---
title: Muse privacy, memory and permissions: the complete setup
description: One page for the whole safety story: the settings to change first, the four permission layers, what Muse remembers vs what Meta trains on, the Soul/Memory/Identity files, why it forgets mid-task, and how to delete your data.
image: https://getmusehelp.com/og.png
source: https://getmusehelp.com/muse-privacy-and-memory/
---

Deep dive · Privacy & safety

# Muse privacy, memory and permissions: the complete setup.

Muse gets personal on purpose — it remembers your chats, your goals and what your apps told it. That memory, what Meta's models learn from you, and what the agent may *do* are three separate things with three separate controls. This page is the whole setup, in the order to do it.

In short

- Do this first: **Settings → Data controls → toggle off “Help improve our AI models”.** It is on by default. That stops your chats training Meta's models — it does not delete your Muse's memory, and it does not stop your chats going to Meta's cloud to run the service.
- Second: **every write action to “allow once”** — send, purchase, share, delete, post. Almost every reported incident traces to a careless “always allow”.
- Third: **connect one app, read-only.** A privacy setting cannot protect a connection you granted on day one.
- Your Muse's memory and Meta's model training are different buttons. Forgetting is the Forget skill or Reset; training is the toggle above.
- Long chats make every agent lose the thread — fresh chat, small steps, restate the goal. Not a bug, a limit.

## The five settings, in order

- 1**Settings → Data controls → “Help improve our AI models” → OFF.** The single highest-value toggle. This is what stops your prompts becoming training data. Restart the app afterward and confirm it stuck — defaults have reset after updates before.
- 2**Settings → Connectors → disconnect what you are not using.** Fewer connections, smaller blast radius. Add back only when a task demands it.
- 3**Settings → Permissions → every write action to “allow once”.** The permission layers are below.
- 4**Check how payments are stored.** Meta has said card numbers can be held as one-time tokens via Link, and that a credential store (1Password-style) is coming. Prefer tokenised cards; never paste a full card number into a chat.
- 5**Read the audit trail once.** Settings → Permissions → history. You want to see what you expected to see before anything else is connected.

Paste into Muse after setup

Before we start: list every setting and connected source you can currently reach, quote my Data Controls status back to me, and do not touch anything until I confirm.

**Copy prompt

## Permissions: the four layers

Permissions are the whole safety story. Muse has four separate layers, and people who only check one get surprised by a different one. The failure mode people report — “I told it not to and it did anyway” — is almost always a Layer 2 or Layer 3 problem they assumed a Layer 1 setting covered.Layer 1 · ConnectionsSettings → Connectors.** Which systems Muse can reach at all: Gmail, Google Docs, files, calendar, health services, music. Revoke from here. If you did not connect it today, it should not be listed tomorrow.

Layer 2 · Action approvals

Per-action prompts — **allow once / always allow / deny**. This is the layer that actually decides whether an email leaves your outbox. Almost every incident traces back to a careless “always allow” here.

Layer 3 · The Feed

Ambient context — updates, reminders, things Muse noticed. It draws on connected sources and behaves less like a folder you opened and more like something reading over your shoulder. Launch-week users on Hacker News and Reddit described the Feed surfacing email content they had not explicitly asked it to read, and a separate report of Muse ignoring a mid-task “deny”. Meta's position is that conversational context is not sold to advertisers and permissions are user-controlled — both can be true while the Feed's reading scope is broader than the connector list you checked. Inspect every source the Feed claims, disconnect anything untraceable, and re-test with one connector at a time.

Layer 4 · Permissions & trail

**Settings → Permissions.** The overview plus the history of what the agent did. This is your only after-the-fact evidence. If you never open it, you cannot tell a working agent from a misbehaving one.

### Allow once, always allow, deny — choose deliberately

Allow once

The correct default for everything that writes. Costs you one tap, buys you a full review of every send. Use this for a month before you even consider “always”.

