Privacy teardown of the Muse apps

![Muse privacy concern — independent teardown](assets/muse-platforms.png)

# Muse by Meta: iOS, macOS and Android privacy teardown

[**iOS**](IOS.md) · [**macOS**](#1-is-this-really-metas-app) · [**Android**](ANDROID.md) · [**All evidence**](EVIDENCE.md) · [**Review updates**](REVIEW.md)

> The internet is the 'greatest spying machine the world has ever seen' and is not a technology that necessarily favours the freedom of speech.
>
> — Julian Assange’s remarks, as summarized by [The Guardian, 15 March 2011](https://www.theguardian.com/media/2011/mar/15/web-spying-machine-julian-assange). This full sentence is the article’s summary, not a verbatim sentence from his speech.

A static teardown of **Muse 3.0 for macOS** (`com.meta.endo`), plus Android and iOS samples. Meta uses **Hatch** internally; the Mac binary also contains **Endo** names.

**The privacy issue is the breadth of access:** the Mac build contains tools for iMessage, WhatsApp, Mail, Notes, contacts, calendars, files, screen capture and computer control, plus background-sync machinery and a powerful bundled Chrome extension. Enabling a connector can expose private information to a cloud agent; some connectors support ongoing uploads.

**This report establishes shipped capabilities, not what a particular user's account uploaded.** OS permissions, connector settings, approval rules, feature flags and platform restrictions affect what actually runs. No Muse app was launched, no account was connected and no network traffic from the apps was captured. Strings and decompiled code do not establish successful execution or server-side enforcement.

### Platforms covered

| Platform | Inspected build | Report / evidence strength |
|---|---|---|
| macOS | 3.0, build `1075746581` | This page; Meta Developer ID signature verifies. Production update feed still lists this build on 2026-09-24. |
| Android | 8.0.0.21.168 (`com.facebook.aura`) | [ANDROID.md](ANDROID.md): verified APK signature/source stamp; SMS, calls, notifications, location and **19 health-data category permissions**, plus history/background permissions. |
| iOS | 8.1.0, build `1074192126` (`com.facebook.hatch`) | [IOS.md](IOS.md): **modified/decrypted-looking IPA with invalid signature**; sample-specific findings, not authenticated retail-code claims. |

### What changed in this review — 2026-09-24

- Added the iOS sample: HomeKit controls and