Mulno Cloud storage, by plan (D99)
Mulno Cloud holds builds and testers' sessions. A Mulno Cloud project's sessions are kept for the plan's number below, counted from when a session finished uploading (or was last restored). Then the session is hidden from everyone, and its files are deleted for good 30 days later; until then an admin can still restore or export it. Builds are never deleted because of a plan.
An owner or admin can also delete one session sooner, from its review in the web app: hidden at once and deleted for good 30 days later (restorable until then), or deleted right away with no undo. A session a tester asked to have deleted on our deletion page is hidden at once and deleted for good 30 days after the request, unless the studio restores it (what we store); nobody can export it while it is hidden, and a plan change's hold below doesn't delay it.
| Plan | Sessions kept | Storage quota |
|---|---|---|
| Free | 14 days | 15 GB |
| Indie | 1 year | 250 GB |
| Team | Unmetered, fair use — no fixed number | 250 GB per seat |
| Education | Until the course ends, plus 90 days (not yet enforced by code; the Education plan exists in the plan table but is not yet sold, D134) | 50 GB per class |
A Private bucket's own retention is entirely up to you — Mulno holds nothing of the footage itself to expire (see what we store).
The broker's own records — the same in every storage mode
| What | Kept |
|---|---|
| Invite codes, sessions, redemptions, upload tickets, NDA acceptances, the records of which privacy notice the Launcher showed a tester | 90 days after the campaign closes, expires or is killed (a campaign with no end date never starts this clock: set an expiry); all of them within 30 days of the workspace being closed |
| Capture-health records | 90 days from when they're received |
| The account/workspace audit log (sign-ins, member changes, storage and lent-key changes, refunds asked for, exports, closing, and every read our servers make of a Private project's recordings under a lent key) | 1 year, or the plan's own session retention if longer (today, every plan's own number is at most a year, so this is a year for all of them); a closed workspace's entries too, with every member's address, account id and IP-address hash taken off them when the workspace's rows are deleted |
| A keyed, truncated hash of a tester's IP address, for rate limiting | About an hour |
| Request logs (Cloudflare Workers Logs) | 7 days |
| The traffic log Thailand's Computer-Related Offences Act s.26 asks for: per request, the time, method, route pattern, status and readable source IP address — no session, campaign or studio id. Mulno keeps it as its own legal obligation | 90 days |
Deleted rows can remain in Cloudflare's point-in-time database backups for up to 30 more days; this cannot be turned off (a Cloudflare platform limit, not our choice).
Download records (gated downloads)
Studio, the Unity package and the Claude Code plugin are downloaded by signed-in accounts (the Downloads page makes a link for each file it lists), and from Studio 0.4.2 every signed-in Studio update check carries a token we can link to the account. Each link made leaves a record: the account id, which file (app, version, file name) or, for an update check, the platform, a random link id and the times it was made and expires. It holds no IP address and no e-mail address. It is used only to trace a passed-on or misused link, or a copied update-check token, to the account it was made for. The counter that limits how often an account can make links is kept at most a couple of days.
| What | Kept |
|---|---|
| A download record | 90 days, then deleted automatically |
| An update-check record | 14 days, then deleted automatically |
Erasing your account deletes them at once (privacy notice §6, §7).
Closing a workspace, erasing an account
- Closing a workspace (an owner, in the workspace's settings): access ends at once; from day 14 we delete its Mulno Cloud recordings and builds, its session index and its rows, then the broker's records for it, all within 30 days of the closing. Kept: the audit logs until each entry's year ends, the broker's record that the workspace existed (an opaque id, plan and dates, no name), the record of the closing (up to 3 years), the traffic log and backups until they expire. The workspace's audit log loses its members' addresses, account ids and IP-address hashes when its rows are deleted. What we store has the full list.
- Erasing an account (the person, in a workspace's settings): immediate. Kept: the Terms record under an opaque id (up to 10 years), the audit log's entries without the person's address (until their year ends), the record of the erasure (up to 3 years), the traffic log (90 days). The privacy notice has the details.
- The DPA (§16): data is deleted within 30 days of the agreement ending or a deletion request, confirmed in writing; for Mulno-hosted recordings, we hold them available for you to download for 30 days first if you ask before termination (so ask before you close the workspace).
Changing your plan's retention
Downgrading a plan does not delete anything without warning: the Terms of Service (section 12) say we won't delete anything only because a plan changed without first writing to the workspace's owners and giving 30 days to export it. When a plan change shortens how long sessions are kept, nothing of the workspace is deleted for 30 days: its owners get an e-mail, the Billing page shows the date, and moving back up stops it. After that the lower plan's number applies (hidden first, deleted for good 30 days later). Meanwhile, new uploads over the lower plan's limits are refused. There is no export button in Studio yet: an admin can download a Mulno Cloud project's sessions through our api, or ask at developer@mulno.com from the owner's address and we make your files available to download within those 30 days. Builds you pushed also stay on your own computer, and a Private bucket never left your hands.
Mulno's own records about you
How long we keep your account and its sign-in records, your download records, a beta waitlist entry, and messages you send us is in §6 of our privacy notice, not on this page: those are Mulno's own records, not a workspace's.
What changed on 2026-10-18
- Download records (a link made for Studio, the Unity package or the plugin; an update check): 90 days and 14 days, deleted automatically and with the account.
What changed on 2026-10-08
- Where to find how long Mulno keeps its own records about you, including a beta waitlist entry.
What changed on 2026-10-04
- Mulno Cloud keeps sessions: the plan's number applies, then 30 days hidden before the files go; one session can be deleted sooner (30 days to undo, or right away); a tester's request hides it at once and deletes it after 30 days unless the studio restores it.
- A closed workspace's audit log keeps its year without its members' details.
- A plan change that shortens retention holds every deletion for 30 days, with an e-mail to the owners; exporting through the api.
- Closing a workspace and erasing an account are in the product: what goes, when, and what stays.