Always allow

Grant this **narrowly** — one action, one connector, after you have watched it succeed safely 10+ times. Never for: send email, make purchases, share files, delete anything, post publicly.

Deny

Reach for this more often than feels natural. An agent that cannot do something is not a limited agent — it is a predictable one. You can always re-enable it later.

**The rule:** grant “always” for *reading* after the connector has proven useful, and keep *writing* on “allow once” indefinitely. Reading is recoverable; a sent email is not.

### Red flags a permission prompt should never show

- **A password field.** Muse never needs a third-party password — connectors use OAuth handoffs.
- **“Read all email, forever, silently”** asked for at install time rather than when the task needs it.
- **A purchase approval you did not initiate.** Any spend that arrives without you asking for a spend should be denied and reported.
- **Approval dialogs that appear after the action already ran** — approval has to be a gate, not a receipt.
- **Any prompt asking for your Meta password, a login code, or a screenshot of your Settings.** Meta support does not ask for these.

If you see any of these, deny, disconnect, and read [troubleshoot](/troubleshoot/). Then come back and finish the setup.

## Memory vs training: two different buttons

**Memory** lives in your Muse: chat history, goals, and what connected apps revealed. It makes the agent useful — the tenth errand starts where the ninth left off. **Training** is Meta reusing interactions to improve its AI models. They are separate things with separate controls.

1 · Chat memory

Muse remembers what matters across conversations — preferences, people, ongoing jobs — without being re-told. Ask it what it remembers about you any time; you can inspect the stored notes (Meta documents a Memory file) and tell it to forget specific topics or people with the Forget skill.

2 · Goals and feed

Tell Muse a goal and it works toward it unprompted: nudges, suggestions, a daily feed built from your conversations. Delete the goal and the nudging stops. How proactive it feels also comes from its system files — see below.

3 · Connected apps

Every connector widens what Muse knows: inbox contents, calendar, spending, health data. Memory plus connectors is where the real exposure sits. Review them in [the connector list](/connectors/).

4 · The nuclear option

Settings → Data controls → Reset Muse “permanently delete[s] all information including chat history, files and active tasks,” per Meta. Use it when handing the account to someone else, or when you want a genuinely fresh start.

### The training toggle, exactly

Three steps: Settings → Data controls → "Help improve our AI models" off, then restart and confirm it stuck. Meta states the off switch also covers previous interactions and connected-app info — and that even with training on, it strips names, emails, phone numbers and Social Security numbers and disassociates interactions from your account. That is Meta's claim, not something we can audit from outside.

Meta states

- Off means your interactions are not used to develop and improve AI at Meta — including info from connectors.
- The change also applies to previous interactions.
- Conversations are not shared with advertising systems.

Still true with it off

- Your chats still go to Meta's cloud — that is how a cloud agent answers. The toggle governs training, not operation.
- Your Muse still remembers you. Forgetting is the Forget skill or Reset, not this toggle.
- Meta staff access for running, supporting and securing the service is a separate matter. The user-key-encrypted Confidential VM is meant to close even that gap, but it is still in limited testing.

Do this in your first 60 seconds, not your ninetieth day: the earlier it is off, the less history the question even covers.

## The system files: Soul, Memory, Identity

If your Muse only answers when asked, that is not a broken setting — it is a missing instruction. Muse's behavior lives in plain-text files it reads every conversation, plus the goals you give it. Meta documents all three as editable: open them from the Assistant icon (your Muse's avatar), then Identity. You can also ask in chat to make the change — but always inspect the saved file afterward.

Soul

**Holds:** core truths, boundaries, personality, communication rules. **Path:** Assistant icon → Identity → Soul. **Change when:** you want it to talk differently, report differently, or act without being asked twice. This is where proactivity instructions go.

Memory

**Holds:** what it learned: preferences, people, ongoing jobs. **Path:** Assistant icon → Identity → Memory. **Change when:** it keeps acting on something wrong, stale, or you never said.

