- The app — the desktop app and the web editor. It has no account. Your diagrams are files on your own machine. The only thing that ever leaves is optional, anonymised diagnostics, and you can switch those off.
- Diagrammo Cloud — the optional hosted side. You sign in, and your diagrams are stored on our servers so a team can share them. That means we hold your email address and your diagram content. This page says exactly what that involves.
If you have never signed in, only the first half applies to you.
Who this notice is from. Diagrammo is operated by Diagrammo LLC, a limited liability company formed in Colorado, United States. Where this page says “we”, it means that company — and for anything covered in Part 2 it is the controller, meaning the party that decides what is collected and why, and the one you can hold to everything written here.
Part 1 — The app (desktop & web editor)
Diagnostics summary
- What we collect: sanitized error messages, sanitized stack traces, app version, platform, and a per-install random ID. Your IP address is visible to the third-party error-tracking service that receives the events; we don’t use it to identify you.
- What we don’t collect: your file content, file names, full filesystem paths, the diagrams you author.
- Retention: 90 days.
- How to turn off: Settings → toggle off Send error reports to help fix bugs.
Events we capture
Each event sends only the listed properties.
app_opened
When the app launches. Properties: app version, platform (tauri desktop or web), and the chart type of the last opened file (derived from file extension only).
diagram_rendered
When a diagram successfully renders. Property: the chart type from a fixed list (e.g. sequence, flowchart, erd, kanban, org, c4).
app_crashed
Once per session if a recovery snapshot is found on launch. Properties: app version, file-extension-derived diagram type, and a short label describing what the app was doing before the crash (from a fixed allowlist).
crash_loop_detected
Once per session if the app crashed twice within 60 seconds. Properties: tier (always 1), the 60-second window, and the activity label.
onboarding_path
Once when a new install picks a folder. Property: default, suggestion, custom, or existing.
$exception
When an uncaught error escapes a React boundary, an async catch, or an unhandled rejection.
- Sanitized error message (paths stripped, capped at 500 characters)
- Sanitized stack trace (paths stripped, capped at 4000 characters)
- An
error_classlabel from a fixed list:render_error,export_error,update_error,fs_error - Narrow context fields: which UI panel crashed, update phase (check/install), filesystem operation, export format, or a base filename without path or extension. None of these carry user content.
What is NOT captured
- Your diagram content. The DSL you type, the diagrams you render — none enters any event.
- File or folder names. Path shapes in messages and stack traces are stripped before sending.
- Browsing. No pageview tracking, no docs-page tracking.
- Session replay. Not used.
- Funnels, cohorts, A/B tests. Not used.
Pseudonymity, not anonymity
The per-install ID is a random UUID generated on your device the first time Diagrammo starts. Diagnostics carry no name, no email, and no account identifier — they are not joined to a Cloud account even if you have one. But because the same UUID is reused across launches, two events from the same install are linkable to each other. That’s pseudonymity, not anonymity.
Opting out
Settings → Send error reports to help fix bugs. The opt-out is honored at the SDK level so any in-flight events are dropped.
Part 2 — Diagrammo Cloud
This part applies only once you sign in. Signing in is optional; the app is fully usable without it.
The short version
- We store your email address, your display name if you set one, and the diagrams you push to a space. Diagram source is text you wrote, so it is whatever you put in it — treat a space the way you’d treat any shared drive.
- We don’t sell anything, show ads, or run behavioural profiling. There is nobody to sell it to; the product is the product.
- We never run AI over your diagrams. Diagrammo’s AI features run on your own machine with your own key. Your diagram content is never sent to a model by us.
- Your export always works — including after you cancel a paid plan, if and when paid plans exist. Diagrams are plain text files and you can take them and leave at any time.
- You can have all of it deleted, and you can do it yourself — from the app, confirmed by a link we email you. Or email privacy@diagrammo.app and we’ll export what you want and destroy the rest.
