- The app — the desktop app and the web editor. It has no account. Your diagrams are files on your own machine. The only thing that ever leaves is optional, anonymised diagnostics, and you can switch those off.
- Diagrammo Cloud — the optional hosted side. You sign in, and your diagrams are stored on our servers so a team can share them. That means we hold your email address and your diagram content. This page says exactly what that involves.
If you have never signed in, only the first half applies to you.
Part 1 — The app (desktop & web editor)
Diagnostics summary
- What we collect: sanitized error messages, sanitized stack traces, app version, platform, and a per-install random ID. Your IP address is visible to the third-party error-tracking service that receives the events; we don’t use it to identify you.
- What we don’t collect: your file content, file names, full filesystem paths, the diagrams you author.
- Retention: 90 days.
- How to turn off: Settings → toggle off Send error reports to help fix bugs.
Events we capture
Each event sends only the listed properties.
app_opened
When the app launches. Properties: app version, platform (tauri desktop or web), and the chart type of the last opened file (derived from file extension only).
diagram_rendered
When a diagram successfully renders. Property: the chart type from a fixed list (e.g. sequence, flowchart, erd, kanban, org, c4).
app_crashed
Once per session if a recovery snapshot is found on launch. Properties: app version, file-extension-derived diagram type, and a short label describing what the app was doing before the crash (from a fixed allowlist).
crash_loop_detected
Once per session if the app crashed twice within 60 seconds. Properties: tier (always 1), the 60-second window, and the activity label.
onboarding_path
Once when a new install picks a folder. Property: default, suggestion, custom, or existing.
$exception
When an uncaught error escapes a React boundary, an async catch, or an unhandled rejection.
- Sanitized error message (paths stripped, capped at 500 characters)
- Sanitized stack trace (paths stripped, capped at 4000 characters)
- An
error_classlabel from a fixed list:render_error,export_error,update_error,fs_error - Narrow context fields: which UI panel crashed, update phase (check/install), filesystem operation, export format, or a base filename without path or extension. None of these carry user content.
What is NOT captured
- Your diagram content. The DSL you type, the diagrams you render — none enters any event.
- File or folder names. Path shapes in messages and stack traces are stripped before sending.
- Browsing. No pageview tracking, no docs-page tracking.
- Session replay. Not used.
- Funnels, cohorts, A/B tests. Not used.
Pseudonymity, not anonymity
The per-install ID is a random UUID generated on your device the first time Diagrammo starts. Diagnostics carry no name, no email, and no account identifier — they are not joined to a Cloud account even if you have one. But because the same UUID is reused across launches, two events from the same install are linkable to each other. That’s pseudonymity, not anonymity.
Opting out
Settings → Send error reports to help fix bugs. The opt-out is honored at the SDK level so any in-flight events are dropped.
Part 2 — Diagrammo Cloud
This part applies only once you sign in. Signing in is optional; the app is fully usable without it.
The short version
- We store your email address, your display name if you set one, and the diagrams you push to a space. Diagram source is text you wrote, so it is whatever you put in it — treat a space the way you’d treat any shared drive.
- We don’t sell anything, show ads, or run behavioural profiling. There is nobody to sell it to; the product is the product.
- We never run AI over your diagrams. Diagrammo’s AI features run on your own machine with your own key. Your diagram content is never sent to a model by us.
- Your export always works — including after you cancel a paid plan, if and when paid plans exist. Diagrams are plain text files and you can take them and leave at any time.
- You can have all of it deleted. Email diagrammo@pm.me and we’ll export what you want and destroy the rest.
What Cloud stores
| What | Why it exists | How long we keep it |
|---|---|---|
| Your email address | It is your identity — sign-in links go to it, and invites are addressed to it | For as long as your account exists |
| Display name, if you set one | So teammates see a person rather than an address | For as long as your account exists |
| Sign-in sessions — including the browser or app user-agent string | So you stay signed in, and so you can see and revoke your own devices | 30 days, then automatically deleted |
| Sign-in link and code records — always hashed, never the raw token | To make each link single-use and stop replays | Minutes. Deleted automatically once used or expired |
| Failed sign-in counters, keyed by email address or IP address | To stop somebody brute-forcing or spamming sign-in links | 24 hours |
| Team space membership and role | To decide who may read or edit what | For as long as the membership exists |
| Pending invitations — the invited email address and role | So somebody who isn’t a user yet can be let in | Accepted: kept, as the record of how that person joined. Unaccepted: deleted a week after the invitation expires |
Your diagram content — the .dgmo source you push, its title, and its recent versions | It is the thing you asked us to host | The last 10 versions of each diagram. Deleted diagrams are recoverable for 30 days, then destroyed — rows and files both |
| Cached renders of your diagrams | So a shared link opens fast | Refreshed with the diagram; destroyed with it |
| An activity log — who did what and when, by account ID | Security. It is how a team can tell who granted access, who viewed a private diagram, and who deleted something | Kept for the life of the space (see Deleting everything, below) |
| Usage measurements — space and diagram IDs, action names, timings | To see whether the product works. No names, no email addresses, no content | 3 months |
| Billing records, if paid plans exist and you subscribe | To take the payment | Handled by the payment provider; we store only their reference IDs |
Your diagrams on your own machine
The desktop app and the web editor keep a local copy of the diagrams in a space, so you can keep working offline. That copy is on your device, under your control, and is not encrypted by Diagrammo — it relies on your operating system’s disk encryption (FileVault, BitLocker). If you are removed from a space, the app deletes that space’s local copy the next time it runs.
