an account, Stop reminders on the in-app invitation ends the sign-up reminders for that phone. Turning notifications off never affects listening.
• The Audiences switch in Account is off until you turn it on. Turning it off withdraws your permission: nothing more is sent, and you are removed from musen's audiences on Google at the next synchronisation, normally within seven days. Deleting the account does the same. The switch never affects listening.
• Radio Memory is under your control. Two switches in Account, Remember what I tell musen and Let musen notice my habits, are both on until you turn them off; the first pauses the use of what you told musen, the second stops musen noticing habits and making proposals. The Radio Memory screen (See what musen remembers) lets you edit, confirm, delete or reject each item, add your own, see the recent Requests musen uses, and choose Forget everything, which erases your memories, your Request history and your submitted Requests while your current Request and your radio settings stay. Neither switch affects listening.

16. Your data protection rights

Where the UK GDPR, EU GDPR or other applicable data protection law gives you these rights, they may include the following, subject to the conditions and exceptions in applicable law:

• Access to your personal data and information about how it is processed.
• Rectification of inaccurate or incomplete personal data.
• Erasure in circumstances where the law gives you that right.
• Restriction of processing in specified situations.
• Data portability for qualifying processing based on consent or contract and carried out by automated means.
• Objection to processing based on legitimate interests and an unconditional right to object to direct marketing.
• Withdrawal of consent at any time where processing is based on consent, without affecting processing already carried out lawfully.
• The right to lodge a complaint with a competent data protection supervisory authority.

Requests may be sent to info@musen.live. We normally respond within one month where the applicable law provides that period, subject to lawful extensions for complex or numerous requests. We may ask for proportionate information to verify your identity or authority to act for another person.

17. Children and age related safeguards

The Service is not directed to children under 13. People under 13 may not use the current Service. Users aged 13 to 17 may use the Service only where applicable law permits it and subject to any parent or legal guardian authorisation required for the relevant processing or service in their country.

Where consent is the legal basis for offering an information society service directly to a child, the applicable age for independent consent can be higher than 13 depending on national law. musen may restrict a feature, request age information or require parent or legal guardian involvement where reasonably necessary to comply with applicable law or protect young users.

We do not use children's data for behaviourally targeted advertising. If we become aware that personal data from a child under 13 has been collected in circumstances where use of the Service is not permitted, we will take reasonable steps to delete or otherwise lawfully resolve that data without undue delay.

18. Security and personal data breaches

The controller uses technical and organisational measures intended to protect personal data against unauthorised access, loss, alteration and disclosure. Measures may include access controls, secure authentication, encryption in transit, appropriate storage protection, logging, monitoring and restricted internal access. No system can be guaranteed to be completely secure.

When a personal data breach occurs, it is assessed and handled in accordance with applicable law. Where applicable data protection law requires notification to a supervisory authority, notification is made without undue delay and, where the UK GDPR or EU GDPR applies, within 72 hours after becoming aware of the breach when that rule is applicable. Affected people are notified where the law requires it because the breach is likely to result in a high risk to their rights and freedoms.

19. Profiling, AI and automated decisions

Personalisation can involve profiling in the broad data protection sense because listening activity, requests and preferences may be used to infer likely interests and shape radio output. This profiling is used to provide entertainment and improve radio relevance.

The current Service does not use automated decision making to make decisions that produce legal effects or similarly significant effects about users. If a future feature changes that position, musen will assess the applicable legal requirements and update the relevant information before such processing begins.

20. Data Protection Officer assessment and complaints

The controller has assessed whether appointment of a data protection officer is currently required under the applicable data protection rules. Based on the controller's present processing activities, a data protection officer has not been appointed. This assessment is reviewed when the nature, scope, context or purposes of processing materially change. Privacy and data protection enquiries may be sent to info@musen.live.

Where applicable data protection law gives you this right, you may lodge a complaint with the competent data protection authority in your habitual residence, place of work or place of the alleged infringement. This Policy does not restrict any complaint or redress right available under applicable law.

21. Changes to this Policy

This Policy may be updated when the Service, legal requirements, providers or processing practices change. Material changes will be communicated through the Service, website, email or another appropriate channel where required. An updated privacy policy is not treated as consent to a new processing activity where consent or another separate legal basis is required. Where renewed consent is necessary, it will be requested separately.

22. Relationship to other musen documents

This Privacy Policy governs personal data processing. The Terms govern the contractual relationship with users. The Content Rights Policy governs rights in music and other content. The Community and Broadcasting Guidelines govern participation and behavioural standards. The Security Policy describes security practices. Where a binding legal instrument governs a particular right or obligation, this Policy does not replace that instrument.

23. Contact information

• Privacy and data protection: info@musen.live
• General support: info@musen.live
• Security reports: admin@musen.live
• Controller: Fabio Senna, operating under the trading name musen
• Service address: 483 Green Lanes, N13 4BS, United Kingdom

© 2026 musen. All rights reserved.