This Cookie Policy explains what Muse Entertainment LLC (“Muse Entertainment”, “TourMuse”, “we”, “us”, “our”) stores on your device when you use TourMuse, why we store it, and how you can control it. It should be read together with the TourMuse Privacy Policy, which explains what we do with information more generally.
1. What this policy covers
TourMuse reaches you through four places, and they behave differently. This policy names each one because the technologies involved are not the same:
The TourMuse website —
tourmuse.app. An informational site with a waitlist sign-up page and a contact page for partners and investors. It is a set of static pages; there is no account and nothing to sign in to.The TourMuse web app —
app.tourmuse.app. The full TourMuse application running in your browser. You can sign in, buy and take Tours, and post to the Musing feed here. This is where almost everything described in this policy is stored.The TourMuse mobile apps — iOS and Android. These do not use browser cookies. They use comparable technologies, described in section 6.
These legal pages. The page you are reading is plain HTML with a stylesheet. It stores nothing, runs no scripts, and works with JavaScript disabled.
Throughout this policy, “cookies” is used loosely, as the law generally uses it, to mean cookies and the other ways a site or app can store information on, or read information from, your device — browser local storage, IndexedDB databases, service workers, cached files, and the identifiers a mobile SDK keeps. The rules that apply to cookies in the EEA and the UK apply to all of these, so we describe all of them here.
2. What these technologies are
A cookie is a small text file a website asks your browser to keep and send back on later visits. A first-party cookie is set by the site you are visiting; a third-party cookie is set by someone else whose content that site loads.
Browser storage — local storage, session storage and IndexedDB — does a similar job with more room. It stays on your device and is not automatically sent to a server, but it is still data kept on your equipment, so we treat it the same way here.
A service worker is a script your browser keeps and runs in the background, which is how a web app can receive a push notification while its tab is closed.
Mobile SDK identifiers and local storage are the equivalents inside an installed app: a signed-in session, a per-installation identifier, a push notification token, and cached files.
3. The categories we use
Strictly necessary. Without these, the Service does not work. They keep you signed in, remember which TourMuse environment you are connected to, hold your place in a Tour, and make purchases and bookings work. These cannot be switched off from within TourMuse, and no consent is required for them. You can still clear them through your browser — see section 9.
Security and anti-abuse. These confirm that a request is coming from a genuine copy of TourMuse and not from an automated script. They protect other people’s accounts, Creators’ paid content, and our infrastructure. We treat these as necessary; section 5 names the one that sets a third-party cookie so you can see exactly what it is.
Functional. These remember choices you make so you do not have to make them again.
Analytics. These tell us, in aggregate, which parts of TourMuse are used and where they fail.
Advertising and cross-site tracking — none. We do not use advertising cookies, advertising identifiers, ad-network pixels, or any technology whose purpose is to build a profile of you across other companies’ websites or apps. This matches the commitment in the Privacy Policy that we do not sell personal information and do not use it for cross-context behavioral advertising.
4. The TourMuse website (tourmuse.app)
The website sets no cookies of its own. There is no analytics tag, no advertising tag, and no session cookie, because the pages are static and there is nothing to keep track of between them.
The typefaces are served from our own site, so viewing a page requests nothing from anyone but us. One third party is involved:
| Who | Where | What it does | What it means for you |
|---|---|---|---|
| Flodesk | The waitlist page and the partners page only | Provides the waitlist sign-up form and the partner contact form | The form script keeps one small entry in your browser’s local storage for our site (_fdt_form_events) to operate the form and avoid showing you the form twice. Flodesk receives what you submit: your email address and, on the partners page, your name and the topics you tick. Flodesk’s own privacy notice governs what it does with it. |
If you never open the waitlist page or the partners page, Flodesk is never loaded.