Private, public, and what “public” really means
Diagrams are private by default. Private means private: every read is checked against your membership on the server at the moment you ask for it, and files are never served straight from storage.
If you deliberately make a diagram public, it becomes a genuinely public web page — anybody with the link can open it, it is cached on servers around the world to make it fast, and search engines may index it. Making it private again stops us serving it, but we cannot un-publish something that has already been copied, cached elsewhere, or archived. Only make public what you’d be comfortable posting.
Who else touches your data
We keep this list short on purpose.
| Who | What they handle | Where |
|---|---|---|
| Cloudflare | Hosts the whole service — the API, the database, and the file storage your diagrams live in | Single region |
| Resend | Sends sign-in links and invitations. Sees the recipient’s email address | — |
| Only if you choose “Sign in with Google”. We receive your email address and name from them; they learn that you signed in to Diagrammo | — | |
| Your payment provider | Only if paid plans exist and you subscribe. Card details go to them and never touch our servers | — |
That’s the complete list. If it ever changes, this page changes first.
What Cloud never does
- No AI on your content. No model, ours or anybody’s, is shown your diagrams by us.
- No training on your diagrams. Not by us, not by a partner.
- No selling or sharing your data with advertisers, brokers, or anyone else.
- No behavioural profiling, session replay, ads, or cross-site tracking.
- No reading your private diagrams, other than the narrow case below.
The narrow case: we may look at specific content if you ask us to for support, if we must to investigate abuse or a security incident, or if we are legally compelled. Every private view is written to the activity log.
Your rights
Wherever you live, you can ask us to:
- See what we hold about you
- Export it — diagrams are plain text and you can take them at any time, with or without asking us
- Correct anything wrong
- Delete all of it
- Object to a particular use
Email diagrammo@pm.me. We aim to reply within 30 days, and always inside the deadline the law where you live sets. We won’t charge you or make you jump through hoops.
Deleting everything
Ask, and we will export anything you want to keep, then destroy your account, your diagrams, and their stored files.
One exception, and we’d rather be straight about it: the security activity log is deliberately tamper-evident, because a log a person can quietly edit is not a security log. Rather than delete those entries, we cut the link to you — your account ID is severed from them, so what remains records that something happened without recording that you did it.
Working out who you are
We are not trying to build a profile of you. But we should be clear that an email address is a direct identifier, and that an IP address counts as personal data in the EU and UK. We use IP addresses only to rate-limit sign-in attempts and stop abuse, we don’t build any profile from them, and we throw them away after 24 hours.
Where your data lives
Diagrammo Cloud runs in a single region and your data stays there. We are based in the United States; if you are in the EU or UK, using Cloud means your data is handled in the US under the appropriate safeguards.
Teams and companies
If you use Cloud as part of a team, there are two layers. We decide how account data works — that’s on us. Your team decides what goes in its diagrams — we hold that content on their instructions, not our own. If your organisation needs a data-processing agreement covering that arrangement, email diagrammo@pm.me and we’ll provide one.
If something goes wrong
If your data is exposed in a breach, we will tell you and the relevant regulators as fast as the law requires and, where we can, faster.
Children
Diagrammo isn’t built for or aimed at children under 16, and we don’t knowingly keep accounts for them.
Changes
If we ever expand what’s collected, this page is updated before the change ships and release notes call it out explicitly.
28 July 2026 — rewritten for Diagrammo Cloud. The previous version described only the desktop app’s diagnostics and said we never see your name or email, which stopped being true when Cloud launched with accounts. Part 1 is unchanged in substance; Part 2 is new.
Contact
Questions, requests, complaints: diagrammo@pm.me.