What we receive about you, and the much longer list of what we do not.

Privacy Policy

Last updated: 2026-10-06

This policy says what ROCKETAPPS TECNOLOGIA LTDA, CNPJ 54.764.854/0001-73, at R. Bom Jesus, 178, Weissópolis, Pinhais — PR, CEP 83.322-050, Brasil (“RocketApps”, “we”) does with personal data when you use Muster or buy a licence for it. For that data, we are the controller.

The short version

Muster runs on your machine, and there is no account to create. We never receive your code, your files, your prompts or your agent transcripts — there is no server of ours that could hold them.

The personal data we do hold is what a sale and a licence need: your email address, your licence key, and a hashed identifier of each machine you activated on. That is the whole list.

What we receive, and why

When you buy

Purchases go through FastSpring, which is the merchant of record — the seller on your invoice. They collect what a sale requires (name, email, billing address, country, tax identification, payment details) under their own privacy policy, and we never see your card.

From them we receive your email address and the order and subscription identifiers. We store those to issue your licence, to renew it on the anniversary, and to find it again when you write to support.

When you activate the app

The app sends your licence key and a machine identifier, and receives a signed token back.

That identifier is a salted SHA-256 hash of a hardware identifier your operating system already exposes — IOPlatformUUID on macOS and MachineGuid on Windows. We do not receive the hardware identifier itself, and the hash does not read back to it. The salt means the same computer produces one value for Muster and a different one for anything else that hashes the same number.

Per activation we store the hash, the application name, the version, and the first and last date we saw it. It exists for one reason: to count the three machines your licence allows, and to let a reinstall not cost you one of them.

When the app checks for updates, and when you visit the site

Muster talks to exactly two addresses of ours: licenca.rocketapps.com.br to activate, and updates.rocketapps.com.br to look for a new version. Those requests, and visits to rocketmuster.com, leave the ordinary record any web server keeps — IP address, time, what was requested — handled by our hosting provider for delivery and for abuse prevention.

The site loads no third-party script, sets no cookie, and runs no analytics. It reads your browser language and time zone to decide which currency to show you, and that reading never leaves your browser.

When you write to us

We keep the message and our reply, so that the next person who answers you knows what was said.

What we never receive

• Your code, your files, your diffs, your commits.
• Your prompts, your agent transcripts, your session history.
• Your project names, paths, queue, roles or settings. They live in a database on your own computer.
• Telemetry, usage statistics, or crash reports. Muster sends none, and there is nothing to turn off.

What your agents send, they send to their own provider, on your own account, exactly as they would from your terminal. That traffic is covered by that provider's privacy policy, not by ours.

Why we are allowed to hold it

Under the LGPD (Lei 13.709/2018, art. 7) and, where it applies to you, the GDPR (art. 6):

• Performance of the contract — your email, licence key, machine hashes and order identifiers. Without them there is no licence to give you.
• Legal obligation — the commercial and tax record of the sale, for as long as Brazilian law requires it to be kept.
• Legitimate interest — server logs, for security and for noticing a key being shared far beyond three machines.

We do not sell personal data, we do not use it for advertising, and we do not profile you.

Who else touches it

• FastSpring, Inc. (United States) — payment, invoicing and tax, as merchant of record.
• Cloudflare, Inc. (United States) — the licence server and the update files.
• Our email provider, for support correspondence.

This means your data may be processed outside Brazil and outside the European Economic Area, under the contractual safeguards those providers offer, including standard contractual clauses.

How long we keep it

The licence record lives as long as the licence does, and then for the period Brazilian law requires of commercial and tax records. Activation rows are deleted with the licence they belong to. Support correspondence is kept for two years.

Your rights

You may ask us to confirm that we hold data about you, to show it to you, to correct it, to delete it, to hand it to you in a portable form, or to tell you who we shared it with (LGPD art. 18; GDPR arts. 15–21).

Write to contato@rocketapps.com.br. We answer within 15 days, in Portuguese or in English. If we cannot do what you asked, we will say why.

Deleting your data is not free of consequence, and we would rather say so here than surprise you: erasing the licence record ends the licence, because the record is the licence.

You may also complain to Brazil's data protection authority, the ANPD (gov.br/anpd), or, in the European Union, to your local supervisory authority.

Children

Muster is a tool for professional developers, and it is not directed at anyone under 18.

Changes to this policy

The version in force is the one published here, with the date at the top. If a change materially affects how we treat data we already hold, we will tell licence holders by email before it applies.

Talking to us

contato@rocketapps.com.br, in Portuguese or in English. The same address reaches the person responsible for data protection (encarregado, LGPD art. 41).