What Cloud stores
| What | Why it exists | How long we keep it |
|---|---|---|
| Your email address | It is your identity — sign-in links go to it, and invites are addressed to it | For as long as your account exists |
| Display name, if you set one | So teammates see a person rather than an address | For as long as your account exists |
| Sign-in sessions — including the browser or app user-agent string | So you stay signed in, and so you can see and revoke your own devices | 30 days, then automatically deleted |
| Sign-in link and code records — always hashed, never the raw token | To make each link single-use and stop replays | Minutes. Deleted automatically once used or expired |
| Failed sign-in counters, keyed by email address or IP address | To stop somebody brute-forcing or spamming sign-in links | 24 hours |
| Team space membership and role | To decide who may read or edit what | For as long as the membership exists |
| Pending invitations — the invited email address and role | So somebody who isn’t a user yet can be let in | Accepted: kept, as the record of how that person joined. Unaccepted: deleted a week after the invitation expires |
Your diagram content — the .dgmo source you push and its title | It is the thing you asked us to host | The current version only — saving replaces the copy before it, and no version history is kept. Deleted diagrams are recoverable for 7 days, then destroyed — rows and files both |
| A copy of a diagram you are showing on the web, held briefly in Cloudflare’s cache | So a link that many people open doesn’t cost a fresh lookup every time | Up to five minutes, then fetched again. This is the diagram source — the picture is drawn in the reader’s own browser, and we keep no copy of it |
| An activity log — who did what and when, by account ID | Security. It is how a team can tell who granted access, who viewed a private diagram, and who deleted something | Kept for the life of the space (see Deleting everything, below) |
| Usage measurements — space and diagram IDs, action names, timings | To see whether the product works. No names, no email addresses, no content | 3 months |
| Billing records, if paid plans exist and you subscribe | To take the payment | Handled by the payment provider; we store only their reference IDs |
Your diagrams on your own machine
The desktop app and the web editor keep a local copy of the diagrams in a space, so you can keep working offline. That copy is on your device, under your control, and is not encrypted by Diagrammo — it relies on your operating system’s disk encryption (FileVault, BitLocker). If you are removed from a space, the app deletes that space’s local copy the next time it runs.
Private, shown on the web, and what that really means
Diagrams are private by default. Private means private: every read is checked against your membership on the server at the moment you ask for it, and files are never served straight from storage.
If you deliberately show a diagram on the web, it becomes a genuinely public web page — anybody with the link can open it, its source is cached on servers around the world to make it fast, and search engines may index it. Stop showing takes it down, but neither instantly nor everywhere: our own cache can go on answering for about five minutes, and nothing we do reaches a copy somebody else has already saved, cached or archived. Only show what you’d be comfortable posting.
Who else touches your data
We keep this list short on purpose.
| Who | What they handle | Where |
|---|---|---|
| Cloudflare | Hosts the whole service — the API, the database, and the file storage your diagrams live in | Single region |
| Resend | Sends sign-in links and invitations. Sees the recipient’s email address | — |
| Only if you choose “Sign in with Google”. We receive your email address and name from them; they learn that you signed in to Diagrammo | — | |
| Your payment provider | Only if paid plans exist and you subscribe. Card details go to them and never touch our servers | — |
That’s the complete list. If it ever changes, this page changes first.
What Cloud never does
- No AI on your content. No model, ours or anybody’s, is shown your diagrams by us.
- No training on your diagrams. Not by us, not by a partner.
- No selling or sharing your data with advertisers, brokers, or anyone else.
- No behavioural profiling, session replay, ads, or cross-site tracking.
- No reading your private diagrams, other than the narrow case below.
The narrow case: we may look at specific content if you ask us to for support, if we must to investigate abuse or a security incident, or if we are legally compelled. Every private view is written to the activity log.
Your rights
Wherever you live, you can ask us to:
- See what we hold about you
- Export it — diagrams are plain text and you can take them at any time, with or without asking us
- Correct anything wrong
- Delete all of it
- Object to a particular use
Email privacy@diagrammo.app. We aim to reply within 30 days, and always inside the deadline the law where you live sets. We won’t charge you or make you jump through hoops.
Deleting everything
You can do this yourself. In the app, type your own email address to ask for deletion; we send you a link, and pressing the button on the page it opens destroys your account, your diagrams and their stored files. The link is good for a day, and opening it does nothing on its own — a person has to press the button, because mail security scanners follow links automatically and an act performed by merely opening one would not be your act.
Two acts through two channels is the point: typing the address makes it deliberate, and the emailed link proves it is you rather than somebody at your unlocked laptop.
Or just ask, and we will export anything you want to keep, then destroy the same things by hand.
One exception, and we’d rather be straight about it: the security activity log is deliberately tamper-evident, because a log a person can quietly edit is not a security log. Rather than delete those entries, we cut the link to you — your account ID is severed from them, so what remains records that something happened without recording that you did it.
Working out who you are
We are not trying to build a profile of you. But we should be clear that an email address is a direct identifier, and that an IP address counts as personal data in the EU and UK. We use IP addresses only to rate-limit sign-in attempts and stop abuse, we don’t build any profile from them, and we throw them away after 24 hours.
Where your data lives
Diagrammo Cloud runs in a single region and your data stays there. We are based in the United States; if you are in the EU or UK, using Cloud means your data is handled in the US under the appropriate safeguards.
Teams and companies
If you use Cloud as part of a team, there are two layers. We decide how account data works — that’s on us. Your team decides what goes in its diagrams — we hold that content on their instructions, not our own. If your organisation needs a data-processing agreement covering that arrangement, email privacy@diagrammo.app and we’ll provide one.
