Meta Muse

The Privacy Policy states that AI training is opt-in by default with a toggle in Settings, and users can change this setting at any time. However, the setting is described as 'on when you first use Muse,' meaning training occurs unless the user actively disables it. While users can opt-out, the default-on configuration and the broad language in ToS Section 2.3 granting a license 'to improve AI at Meta' without explicit opt-out guarantees create moderate concern.

“[Privacy] 'You decide whether we can use your interactions with Muse to train and improve our AI models. This setting is on when you first use Muse. You can change it at any time using the toggle in your Settings under Data controls.'”

ToS Section 2.3 grants Meta a 'non-exclusive, transferable, sub-licensable, royalty-free and worldwide license to host, use, distribute, modify, run, copy, publicly perform or display, translate, and create derivative works of Your Content' for purposes including improving AI at Meta. This is a broad, sublicensable license that extends beyond merely providing the service and explicitly permits derivative works and sublicensing.

“[ToS] 'You grant Meta a non-exclusive, transferable, sub-licensable, royalty-free and worldwide license to host, use, distribute, modify, run, copy, publicly perform or display, translate, and create derivative works of Your Content... you further grant us a license to use it to improve AI at Meta'”

The Privacy Policy describes Connectors (third-party integrations) and states that Muse exchanges 'only the data that's needed' for them to work. However, the ToS Section 6 places responsibility entirely on the user for understanding third-party terms and managing permissions. No explicit DPA requirements or sub-processor list is mentioned. The scope of 'necessary' data is vague.

“[Privacy] 'We designed Muse to exchange with Connectors only the data that's needed for them to work for you' and [ToS] 'Third-Party Services are not controlled by Meta, and their availability, security, reliability, and data handling practices may vary. You are solely responsible for... understanding and complying with the terms and policies of each Third-Party Service.'”

The Privacy Policy states users can delete messages, chats, and files, and can reset Muse to delete all data. However, it explicitly notes that 'Muse may still remember information it learned from what you deleted' and data used for training may be retained (subject to the opt-out setting). No specific retention period is stated for backup data or training data that has been anonymized.

“[Privacy] 'You can delete any message you send to Muse... After you delete something, Muse may still remember information it learned from what you deleted' and no explicit retention limit stated for other data categories”

ToS Section 2.1 states 'You retain ownership of any intellectual property rights you have in content that you create or share with Muse.' However, Section 2.3 simultaneously grants Meta a broad, sublicensable license to create derivative works. The retention of ownership is undermined by the broad license grant, creating ambiguity about practical exclusivity.

“[ToS] 'You retain ownership of any intellectual property rights you have in content that you create or share with Muse' but 'You grant Meta a non-exclusive, transferable, sub-licensable... license to... create derivative works of Your Content'”

The Privacy Policy references the Meta Privacy Policy and mentions future 'Muse Confidential VM' for privacy, but provides no explicit certifications (SOC 2, ISO 27001, GDPR compliance, HIPAA) or published security practices. The ToS contains a broad liability waiver but no affirmative security commitments or third-party audit documentation.

“Not found in documents — scored conservatively. Privacy Policy references Meta Privacy Policy but no SOC 2, ISO 27001, GDPR compliance statement, or HIPAA certification is explicitly stated.”