Last updated: 6 September 2026
Muster is a macOS app that syncs your contacts between address books you choose. This page says what it does with your data, including data it gets from Google.
The short version
Your contacts stay on your Mac and go to the address books you configure. They are never sent to me, and there is no third party involved in the sync. I operate no server and hold no copy of anything.
What Muster stores, and where
Everything lives in one folder on your Mac:
~/Library/Application Support/contact-manager/store
It is a git repository, so every change is a commit with a readable history.
Field values are encrypted at rest using a key that never leaves your Mac’s Keychain. Names, addresses, phone numbers, notes and photos are ciphertext on disk. Field names stay readable so the history is diffable.
Credentials and access tokens are held in the macOS Keychain, never in the store and never in a configuration file.
Google data
If you connect a Google account, Muster asks for one scope:
https://www.googleapis.com/auth/carddav
Why it needs it. That scope is how Muster reads your Google contacts and writes changes back to them, using Google’s CardDAV endpoint. There is no narrower scope that allows two-way contact sync.
What it accesses. The contacts in your Google account: names, phone numbers, email addresses, postal addresses, organisations, notes, birthdays and photos.
What it does with them. Reads them into the store on your Mac, compares them with what the store holds, and writes back the changes you approve. Nothing is pushed to Google until you have read the dry run and pressed Apply.
How it stores them. Encrypted at rest in the store described above, on your Mac only.
Who it shares them with. Nobody. Google data is not sent to me, is not sent to any analytics or logging service, and is not sent to any other company. It goes to the other address books you have configured only if you route those contacts there yourself.
How long it keeps them. Until you delete them. Removing a contact in Muster removes it from the store and, on the next sync you approve, from the servers that hold it. Deleting the store folder deletes everything.
Sign-in. Muster uses OAuth. Your Google password is never typed into the app and never seen by it. The sign-in happens in your browser, on Google’s own page. The refresh token is kept in the macOS Keychain.
Revoking access. Go to myaccount.google.com/permissions and remove Muster. You can also remove the account inside the app, which deletes the stored token.
Muster’s use of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements.
Other accounts
The same rules apply to every other address book: Apple iCloud, Microsoft, Nextcloud, mailbox.org, Zoho, or any CardDAV server you point it at. Muster talks to the servers you configure and to nothing else.
The optional assistant
Muster can ask a language model to help sort contacts into groups or to name a company from its email domain. This is off by default and does nothing until you turn it on and enter an endpoint.
If you turn it on:
- You choose the endpoint. It can be a model running on your own Mac, on your own server, or a hosted API. I do not provide one and cannot see what you send.
- You choose which fields are sent, from a list of checkboxes. The app states, in words, exactly which fields will leave your Mac before each request.
- Every request is confirmed before it is made, and the confirmation names the endpoint, the fields and the number of contacts.
If you never turn it on, no contact data leaves your Mac except to the address books you sync with.
Telemetry
There is none. Muster contains no analytics, no crash reporting and no usage tracking.
The app writes a local log to ~/Library/Logs/Muster.log for diagnosing failures. It records target names, counts and error text, and deliberately never records contact values. It is never sent anywhere.
Network requests
Muster makes network requests only to:
- the address book servers you configure,
- the sign-in endpoints of those providers, when you sign in,
- the backup destination you configure, if you configure one,
- a company’s own website, if you ask it to fetch that company’s logo,
- the assistant endpoint you configure, if you turn the assistant on.
Children
Muster is not directed at children and collects nothing from anyone directly.
Changes
If this policy changes in a way that affects what happens to your data, the date at the top changes and the previous version stays in the site’s git history.