If something goes wrong
If your data is exposed in a breach, we will tell you and the relevant regulators as fast as the law requires and, where we can, faster.
Children
Diagrammo isn’t built for or aimed at children under 16, and we don’t knowingly keep accounts for them.
Part 3 — Asking to be told when something ships
At the foot of this website there is one field, labelled Stay up to date, where you can leave an email address to hear from us. It has nothing to do with the app or with a Cloud account, so it gets its own part.
What we store: the address you typed, which of the asks it was, the page you asked from — the path only, never the query string — and the date. No name, no cookie, no profile, and it is not joined to a Cloud account even if you have one with the same address.
And, for 24 hours, a counter. Submitting also increments an abuse counter keyed by your email address and by your IP address, in the same table used for sign-in attempts. It is what stops one machine filling the list with addresses. Those counter rows are deleted automatically 24 hours later; your IP address is not stored anywhere else and never reaches the record above.
What we do with it: count it, and sometimes write to you.
Counting is the main thing — we are working out whether enough people want to hear from us to be worth running a mailing list at all. Alongside that, a real person may write to you directly: a short question about what you are building with Diagrammo, or news we think you specifically would want. It comes from a person, it is not automated, and replying to it reaches that person.
What we are not doing is sending bulk announcements to everyone on this list. If that starts, this page changes first and every one of those messages will carry a way to unsubscribe.
How long we keep it: until you ask us to remove it, or until we decide not to run a list and delete the lot.
Getting off it: email privacy@diagrammo.app and every record of your address here is deleted. Because nothing is sent yet there is no unsubscribe link to click, which is exactly why the address above is the answer.
If someone else entered your address: tell us and we will delete it. The field does not ask you to confirm by email, because confirming is only meaningful once something is being sent — see the note above.
Changes
If we ever expand what’s collected, this page is updated before the change ships and release notes call it out explicitly.
18 August 2026 — the retention row for your diagram content said a deleted diagram was recoverable for 30 days. The real window became 7 days on 17 August 2026 and this page went on saying thirty for a day; the row now says seven. Nothing else about what is collected, kept or shared has changed, and the row above it — sign-in sessions, kept 30 days — is a different thing on a different clock and is unaffected. The terms were corrected the same day.
17 August 2026 — erasure is now something you can carry out yourself, so Deleting everything and the summary bullet above it describe how instead of only telling you to email us. The mechanism shipped to the web editor today: you type your own address in the app, we email a link, and pressing the button on the page it opens destroys the account, the diagrams and their stored files. Emailing us still works and is still the route if you want an export first. Nothing about what is collected, kept or shared has changed, and the activity-log carve-out below is unaffected.
16 August 2026 — the row describing your diagram content said we keep the last ten versions of each one. We stopped keeping any on 13 August 2026: only the current version is stored, and saving replaces the copy before it. The row now says so, and no longer lists “recent versions” among the things we hold. Nothing else about what is collected, kept or shared has changed — in particular the 30-day window for restoring a deleted diagram is unaffected. The terms were corrected the same day.
10 August 2026, later — the addresses on this page moved from a personal Proton mailbox to the domain itself. Data export, erasure, data-processing agreements and removal from the mailing list now go to privacy@diagrammo.app; general questions to hello@diagrammo.app. Security reports and copyright complaints in the terms moved to their own addresses too. All of them reach the same person; separating them is so a request carrying a legal deadline is not buried among general mail. Nothing about what is collected, kept or shared has changed.
10 August 2026 — the website now has a field for leaving an email address to hear about releases, and Part 3 describes it. Nothing is sent to those addresses; they are being counted to see whether a mailing list is worth running. Nothing about the app or Cloud changed.
9 August 2026 — this notice now names the company behind it. Diagrammo LLC was formed on 8 August 2026; until today the terms named it and this page said only “we”. Nothing about what is collected, kept or shared has changed. The link to this page was also added to the footer of every page — before today it could be reached only from inside the terms.
7 August 2026 — we stopped drawing diagrams on our servers, so the row describing a store of cached pictures was removed; nothing of the kind is kept any more, and a diagram is drawn in the reader’s own browser. In its place is the one copy that does exist: the source of a diagram you are showing on the web, held in Cloudflare’s cache for up to five minutes. The section on showing a diagram now says how long stopping takes to bite.
28 July 2026 — rewritten for Diagrammo Cloud. The previous version described only the desktop app’s diagnostics and said we never see your name or email, which stopped being true when Cloud launched with accounts. Part 1 is unchanged in substance; Part 2 is new.
Contact
Questions, requests, complaints: hello@diagrammo.app, or write to Diagrammo LLC, Colorado, United States.