Privacy Policy

• Account data: email + display name + avatar from your OAuth provider (GitHub / Google).
• Diagrams:the source code you write, when you opt into cloud sync. If you don't opt in, diagrams stay in your browser's local storage and we never see them.
• Usage telemetry: anonymous, first-party product events keyed to a random per-browser id. Section 4 lists every field.
• Feedback:the message you send through the in-product feedback door — with your user id and email attached if you were signed in. Section 5.
• Error reports: details of crashes in your browser or on our servers, so we can fix them. Section 6.
• Security log:for security-relevant account events only — sign-in and sign-out, plan changes, API-key creation and revocation, saving or deleting a stored AI key — we record the event, your user id, your IP address and your browser's user-agent string. This is the one place we keep an IP. It exists to investigate account takeover and billing disputes, and it is never used for analytics or advertising.
• Billing:if you subscribe, Stripe holds your card details — we only store the subscription status and tier.

• We don't train AI models on your diagrams.
• We don't sell or rent your data.
• We don't use third-party analytics, ad trackers, or cross-site tracking of any kind.
• We don't read your cloud-synced diagrams except to render them back to you.
• We never store your AI provider API key in plain text, and we never log it.

When you use an AI feature, your prompt and the relevant diagram context are sent to the AI provider handling the request — Anthropic or OpenAI. The provider's own privacy policy applies to that leg of the call. We don't retain the prompt or the completion after returning it to you.

If you bring your own key (BYOK) there are two modes, and they handle your key differently. Both of them route the key through our server — the provider call is made server-side, so a “browser-only” BYOK is not something we can honestly claim:

• Kept in your browser (the default).Your key is stored in your browser's local storage and attached to each AI request as an X-User-Api-Key header. Our server holds it in memory only for the lifetime of that one request, uses it to call the provider you nominated, and never writes it to a database or a log.
• Saved to your account (opt-in).If you turn on “save key to my account”, the key is encrypted on our server with AES-256-GCM and only the ciphertext, initialisation vector and authentication tag are stored in our database. The encryption key lives in the deployment's environment and never touches the database, so a copy of the database alone does not reveal your key. The row is readable only by the server, gated on your signed-in session; the database's own access rules deny every client role outright. We also store the first 8 characters of the key in clear text so the settings screen can show you which key is saved (sk-ant-x…). We decrypt it in memory, per request, only to call your provider. You can delete it at any time from Settings, which removes the row.

If you don't bring a key, requests use the platform's own provider key and are subject to the quotas described in the Terms.

Telemetry is first-party and anonymous. There is no third-party analytics SDK anywhere in the product. A telemetry row contains only these fields:

• A random browser id— a UUID generated in your browser on first use and kept in local storage. It is not derived from your account, your email, your IP or your device; clearing site data gives you a new one.
• An event name from a fixed, short list (opening a workstation, a successful render, an export, a handoff, a vault save, a feedback submission, and similar).
• The workstation id the event happened in (for example studio) — an identifier, never a URL.
• A small properties bagcapped at 900 characters — things like which engine rendered or which export format was chosen. The only free text it can ever contain is a ⌘K search query that returned zero results, truncated to 60 characters, so we learn what the product is missing.
• A timestamp.

We do not store your IP address, your user-agent string, a referrer, a full URL or any query string with telemetry, and telemetry rows are never linked to your account. Diagram source, notes and file contents are never sent.

Retention: telemetry rows are deleted after 90 days.

Turning it off:we honour your browser's Do-Not-Track signal, and you can switch telemetry off permanently by setting glyph:telemetry:disabled to 1 in local storage.

The in-product feedback door stores your message, the page path you sent it from, and the random telemetry browser id (when telemetry is on) so we can see the journey that led to it.

If you are signed in when you submit, we also store your user id and your email address — so that we can reply to you. That means signed-in feedback is identifiable, not anonymous. If you want to send something anonymously, sign out first: submissions from signed-out visitors carry no user id and no email.

When something crashes — in your browser or on our servers — we record the failure so we can fix it. A crash report contains the error message, the stack trace, whether it happened on the client or the server, the page path (never the full URL, so share tokens in query strings are not captured), the build identifier, the random telemetry browser id, your browser's user-agent string, and your user id if you were signed in.

Stack traces and error messages can incidentally contain identifiers from whatever you were doing when the crash happened. We use these reports for one purpose only: finding and fixing bugs. They are never used for analytics, profiling, marketing or any automated decision about you. They are readable only by the server, are pruned on the same 90-day schedule as telemetry, and if the deployment is configured with an external error-tracking endpoint (Sentry), a copy of the report is forwarded there as well.

The platform voice (read-aloud) runs a speech model entirely inside your browser. The text being read never leaves your device and never reaches our servers — there is no speech API call to log.

There is one thing you should know: the first time you use it, your browser downloads roughly 80 MB of model files directly from the Hugging Face CDN (huggingface.co and its content hosts). That is a request from your browser to a third party we do not control, so Hugging Face will see your IP address and the usual request metadata, governed by their privacy policy rather than this one. The files are then cached locally, so it happens once. If you never use read-aloud, the download never happens.

• Telemetry and error reports: 90 days.
• Account data and cloud-synced diagrams: for as long as your account exists.
• Feedback messages: kept until we've acted on them. Note that deleting your account unlinks feedback from your user record but does not automatically erase the message or the email address it was submitted with — ask us and we'll delete those too.
• Security log entries: kept while they have forensic value for account-security and billing questions.

• Export every diagram you've created.
• Ask us to delete your account. There is currently no self-serve delete button — email the address below and we will erase your profile, workspace, API keys, saved AI key and billing references within 30 days, and confirm when it's done.
• Request a copy of everything we hold about you, or ask us to correct it.
• Object to, or ask us to stop, any of the collection described above. Telemetry you can switch off yourself (section 4).

Send any of these to SET_SUPPORT_EMAIL (this deployment has no contact address configured — its operator must set the SUPPORT_EMAIL environment variable).