Where your data actually goes
Short version: nowhere. Everything happens in your browser, on your machine. This page is the long version, because a promise you cannot check is not worth much.
Your export is never uploaded
Your export is opened by the browser itself, the same way it would open a file you double-click. Reading it, merging services, finding duplicates, repairing dates, searching and exporting all happen on your machine. No part of the archive is sent anywhere. Open your browser's network tab on the page where your export is open and you will see it load, and then nothing at all - not one request, for as long as you use it. Do the same on this page and you will see a single count go out, which is described below and is the only thing on this site that ever does.
There is no exception, and the thing enforcing that is not a paragraph on this page. connect-src in the site's headers is 'self' and nothing else, so the browser would refuse to send your archive anywhere even if a future change to this site tried to. You can read that header in your own browser's network tab, and the file that sets it is in the public source.
Some things are kept, on your device
Reading a large export takes time, and working out which photos are near-duplicates takes longer. Doing that again every visit would be a poor trade, so the results are kept - in your browser's own storage, on your own disk.
What is kept
The list of what is inside your export, the dates and places read out of it, and the results of any analysis. Plus a reference to each archive, so it can be reopened without asking you to find it again.
What is not kept
Copies of your photos, videos or messages. A reference to an archive is a pointer to the file already on your disk, not a second copy of it. Move or delete the archive and Muletto will tell you it is gone.
Who can read it
This browser, on this machine, for this site. Not us, not another site, not another profile. It is the same storage a web app uses to remember your settings.
Getting rid of it
One button. Forget this library, in the sidebar, clears everything Muletto has kept, immediately. Clearing site data in your browser does the same.
Work you can take with you
Browser storage belongs to the browser, and it can be cleared - by you, or by the browser needing room. Anything that took real effort can be written out to a file you keep. It holds the results only: no photos, no messages, not even file names. Feed it back next year alongside a fresh export and everything that still applies is recognised, because results are filed against the contents of each file rather than its name.
Nothing happens in the background
There is no telemetry and no crash reporting. Nothing is sent while you are not looking. The app makes no network requests at all - not one, with your data or without it - which is a shorter claim than any list of exceptions could be, and an easier one to check.
The one thing we do count
The pages of this site - not the app - send a note that a page was read. It is worth being exact about what that is, because most sites are not.
What is recorded
Which page, which site you arrived from, which country the connection came from, a browser family, and whether the screen is a phone. Added to a tally for that day and nothing else.
What is not
No cookie and nothing else stored on your device - which is the entire reason this site has no consent banner, because a banner exists to ask permission for exactly that. No address is kept, hashed, or turned into an identifier, so there is no such thing here as a visitor, a session or a return visit. Only counts.
Never from the app
The page where your export is open sends nothing at all. That is why you can open the Network tab, use the whole app, and see no requests - a claim with an exception in it is not worth making, so there is no exception.
And it is refusable
Do Not Track and Global Privacy Control are both honoured, though neither is required of a site that stores nothing on your machine. Turn either on and even the tally stops.