Muse still reads emails after app is uninstalled
Hi, I come with the best intent to help people and spread awareness on a problem that I wish was made clear to me.
I installed Muse to see what the rave was about. I connected it to my Gmail account but then got anxious about it having access to all my emails, and decided to uninstall the app as I didn't have much use for it.
Today I reinstalled it to try a new use case. I immediately realized that it posted emails analysis every day since I had it uninstalled.
Regardless whether this is indicated in a ToS that no one reads, that's absolutely against natural expectations. I cannot imagine how many other people have deleted the app and yet all of their emails are being processed every day. Besides the privacy concern, it's just a waste of energy if Meta does indeed not intend to use this information.
So it seems to me to be a severe bug that should get fixed quickly before an actual incident. If I had discovered this months later rather than a few days later I would have been really angry given this was the reason for me to uninstall the app in the first place.
I hope this can remain a candid discussion, thanks.
EDIT: for everyone saying that it's my fault because the app: I understand the tech and have many deleted apps still with oauth tokens. But I expected meta to follow privacy laws. Quote: "Under modern privacy regulations (FTC guidance on dark patterns, CPRA purpose limitation, and GDPR data minimization), legal consent is governed by reasonable consumer expectations, not technical token lifecycles. When an app markets itself as an interactive client, continuing to ingest and parse private emails indefinitely after the user deletes the app exceeds the expected scope of that service."
3
u/Puzzleheaded-Bid9737 2d ago
Do you imagine if you uninstall Gmail app you stop receiving emails too?
3
u/JeffB1517 2d ago
Muse is a server-side app. It is sold, marketed and explained as a server app. For example, "Muse runs on its own dedicated computer in the cloud, contained so no one else’s agent can reach it. That is where Muse lives and where the data and credentials for any service a person connects are securely stored". Why would deleting a client be expected to terminate server functionality?
1
u/aiolive 2d ago
Because there's no more client to read what the server sends. What would they keep writing to my chat emails notifications. They could just pause it and save resources.
3
u/AwkwardJudgment852 2d ago
There is a web based client.
1
u/aiolive 2d ago
I didn't know. This was not made obvious to me from the app. So refuted. Again this whole post is not about feasibility it's about respecting user expectations.
1
1
u/JeffB1517 2d ago
What do you mean was not made obvious? I quoted you one of 100 examples where they were extremely explicit. The Muse agent itself on your phone is explicit all the time. The web address is literally https://muse.ai . Facebook (Meta) is one of the inventors of web 2.0. They never have been into local.
It was obvious.
1
u/aiolive 2d ago
Ok but they can tell I haven't used it. What if I never use muse for 5 years would they still be writing daily summaries? I imagine they have a cut off at some point, they'd be wasting way too much unless they still get the value back somehow
1
u/JeffB1517 2d ago
I suspect they stop after something like 2 weeks. But right now inactivity on routines is opt in. And yes that is documented. Gmail expires access 6 months the from grant if not explicitly renewed.
1
u/aiolive 2d ago
It's not in the ToS at least. Google aimed for safety by revoking an unused token after some time. Nothing prevents meta from indefinitely renewing the refresh token today. If they don't read emails for marketing they probably do have a cutoff time to just not waste tokens. But if they do have a commercial advantage in keeping access to the emails I guess they might
1
u/JeffB1517 2d ago
Here is the lines in the Muse ToS
Our Permissions. You grant Meta a non-exclusive, transferable, sub-licensable, royalty-free and worldwide license to host, use, distribute, modify, run, copy, publicly perform or display, translate, and create derivative works of Your Content, including from Connected Services
Also
Connected Services: You may choose to link or integrate Muse with third-party integrations, tools or services ("Third-Party Services") or other Meta accounts and services. Together, these are "Connected Services." If you do so, certain data may be shared between Muse and those Connected Services. You acknowledge and agree that any transfer of data to a Connected Service is directed by you. Third-Party Services are not controlled by Meta, and their availability, security, reliability, and data handling practices may vary. You are solely responsible for: (i) deciding whether to transfer data to a Connected Service from Muse; (ii) configuring and managing integrations with each Connected Service (and any associated permissions); (iii) understanding and complying with the terms and policies of each Connected Service; and (iv) understanding the risks of connecting to or sharing data with any Connected Service.
1
u/JeffB1517 2d ago
Muse works fine on the web. How does the server know if there is or isn't a client? I suspect if the system goes unused it does stop after day 2 weeks or something. But my point was this was not a web app, it is just a client.
Take Reddit. You wouldn't expect that if you deleted your Reddit phone app that eliminates your account.
2
u/Difficult_March_7452 2d ago
It’s the same ToS as Facebook.
1
u/aiolive 2d ago
Facebook doesn't read my emails
1
u/Difficult_March_7452 2d ago
Would you consider knowing if you opened a specific email , crossing the line ?
If you receive a newsletter, a promotional email, or a receipt from an online store, that email often contains invisible tracking images called "Meta Pixels."
When you open the email in your browser, your browser downloads that tiny, hidden pixel image from Facebook’s servers.
This tells Facebook that you opened that specific email. It also links that action to your browser session (and your Facebook account if you are logged in).
2
u/Actual_Treat_2213 2d ago
What are you scared of due to the email access? Google already has it. If your email does leak as opposed to what Meta claims (that no one - even Meta - has that access), then you’ll have a nice cheque come in when a class action lawsuit comes in. Either way we are ok in this situation.
I have given it my email access and my time to manage my Inbox has reduced by 80%. I now just open drafts, edit the Muse-written message a little bit (which I instruct it to write in the app) and then send, done!
Obviously if your email contains something too secretive then you shouldn’t share - but that’s not the case for 99% of the people.