Identity

**Holds:** name, creature, vibe, tagline. **Path:** Assistant icon → Identity → Edit. **Change when:** you want a different name or feel.

### Make it proactive, step by step

- 1Open Soul: Assistant icon → Identity → Soul. Or ask in chat to change it — then inspect the saved file either way.
- 2Append your own headed section at the end. Do not replace the existing core truths — your block sits alongside them, easy to find and easy to delete. Keep a backup of anything you change.
- 3Reopen Soul and confirm your block saved word for word. If it didn't, the edit didn't happen, whatever the chat said.
- 4Test it in a fresh conversation: give Muse a task it would normally wait on, and check it acts without being asked twice. A greeting alone proves nothing.

Try it — paste into Soul

## How I want you to work**Be proactive: when I give you a goal, work on it without waiting to be asked, and report back with what you did and what needs my approval. Check my goals each morning and tell me only if something changed. Never send, post, or spend without asking.Copy blockWhat you'll get: a Muse that works its goals and reports back, instead of one that waits for the next message. Proactivity = Soul instructions + a goal.About AGENTS.md and PROACTIVE_PREFERENCES.md:** those names come from the DIY agent world Muse borrowed ideas from. Meta's documented files for Muse are Soul, Memory and Identity. If a tutorial tells you to create an AGENTS.md for Meta Muse, that is not Meta's documented path. And editing files will not add capabilities, bypass approvals, or fix a region block — Soul changes how Muse behaves, not what it can reach.

## Why Muse sometimes forgets things or stops halfway

This is not a Muse bug. Every AI agent built on a large language model works this way: it can only keep so much in mind at once. Everything Muse is working with — your messages, what it already did, files you shared, pages it read — sits in one workspace called its context. Think of it like a desk: there is only so much room.

Bloat

Every message and tool result adds paper to the desk. The newest sits on top; your original instructions end up buried at the bottom, out of attention's reach. That is why it can agree to your rules at the start and drift away from them by step ten.

Rot

When the desk overflows, Muse compresses the older parts into summaries. Summaries keep the gist and drop the specifics — names, numbers, conditions. The next step then works from the fuzzy version.

Stopping halfway

Big jobs mean more steps to hold and more paper on the desk. Eventually the chain gets too long to hold together — it stops not because it gave up, but because it lost the thread.

### What actually helps

- 1Start a fresh chat for a new task. A clean desk beats a crowded one.
- 2Break big jobs into smaller ones, and check each part before moving on.
- 3Restate the important bits — the goal, the must-nots — when the chat gets long.
- 4Ask Muse to show its work: "show me the file" beats "did you do it?"
- 5Keep approvals on, so nothing important happens without your say-so.

Muse does remember some things between chats — facts you asked it to save — but the working memory of a single conversation is separate, and it does not last forever. Fresh chat, small steps, check the receipts: that is the whole trick.

## Launch-week security reports you should know

Three stories broke around the September 2026 launch. None of them mean “don’t use it” — all three mean “update and don’t click”. Dates are as reported; re-check current status before acting.

1 · macOS zero-day

Security researcher Patrick Wardle (Objective-See) reported a zero-day in the launch-day Mac app; Meta shipped a hotfix within hours. **Do this:** keep the Mac client updated, install from the official source only, and if you do not need the desktop app, use the iOS or web client until you have confirmed a patch.

2 · The ClickFix hijack

A social-engineering campaign imitated Muse to get victims to paste a command into their own terminal. **Do this:** never run instructions that arrived in a DM, ad, or “Muse support” message. Muse does not ask you to open Terminal.

3 · The Messages dispute

A widely shared report on September 30 described Muse acting on an old Messages instruction and contacting a contact unexpectedly. **Do this:** keep Messages and any sending connector on “allow once”, and inspect the audit trail after any task that touches your inbox or message history.

## Handling something sensitive: email, money, health

Email & files

Connect read-only. Draft, never send. Scope the query — “last 20 unread” beats “summarise my whole inbox”. Start with [Gmail setup](/connectors/gmail/).