5. The TourMuse web app (app.tourmuse.app)
This is the full application in a browser, so the list is longer. Nothing here is advertising.
| What | Category | Why | How long it lasts |
|---|---|---|---|
| Sign-in session (browser database) | Strictly necessary | Keeps you signed in between page loads and refreshes your session | Until you sign out or clear site data |
| Signing in with Google or Facebook | Strictly necessary | Our own sign-in domain (tourmuse.firebaseapp.com) sets no cookies. If you sign in with Google, Google sets its own cookies on its domains to keep you signed in to your Google account; Facebook does the same if you sign in with Facebook. Those belong to Google or Facebook, under their policies |
Set by Google or Facebook; typically six months to a year, plus what they keep under their own policies |
| App preferences and offline data (browser database) | Strictly necessary / functional | Your settings, which Tours you have saved for offline use, and how far through a Tour you are | Until you clear site data |
| App-check token and SDK heartbeat (browser database) | Security and anti-abuse | A short-lived token proving that requests come from a genuine copy of TourMuse, and a date stamp the Firebase software sends with requests so Google can see which versions are in use. Neither is your account and neither follows you to other sites | Until you clear site data |
reCAPTCHA (_GRECAPTCHA, set by Google) |
Security and anti-abuse | Confirms the app is genuine before our servers accept a request. This is a third-party cookie set on Google’s domain; reCAPTCHA also keeps a small amount of its own state in local storage for our app and for Google’s domain | Up to six months, set by Google |
| Google Maps | Strictly necessary for maps | Draws maps and finds places. Google receives your IP address and may store information on your device under its own policies | Set by Google |
| Push notification service worker and token | Functional | Not currently enabled in the browser: the web app does not register for push today. If we enable it, a service worker, a token and an installation identifier are created only after you grant notification permission | Until you revoke notification permission or clear site data |
| Cached application files | Strictly necessary | The app’s own code and images, kept in your browser’s ordinary cache so pages load quickly | Until your browser evicts them or you clear site data |
There is no analytics in the web app. The usage analytics described in section 6 runs on iOS and Android only; it is not enabled in the browser.
6. The TourMuse mobile apps
The mobile apps do not use browser cookies. They use these equivalents:
Sign-in tokens and local storage — keep you signed in and hold your preferences, offline Tours and Tour progress on your device.
A per-installation identifier — identifies this installation of the app, not you, and is used for push notification routing and app attestation.
Device attestation — Apple’s App Attest and Google Play Integrity confirm to our servers that the app is a genuine, unmodified copy. This is the mobile equivalent of the reCAPTCHA check in section 5.
Push notification tokens — created if you allow notifications, so we can deliver the notifications you have opted into.
Usage analytics and crash reporting — tell us which features are used and where the app crashes. Analytics events and crash reports are tied to a per-installation identifier and, while you are signed in, to your account.
Cached and downloaded Tour content — Tours you download for offline use are stored on your device in encrypted form.
Device permissions are not cookies. Location, camera, microphone, photos and notifications are permissions you grant to the app through your operating system. We describe how we use them in the Privacy Policy; you control them in your device settings, as described in section 9. Precise location is never used for advertising.
7. Third parties
These are the only third parties that can set or read information on your device through TourMuse. Each acts under its own privacy notice for this purpose:
- Google — reCAPTCHA (security), Maps, push notification delivery, sign-in if you use a Google account, and mobile analytics and crash reporting.
- Apple — device attestation and sign-in if you use an Apple account, on iOS.
- Meta (Facebook) — only if you choose to sign in with Facebook, and only during that sign-in.
- Flodesk — only on the waitlist and partners pages of
tourmuse.app.
We do not permit any of them to use what they collect through TourMuse to target advertising at you.
8. How long things last
Where a duration is known, it is given in the tables above. As a general rule:
- Browser storage in the web app lasts until you sign out or clear the site’s data. It has no fixed expiry, because it is what makes the app usable across visits.
- Third-party cookies last for the period that third party sets. For the Google reCAPTCHA cookie, Google currently documents six months.
