Murena
Murena positions itself as a privacy-respecting service that won't sell your data, won't monitor your content, and operates under EU law with user-friendly jurisdiction — but its legal terms heavily favor the company, as it accepts no responsibility for data loss, hacks, outages, or service shutdowns. The privacy policy can be changed at any time without your consent, and it vaguely describes what personal data is collected while silently sending behavioral data to a US third party during sign-up. Some features carry additional risks, including your voice audio being sent to OpenAI's servers for transcription, and your account being permanently deleted if you don't add a recovery email within 30 days. Overall, Murena makes genuine privacy commitments but shields itself from nearly all accountability when things go wrong.
Last analyzed
Heads up: this analysis is AI-generated, can be incomplete or wrong, and is not legal advice. Use it as a starting point and read the original document before you agree — see our Terms.
Clause-by-clause breakdown
Every clause we flagged in Murena's agreement, with what it means for you.
Murena can change its privacy policy anytime without your consent.
“We may change this privacy policy from time to time and we will update you when it is the case. We also encourage visitors to frequently check this page for any changes.”
Quoted verbatim from the agreement What this means: Murena reserves the right to change its privacy policy at any time. While they say they will 'update you,' the policy does not specify how (e.g., email, banner notice) or require your affirmative consent before changes take effect. Continued use of the service after a change could be treated as acceptance of new terms.
What you can do: Bookmark the privacy policy page and check it periodically. Consider setting a reminder to review it every few months.
Your data can be shared with authorities if legally required.
“This information isn't disclosed to third parties unless legally obliged to do so.”
Quoted verbatim from the agreement What this means: Murena shares visitor statistics and limited user data with third parties when required by law. There is no mention of a warrant canary, a requirement for a court order, or any commitment to notify users before complying. This means government or law enforcement requests could result in your data being disclosed without your knowledge.
What you can do: Be aware that your data can be handed to authorities without prior notice to you. If this is a concern, consider using the service with minimal identifying information.
Sign-up silently sends your behavior data to a US third party.
“We use the hCaptcha security service (hereinafter "hCaptcha") on murena.io/signup. This service is provided by Intuition Machines, Inc., a Delaware US Corporation ("IMI"). hCaptcha is used to check whether user actions on our account creation service (and solely there) meet our security requirements. To do this, hCaptcha analyzes the behavior of the website visitor based on various characteristics. This analysis starts automatically as soon as the website visitor enters the account creation flow. For the analysis, hCaptcha evaluates various information (e.g. IP address, how long the visitor has been on the website or app, or mouse movements made by the user). The data collected during the analysis will be forwarded to IMI. hCaptcha analysis in the "invisible mode" may take place completely in the background. Website visitors are not advised that such an analysis is taking place if the user is not shown a challenge.”
Quoted verbatim from the agreement What this means: When you sign up for an account, a third-party service (hCaptcha by Intuition Machines, Inc.) silently analyzes your behavior — including your IP address, time on page, and mouse movements — in the background without visibly alerting you. This data is sent to a US company. While this is for bot-prevention, it is a form of covert behavioral tracking at the point of account creation.
What you can do: Be aware that your behavior is being analyzed and sent to a third party during sign-up. Review hCaptcha's own privacy policy at https://www.hcaptcha.com/privacy for details on how they handle your data.
The policy is vague about exactly what personal data is collected.
“We collect information from you when you create an ecommerce account, subscribe to a newsletter, fill out a form, subscribe to a premium storage plan, purchase a smartphone, or enter information on our site.”
Quoted verbatim from the agreement What this means: Murena collects personal information across several touchpoints — account creation, newsletter sign-up, forms, purchases, and storage subscriptions. The policy does not specify exactly what categories of data are collected in each case, which reduces transparency.
What you can do: Contact Murena at their Paris address to request a full breakdown of what personal data they hold about you.
Payments go through Stripe, PayPal, and Bitpay — not Murena.
“We use Stripe, PayPal and Bitpay to process payments on this website.”
Quoted verbatim from the agreement What this means: Payment processing is handled by three external companies — Stripe, PayPal, and Bitpay. Each of these companies has its own privacy policy and data practices. Your financial and personal data submitted during checkout is governed by their terms, not Murena's.
What you can do: Review the privacy policies of Stripe, PayPal, and Bitpay before making a purchase to understand how your payment data is handled.
Your cloud data is never sold or shared with third parties.
“All data on your "own" /e/ server is encrypted and never shared, sold or traded to any third party.”
Quoted verbatim from the agreement What this means: Murena makes an explicit commitment that your cloud data is encrypted and will never be sold or shared with third parties for commercial purposes. This is a strong user-protective pledge that goes beyond what many cloud services offer.
The Murena Workspace software sends no personal data to Murena.
“Our software does not send any of your user personal data to us.”
Quoted verbatim from the agreement What this means: Murena states that the Workspace software itself does not transmit your personal data back to Murena. This means your emails, files, and calendar data stay on your server and are not used for profiling or analytics by the company.
Migrated Google data stays until you choose to delete it.
“Once the migration is over the rules described here will apply and the migrated content will be accessible, writable, removable at all times and only by yourself from your Murena Workspace account as part of data from this account. This means the data will be kept in your Murena Workspace until you delete it or you delete your account.”
Quoted verbatim from the agreement What this means: After migrating your Google data (emails, files, photos, contacts, calendar), that content is stored in your Murena Workspace and remains there until you actively delete it or close your account. You have full control to access, edit, or remove it at any time, which is a user-friendly approach.
What you can do: If you no longer need migrated data, you can delete it directly from your Murena Workspace account at any time.
Frequently asked questions
Is Murena's Terms & Conditions agreement fair?
- BeforeYouClick grades Murena B on an A–E scale, where A is the fairest. Its agreement contains 1 critical clause, 3 warnings and 4 good practices.
What are the biggest problems with Murena's terms?
- The most serious clauses we flagged are: Privacy Policy Can Change Anytime Unilaterally, No Warranty on Service or Data Security and Broad Liability Exclusion for Damages.
How long does it take to read Murena's terms?
- Murena's agreement takes about 5 minutes to read in full, across 8 clauses we reviewed. The summary on this page covers the same ground in under a minute.
When was Murena's agreement last analyzed?
- We last read Murena's Terms & Conditions on July 4, 2026. Companies change their terms without notice, so check the original document for the current version.
Is this analysis legal advice?
- No. This analysis is AI-generated, can be incomplete or wrong, and is not legal advice. Use it as a starting point and read the original agreement before you agree to it.
More agreements to read
- Mullvad VPNSecurityGrade A
- NordVPNSecurityGrade B
- BitwardenSecurityGrade C
- IVPNSecurityGrade C
- DuckDuckGoSecurityGrade C
- ProtonVPNSecurityGrade D