Money

Never type a full card number into a chat. Use a tokenised card or a one-time number where offered, and keep purchase approval on “allow once”. See [bank connection](/connectors/plaid/).

Health

Health connectors are the most sensitive grant on the list. Connect one service, read-only, and check the trail before connecting a second. Start from [the connector list](/connectors/).

The pattern is identical across all three: read-only, scoped, approved, audited. If you cannot say what would happen if the agent misunderstood, you are not ready to connect it.

## Delete my data / delete my account

There is no single “delete my Muse account” button. Meta gives you three levels, and they do very different things.

- 1**Delete one thing.** A message: tap and hold it, tap Delete, confirm. A side chat: in the Chats tab, tap the three-dot menu on the chat, tap Delete. What Muse remembers about you: Assistant icon → Identity → Memory, and edit the file directly. Identity works the same way: Assistant icon → Identity → Edit.
- 2**Reset Muse — the true wipe.** Settings → Data Controls → Reset, then follow the on-screen instructions. This permanently deletes all information: chat history, files, and active tasks. It cannot be undone. Download a copy of your data first (Settings → Data Controls → download your Muse information), and cancel any paid subscription separately — resetting does not cancel billing.
- 3**Delete your Meta account — the only way to remove Muse completely.** There is no way to delete Muse on its own. Deleting your Meta account in Accounts Center deletes everything associated with it, including Muse — and Facebook and Instagram along with it. Export first: Accounts Center → Your information and permissions → Export your information.

**The honest caveat, in Meta's own words:** “After you delete something, Muse may still remember information it learned from what you deleted.” Deleting removes the record; it does not guarantee Muse forgets what it learned. If that matters to you, turn off “Help improve our AI models” first — that toggle covers past chats too — and only then delete.

Deleting the app from your phone does none of this. Your Muse data lives in its cloud virtual machine, not on your phone — uninstalling leaves everything intact. Reset in Data Controls is the only action that permanently deletes it.

## For businesses: the policy to write before rollout

Individual opt-outs do not compose into an organisation policy. Written down, one page, agreed before anyone installs anything:

- **Scope.** Which accounts and which connectors a given team may attach. Default answer: none, until requested.
- **Write policy.** No outbound email, message, purchase, or share on “always allow”. Approval required, every time, logged.
- **Data classes.** What must never enter a prompt — credentials, health data, customer PII, financial account numbers.
- **Privacy defaults.** Model-training opt-out set on every account — then verify by opening Settings on a second machine, because defaults reset with some updates.
- **Review cadence.** Someone opens the audit trail weekly and reconciles it. Named owner, not a group.
- **Offboarding.** Connectors revoked the day someone leaves or changes role.

We write this with you in one session — [request a session](/book-setup/).

## Privacy, memory and permissions: questions

How do I stop Meta training on my chats?Settings → Data controls → toggle off “Help improve our AI models” and confirm. It is on by default. Restart the app and re-check, since defaults have reset after updates. Meta states the change also applies to previous interactions — that is Meta’s claim, not something we can audit from outside.

If training is off, does Meta still see my data?Yes, to run the service: your prompts go to Meta’s cloud so the agent can answer, and staff access for operation, support and security is separate from training. The toggle stops model training, nothing more. The encrypted Confidential VM is designed to go further but remains in limited testing.

What is the difference between Forget, Reset and the training toggle?Forget removes specific memories from your Muse. Reset wipes your Muse’s history, files and tasks. The training toggle stops Meta reusing interactions to improve its models. Three buttons, three jobs — most people want all three set.

Should I pick “always allow” to stop the prompts?Only for narrow reads you have already watched succeed repeatedly. Keep every send, purchase, share, delete, and post on “allow once” — that single habit prevents most incidents.

Muse read something I did not tell it to. Is that normal?The Feed draws on connected sources with a broader scope than the connector list, and launch-week users reported exactly this. Inspect the Feed’s sources, disconnect anything untraceable, and re-test with one connector at a time.