- Mobile identifiers last until you delete the app or reset your device’s advertising and installation identifiers.
Deleting your TourMuse account does not by itself clear what is stored in your browser or on your device. Clear it as described in section 9.
9. Your choices
9.1 What currently requires your consent
Everything described in sections 4, 5 and 6 is either necessary to make TourMuse work or necessary to keep it secure, with two exceptions you control directly: push notifications, which do nothing unless you grant notification permission, and the Flodesk forms, which load only if you open the waitlist page or the partners page. We do not currently run any advertising or cross-site tracking technology, which is why you are not asked to make a cookie choice on arrival.
If that changes — if we add analytics to the website or the web app, or anything that is not necessary — we will ask for your consent first, where the law requires it, and we will update this policy before we do.
9.2 Browser controls
Every major browser lets you see, block and delete cookies and site data:
- Chrome — Settings → Privacy and security → Third-party cookies, and → Site settings → View permissions and data stored across sites
- Safari — Settings → Privacy, and Settings → Advanced → Website Data
- Firefox — Settings → Privacy & Security → Cookies and Site Data
- Edge — Settings → Cookies and site permissions
Clearing site data for the web app signs you out and removes anything saved for offline use, including downloaded Tours and your position in a Tour you have started. Your account, purchases and Tickets are held on our servers and are not affected. Blocking cookies and storage for the web app altogether will prevent it from working; you will not be able to sign in.
9.3 Blocking scripts
The security check in section 5 loads from Google. If a content blocker or a strict privacy mode prevents it from loading, TourMuse is built to carry on without it rather than lock you out, but some requests may be refused.
9.4 Device permissions
You can change TourMuse’s permissions at any time:
- iOS — Settings → TourMuse
- Android — Settings → Apps → TourMuse → Permissions
Turning off a permission disables the features that need it. Turning off location disables in-person Tour guidance and location-verified achievements; turning off the camera disables Quest verification. You can still use TourMuse, including virtual Tours.
9.5 Analytics and push
- Mobile analytics — you can limit ad and analytics identifiers in your device settings: iOS → Settings → Privacy & Security → Tracking, and Android → Settings → Privacy → Ads.
- Push notifications — revoke notification permission in your device or browser settings, or turn individual notification types off in TourMuse.
9.6 Asking us
If you want to know what is stored about you, or want it deleted, write to privacy@tourmuse.app. Section 9 of the Privacy Policy describes your rights and how we handle a request.
10. Do Not Track and Global Privacy Control
Some browsers send a “Do Not Track” signal. There is no agreed standard for what a site should do with it, and we do not act on it.
Some browsers and extensions send a Global Privacy Control signal, which several US state privacy laws treat as a valid request to opt out of the sale or sharing of personal information and of targeted advertising. We do not sell or share personal information and we do not use targeted advertising, so there is nothing for the signal to switch off. Nothing on TourMuse is turned on by ignoring it. We do still recognize the signal: when your browser sends it, the web app records that on your account, attaches no analytics identity to your session, and tells you so under Settings → Legal.
11. Children
TourMuse is not directed to anyone under 13. We do not use cookies or similar technologies to build advertising profiles of anyone, and we do not use them to profile minors. For a user under 18 no analytics identifier is attached to the account and analytics collection is switched off. See section 13 of the Privacy Policy.
12. Changes to this policy
We may update this Cookie Policy when our practices, the Service, or the law change. The version number and effective date at the top of this page identify the revision in force. If a change means we start storing something that requires your consent, we will ask for it before the change takes effect rather than rely on this notice.
13. Contact
Questions about this Cookie Policy, or about anything stored on your device by TourMuse:
Muse Entertainment LLC
16192 Coastal Highway, Lewes, DE 19958
Email: privacy@tourmuse.app
14. Language
This policy is published in English. Any translation is provided for convenience only; if a translation differs from the English text, the English version governs.