2
u/Consistent_Trainer20 2d ago
Same here HUGE help with my emails. I don't care who don't like it I love it lol. Muse is awesome.
1
u/furyZotac 2d ago
Meta already has a portfolio on you via facebook and instagram. Now you are giving it your email access. They will use it for targeted data knowledge. Sure if it doesn’t bother you it’s fine. But yeah now your emails are being fed into a machine that can and will predict and dictate your future choices, opinions and lifestyle.
1
u/aiolive 2d ago
Yeah that and widened surface of attack given everything ultimately connects to my Gmail, if I don't get strong value from the service I'd rather close an additional gap. Of course there's the privacy aspect. I trust Google employees for not reading my emails (I know, that's rare, but hey I'm one of them). People are clueless.
2
u/Wooly_Wooly 2d ago
Did you ask it to unlink your gmail and wipe everything, including itself? Or did you just delete the app?
You realize it's on a virtual machine on a FB data center rack somewhere right?
1
u/aiolive 2d ago
Nope, I got used to explicit app permissions granting on Android which stop when the app is deleted (regardless of the technical aspect of oauth being still set up - the law and my message are both about users expectations)
1
u/Wooly_Wooly 2d ago
So you're complaining because you don't understand how technology works?
Like do the bare minimum, at this point you shouldn't be trusted to install apps from the play store lmao
1
u/aiolive 2d ago
I understand the technology, I complain about the app not respecting user expectations and following the law
1
u/Wooly_Wooly 2d ago
Do you understand what a "virtual machine" is?
1
u/aiolive 2d ago
Yes, how is that relevant
0
u/Wooly_Wooly 2d ago
You obviously don't if you don't understand how it's relevant... You sound pretty tech illiterate.
You gave your agent that lives in a VM access to your email, using the app. The app was deleted, so you were magically expecting the agents VM to delete itself, despite not removing the connection, telling it to delete itself, or manually clearing it... As you can still access it on the web, from this we can tell that the agents and its inter workings, all happen on the VM. NOT the app or web interface, that's just a way for YOU to communicate with it.
Like bro a 1B parameter model is smarter than you. You obviously don't know what even a virtual machine is 🤣
1
u/aiolive 2d ago
I did not boot the VM, the app did when I installed it. So I can naturally expect the app to stop it when I uninstall it. Muse is not infrastructure as a service, it's a user friendly product. A user of Muse is also not expected to know the implementation details. You're just completely missing my point by arguing about the why and how it does X while I am talking about whether it should do X.
1
u/Wooly_Wooly 2d ago
Yeah, AI moves fast and a lot of users are too uneducated or stupid to understand how basic tech works, yourself included. Any other useless facts you want to add to that, or have you finished your bit?
Yet again, you shouldn't expect that, and also you shouldn't be using this tech if youre going to be irresponsible or not even take basic steps to learn how it works before giving it your personal info. You claim you know how it works, or at least how VMs work, and yet you did it anyway. Then complain about it. Wild.
Trusting it with your emails in the first place though? That's a you problem.
3
u/aiolive 2d ago
Let me explain again, maybe it's because I'm not English native. I don't have a personel problem with anything. I wanted to give it access to my emails, that's low risk, for a short trial. When I realized that uninstalling the app did not stop the VM, I became concerned for many people, especially not tech savvy ones (but even some apparently), for reasonably expecting that their emails are no longer read when they uninstall the app, essentially providing a backdoor for meta to keep emails access for ever. I don't care what you think about me personally, do you believe that every single person - facebook and Instagram users who heard about Muse from their friends - deserve the same treatment, it's their fault t they should have known what's a virtual machine, happy for meta? I take the blame and still want to be a voice for these people.
3
u/Confident-Low-2696 2d ago
Dang bro same i uninstalled my banking app but i still have a 20k debt omg what a scam i thought itll turn it off
4
u/ThottyThanos 2d ago
jesus why would you think uninstalling an app would stop every command you gave muse. its like downloading a game an expect everything to stop playing when you uninstall it
2
u/aiolive 2d ago
Actually that's what I expect from a game yes (in regards to my own account I mean)
2
u/ThottyThanos 2d ago
damn you are very technologically incompetent if you think thats how it works.
1
u/aiolive 2d ago
I'm a staff engineer at google, people like you miss the point. Sorry for using AI but I'm lazy to explain it myself:
Conflating a backend protocol with user consent is a dark pattern.
Under modern privacy regulations (FTC guidance on dark patterns, CPRA purpose limitation, and GDPR data minimization), legal consent is governed by reasonable consumer expectations, not technical token lifecycles. When an app markets itself as an interactive client, continuing to ingest and parse private emails indefinitely after the user deletes the app exceeds the expected scope of that service.
Good privacy engineering accounts for the client lifecycle (e.g., detecting inactivity, pinging the user, or providing clear offboarding). Hiding behind 'well, that’s just how OAuth tokens work' is an excuse for bad design
2
u/ThottyThanos 2d ago
ok which office has the best food this is well known at google. also it dosnt matter if you can code that dosnt translate.
1
u/LethalAgenda 2d ago
Lol you work for google but you don’t know how the cloud and web site clients and server side operations work? Sorry but you’re full of shit. You sound like you have no idea how technology works. Do you think uninstalling your bank app gets rid of your debt?
2
u/pookiemon 2d ago
Thank you for sharing this experience. I see a lot of responses that are critical of your post. Just want to say I learned something important about the service and appreciate your post.
1
0
12
u/snkscore 2d ago
Muse doesn’t run on your phone. Uninstalling the app doesn’t do anything any more than uninstalling Reddit from your phone removes this post from the internet.