Does Muse need my Gmail password?No. Connectors go through the provider’s own OAuth screen, so Muse never sees the password. If anything asks you for a third-party password directly, deny it.

How do I edit Soul, Memory or Identity?Tap the Assistant icon, then Identity, then the file — edit directly, or ask in chat and inspect the saved file afterward. Add your own headed section at the end of Soul; do not replace the existing core truths. Back up anything you change; Reset is not an undo.

Why did Muse say it did something it didn’t?Usually context rot: the summary of the work said the step was done, and Muse reported the summary instead of checking the result. Asking it to show the actual file, page, or record is the check that catches it.

How do I see what Muse did with my data?Settings → Permissions shows connections plus the activity trail. Review it after any task that touched your inbox, files, spending, or health data — an unreviewed agent is an unmonitored one.

Should I put my card in Muse?Never paste a full card number into a chat. Use a tokenised card or a one-time number where the app offers one, and keep purchase approvals on “allow once”.

```json
{"@context":"https://schema.org","@graph":[{"@type":"WebSite","@id":"https://getmusehelp.com/#website","url":"https://getmusehelp.com/","name":"GetMuseHelp","description":"Task-first setup help for Meta's Muse personal AI agent.","inLanguage":"en","publisher":{"@id":"https://getmusehelp.com/#org"}},{"@type":"Organization","@id":"https://getmusehelp.com/#org","name":"GetMuseHelp","url":"https://getmusehelp.com/","logo":{"@type":"ImageObject","url":"https://getmusehelp.com/og.png","width":1200,"height":630},"description":"Independent, task-first help hub for Meta's Muse personal AI agent.","sameAs":["https://www.youtube.com/@rajpatel9987"]},{"@type":"Person","@id":"https://getmusehelp.com/#raj-patel","name":"Raj Patel","url":"https://getmusehelp.com/about/","description":"Raj Patel runs GetMuseHelp, an independent, plain-language guide to Meta’s Muse personal agent for everyday people and small business owners."},{"@type":"WebPage","@id":"https://getmusehelp.com/muse-privacy-and-memory/#webpage","url":"https://getmusehelp.com/muse-privacy-and-memory/","name":"Muse privacy, memory and permissions: the complete setup","description":"One page for the whole safety story: the settings to change first, the four permission layers, what Muse remembers vs what Meta trains on, the Soul/Memory/Identity files, why it forgets mid-task, and how to delete your data.","isPartOf":{"@id":"https://getmusehelp.com/#website"},"breadcrumb":{"@id":"https://getmusehelp.com/muse-privacy-and-memory/#breadcrumb"},"inLanguage":"en","datePublished":"2026-11-14T00:00:00.000Z","dateModified":"2026-11-14T00:00:00.000Z","citation":["https://www.meta.com/help/artificial-intelligence/1331373868832401/","https://www.meta.com/help/artificial-intelligence/2225571704857152/","https://www.meta.com/help/artificial-intelligence/1047255454427887/","https://www.meta.com/help/superintelligence/995796179982326/","https://muse.ai/privacy","https://objective-see.org/"]},{"@type":"BreadcrumbList","@id":"https://getmusehelp.com/muse-privacy-and-memory/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://getmusehelp.com/"},{"@type":"ListItem","position":2,"name":"Privacy and memory","item":"https://getmusehelp.com/muse-privacy-and-memory/"}]},{"@type":"HowTo","@id":"https://getmusehelp.com/muse-privacy-and-memory/#howto","name":"Lock down Muse privacy in five minutes","description":"Turn off model training, set every write action to allow-once, connect one app read-only, and check the audit trail.","totalTime":"PT5M","step":[{"@type":"HowToStep","position":1,"name":"Turn off model training","text":"Settings → Data controls → toggle off “Help improve our AI models” and confirm. Restart the app and re-check.","url":"https://getmusehelp.com/muse-privacy-and-memory/"},{"@type":"HowToStep","position":2,"name":"Set write actions to allow once","text":"Settings → Permissions → every send, purchase, share and delete set to ask every time.","url":"https://getmusehelp.com/muse-privacy-and-memory/"},{"@type":"HowToStep","position":3,"name":"Connect one app read-only","text":"Connect a single connector, read-only. Add the next only when a task needs it.","url":"https://getmusehelp.com/muse-privacy-and-memory/"},{"@type":"HowToStep","position":4,"name":"Read the audit trail","text":"Settings → Permissions → history. Confirm the recorded actions match what you expected.","url":"https://getmusehelp.com/muse-privacy-and-memory/"}]}]}
