Version 2026-10-21 · last updated 21 October 2026
SKMB Software Ltd runs Muster and is the data controller for your personal data under UK data protection law (the UK GDPR and the Data Protection Act 2018). Contact: contact@musterchat.com.
| Data | Why | Lawful basis |
|---|---|---|
| Username, display name, email address, password (stored only as a salted hash), date of birth | To run your account, confirm your email, sign you in, keep under-16s off Muster and protect 16–17 year olds | Contract; legal obligation (Online Safety Act) |
| Two-factor sign-in, if you turn it on: the secret your authenticator app shares with us, and your recovery codes (stored only as hashes) | To check the codes when you sign in or make sensitive changes | Contract |
| The beta invitation key used to make your account (a record of which key, who it was issued for and when it was used; never the key itself) | Access is by invitation during the beta, so we can check who joined with which invitation | Legitimate interests (keeping Muster safe) |
| Profile picture, about me, banner colour, status | To show your profile to others | Contract |
| Encrypted messages and files | To deliver them. We hold them only in scrambled form and can't read them | Contract |
| Message metadata: which conversations and servers you're in, when messages were sent and edited, file sizes, reactions, poll votes, replies, server roles, blocks and notes | Needed to run chat, servers and moderation | Contract; legitimate interests (keeping Muster safe) |
| Encryption public keys for your devices | So others can encrypt messages to you | Contract |
| IP addresses and times when you sign up, log in or open Muster | Security, stopping abuse, and because the National Crime Agency asks for them in child-safety reports | Legitimate interests; legal obligation |
| Reports you send, and reports about you, including the reported messages and files | To deal with illegal and harmful content and meet our Online Safety Act duties | Legal obligation; legitimate interests |
| Moderation records (what we did and why) | Accountability, appeals and our legal duties | Legal obligation; legitimate interests |
| Shop orders, if you buy something: the items, price and token, your wallet address and the shop's, the transaction, when, and that you agreed the 14-day cancellation waiver (with the Terms version) | To deliver what you bought, check the payment, handle refunds, and keep our accounts | Contract; legal obligation (tax records) |
| Secret DM requests: who asked whom, whether it was accepted, declined or cancelled, whether the two authenticator codes matched, and when. Messages in a secret DM are encrypted like any other DM, and we still keep who is in it and when messages were sent. If either of you opens a locked secret DM on your own to report something, we note who opened it and when, and show that to our moderators with any report about it | To open a secret DM only when you both confirm, keep requests from reaching under-18s, and stop repeated asking | Contract; legitimate interests (keeping Muster safe) |
| Crypto wallet, if an admin has turned it on for you (adults only): the wallet address you link, the time you linked it, and for each payment sent in Muster its transaction hash, token, amount and the two wallet addresses | To show your balance and history, show payment cards in conversations and stop the same payment being shown twice. Your wallet's key and recovery phrase stay on your device: we never see them | Contract; legitimate interests (keeping payments honest) |
| Server logs (what the server did and any errors), with IP addresses and email addresses removed before they leave the server, and counts such as how many people are online | To find and fix faults and spot attacks | Legitimate interests |
Voice and video calls are end-to-end encrypted: your device encrypts your audio and video with a key that only the people in the call have. Calls pass through our own call server so participants can't see each other's IP addresses. The call server only moves encrypted audio and video and cannot listen to or watch it. We don't record or store calls.
Server logs, with IP and email addresses removed, and counts-only usage metrics are kept for up to 14 days with Grafana Labs (UK) so we can find and fix faults. Passwords, sign-in tokens and other credentials are removed from logs too.
While the wallet is on a test network, a wallet's public address is sent to a public block explorer (Blockscout) to show your transaction history. Wallet addresses and transactions are public on the blockchain.
Payments in the crypto wallet are recorded on a public blockchain. Anyone can see a transaction there (the two wallet addresses, the token and the amount), and nobody, including us, can change or delete it.
We use one cookie: a session cookie that keeps you signed in. It's strictly necessary, so we don't ask for consent. Muster also keeps small settings in your browser (for example, your recently used emoji, and the encryption key for that browser, which never leaves it). No advertising or tracking cookies.
Render stores data in the EU, which the UK recognises as giving adequate protection. Grafana Labs stores our logs in the UK, and our call server is in the UK. Alchemy and Resend are in the United States. Where a provider handles data outside the UK, we rely on the UK's approved safeguards.
| Data | How long |
|---|---|
| Your account and messages | Until you or we delete them |
| Sign-in IP addresses | 90 days |
| Reports and the content in them (closed reports) | 1 year after the report is closed |
| Reports referred to the National Crime Agency | Content and related data for 1 year after the referral; the NCA's reference number for 5 years (both required by the Online Safety (CSEA Content Reporting) Regulations 2026) |
| Server logs and counts (with IP and email addresses removed) | 14 days |
| Payment records in the wallet (transaction hash, token, amount, the two wallet addresses) | Kept while the wallet runs. When you delete your account, your account is removed from them. The transactions themselves are on the public blockchain for good |
| Push notification subscriptions (the address your browser's push service gave the device) | Until you turn notifications off on that device, sign out there, or delete your account |
| Shop orders | Unpaid orders are deleted after 22 hours. Paid orders are kept for as long as UK tax law requires (normally 6 years), even if you delete your account |
| Secret DM requests (who asked whom, the outcome and when) | 7 days after the request ends, or sooner if either account is deleted |
| When a locked secret DM was opened on one person's own to report something (who and when; the last 20) | As long as the secret DM exists |
| Locked-account support requests (the name you typed, your message and the email you gave) | 90 days after the request is closed |
| Backups | Copies on our server are overwritten within a few days. We also keep encrypted copies off the server, on our own computer in the UK; only we can open them, and each is replaced as newer ones are made (we keep the newest 10) |
You can delete your account yourself at any time: open Settings and choose Delete account. Your messages, direct messages, files and devices are deleted straight away.
You can also ask us for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, or to move it elsewhere. Email contact@musterchat.com. We'll reply within one month. Some data we must keep for legal reasons (for example, in an open child-safety referral). You can also complain to the Information Commissioner's Office at ico.org.uk.
Muster is for people aged 16 and over. We ask for a date of birth at sign-up. 16 and 17 year olds can only get new direct messages from adults they share a server with. If we learn that someone under 16 has an account, we close it.
We'll update this page when things change, and ask you to accept important changes in the app.
21 October 2026: Muster is now run by SKMB Software Ltd, a company registered in England and Wales, which took over from S. Kelly as the data controller. Your data stays where it was, is used for the same reasons and is kept for the same times.