Privacy Policy

Muster is operated by Horbal Industries. For any privacy question or request, contact privacy@horbal.net. For UK/EU purposes, Horbal Industries is the data controller for the personal data described here.

• Account details— your email, display name, an optional title, your timezone, and (if you add it) a partner’s email for Spouse Awareness reminders.
• Calendar availability — when you connect a calendar, Muster reads free/busyby default: the time ranges you’re busy. If you choose to reviewa particular calendar to exclude certain events (for example, a family member’s shifts on a shared calendar), Muster reads that calendar’s event titles only so you can pick which ones to exclude. Only the titles of events you choose to exclude are kept (to remember your choices), and none of these titles are ever shown to other members — they only ever see your free/busy. Access credentials (OAuth tokens or app-specific passwords) are stored encrypted.
• Your activity — the fellowships you join, musters you post, times you mark, votes, RSVPs, comments, and any feedback you send us.
• Technical data — basic server logs (such as IP address and request metadata) needed to operate and secure the service.

To run the service: build availability heatmaps, schedule and send muster reminders and Spouse Awareness emails, sync ratified musters back to your own calendar at your request, keep your account secure, and respond to your feedback and support requests.

Where UK or EU data protection law applies, we rely on: performance of a contract (to provide the service you signed up for); our legitimate interests (to operate, secure, and improve Muster); and your consent where specifically requested (for example, the partner email you choose to provide for Spouse Awareness). You may withdraw consent at any time.

We do not sell your personal data or share it for advertising. We use a small set of service providers (processors) to run Muster:

• Amazon Web Services — hosting, database, and transactional email (Amazon SES).
• Google and Apple — only when you connect a calendar, and only to read your free/busy (or, for a calendar you choose to review, its event titles so you can exclude individual events) or write an event you confirm.

Spouse Awareness emails go to the partner address you provide. We may also disclose information where required by law.

Muster is hosted in the United States (AWS, us-east-1). If you are in the UK or EU, your data is transferred to the US under appropriate safeguards, such as the Standard Contractual Clauses.

We keep your information while your account is active. If you ask us to delete your account, we remove your personal data, except where we must retain limited records to comply with the law. Disconnecting a calendar removes its stored credentials.

UK & EU (GDPR): you have the right to access, correct, delete, restrict, or port your data, to object to certain processing, and to withdraw consent. You may also lodge a complaint with your local supervisory authority.

United States (incl. California):you have the right to know what we collect, to access and delete it, to correct it, and to not be discriminated against for exercising these rights. We do not sell or “share” personal information as those terms are defined under California law.

To exercise any right, email privacy@horbal.net. We’ll respond within the timeframe the applicable law requires.

Muster uses only strictly necessary cookies— the session cookie that keeps you signed in. We do not use advertising, analytics, or third-party tracking cookies. Because these cookies are essential to provide a service you requested, they don’t require consent under UK/EU rules, but we show a brief notice so you’re aware of them. If we ever add optional cookies, we’ll ask for your consent first.

We protect data in transit with HTTPS and encrypt sensitive credentials at rest. Access to systems is limited to what’s needed to operate Muster. No method of transmission or storage is perfectly secure, but we work to protect your information.

Muster is not directed to children. We do not knowingly collect personal data from anyone under 16 (or under 13 in the United States). If you believe a child has provided us data, contact us and we will delete it.

We may update this policy from time to time. We’ll revise the “last updated” date above and, for material changes, give notice in the app.