{"@context":"https://schema.org","@type":"FAQPage","@id":"https://getmusehelp.com/muse-privacy-and-memory/#faq","mainEntity":[{"@type":"Question","name":"How do I stop Meta training on my chats?","acceptedAnswer":{"@type":"Answer","text":"Settings → Data controls → toggle off “Help improve our AI models” and confirm. It is on by default. Restart the app and re-check, since defaults have reset after updates. Meta states the change also applies to previous interactions — that is Meta’s claim, not something we can audit from outside."}},{"@type":"Question","name":"If training is off, does Meta still see my data?","acceptedAnswer":{"@type":"Answer","text":"Yes, to run the service: your prompts go to Meta’s cloud so the agent can answer, and staff access for operation, support and security is separate from training. The toggle stops model training, nothing more. The encrypted Confidential VM is designed to go further but remains in limited testing."}},{"@type":"Question","name":"What is the difference between Forget, Reset and the training toggle?","acceptedAnswer":{"@type":"Answer","text":"Forget removes specific memories from your Muse. Reset wipes your Muse’s history, files and tasks. The training toggle stops Meta reusing interactions to improve its models. Three buttons, three jobs — most people want all three set."}},{"@type":"Question","name":"Should I pick “always allow” to stop the prompts?","acceptedAnswer":{"@type":"Answer","text":"Only for narrow reads you have already watched succeed repeatedly. Keep every send, purchase, share, delete, and post on “allow once” — that single habit prevents most incidents."}},{"@type":"Question","name":"Muse read something I did not tell it to. Is that normal?","acceptedAnswer":{"@type":"Answer","text":"The Feed draws on connected sources with a broader scope than the connector list, and launch-week users reported exactly this. Inspect the Feed’s sources, disconnect anything untraceable, and re-test with one connector at a time."}},{"@type":"Question","name":"Does Muse need my Gmail password?","acceptedAnswer":{"@type":"Answer","text":"No. Connectors go through the provider’s own OAuth screen, so Muse never sees the password. If anything asks you for a third-party password directly, deny it."}},{"@type":"Question","name":"How do I edit Soul, Memory or Identity?","acceptedAnswer":{"@type":"Answer","text":"Tap the Assistant icon, then Identity, then the file — edit directly, or ask in chat and inspect the saved file afterward. Add your own headed section at the end of Soul; do not replace the existing core truths. Back up anything you change; Reset is not an undo."}},{"@type":"Question","name":"Why did Muse say it did something it didn’t?","acceptedAnswer":{"@type":"Answer","text":"Usually context rot: the summary of the work said the step was done, and Muse reported the summary instead of checking the result. Asking it to show the actual file, page, or record is the check that catches it."}},{"@type":"Question","name":"How do I see what Muse did with my data?","acceptedAnswer":{"@type":"Answer","text":"Settings → Permissions shows connections plus the activity trail. Review it after any task that touched your inbox, files, spending, or health data — an unreviewed agent is an unmonitored one."}},{"@type":"Question","name":"Should I put my card in Muse?","acceptedAnswer":{"@type":"Answer","text":"Never paste a full card number into a chat. Use a tokenised card or a one-time number where the app offers one, and keep purchase approvals on “allow once”."}}]}
```