• The app — the desktop app and the web editor. It has no account. Your diagrams are files on your own machine. The only things that ever leave are optional, anonymised diagnostics, which you can switch off; a problem report, when you choose to send one; the desktop app’s check for a new version, except on Linux, where your package manager updates it, and the update it downloads; and, in the web editor only, a page-view count with no cookie.
• Diagrammo Cloud — the optional hosted side. You sign in, and your diagrams are stored on our servers so a team can share them. That means we hold your email address and your diagram content. This page says exactly what that involves.

If you have never signed in, only the first half applies to you.

Who this notice is from. Diagrammo is operated by Diagrammo LLC, a limited liability company formed in Colorado, United States. Where this page says “we”, it means that company — and for anything covered in Part 2 it is the controller, meaning the party that decides what is collected and why, and the one you can hold to everything written here.

Part 1 — The app (desktop & web editor)

Diagnostics summary

• What we collect: sanitized error messages, sanitized stack traces, app version, platform, and a per-install random ID. Your IP address is visible to PostHog, the error-tracking service that receives the events (see Who else touches your data, in Part 2); we don’t use it to identify you.
• What we don’t collect: your file content, file names, full filesystem paths, the diagrams you author.
• Retention: 90 days.
• How to turn off: Settings → toggle off Send error reports to help fix bugs.

Events we capture

Each event sends only the listed properties.

app_opened

When the app launches. Properties: app version, platform (tauri desktop or web), and the chart type of the last opened file (derived from file extension only).

diagram_rendered

When a diagram successfully renders. Property: the chart type from a fixed list (e.g. sequence, flowchart, erd, kanban, org, c4).

next_steps_shown, next_steps_acted, next_steps_dismissed, next_steps_done, next_steps_setting

The next-steps card: when it is shown, when one of its buttons is pressed, when it is closed, the first time a step is seen done, and when Show next steps is switched in Settings. Properties: the step from a fixed list (e.g. live-link, export, ai), where the card was drawn (launch, pane or account), whether a close hid the step, and the switch’s new setting. Nothing about your diagrams or your account.

app_crashed

Once per session if a recovery snapshot is found on launch. Properties: app version, file-extension-derived diagram type, and a short label describing what the app was doing before the crash (from a fixed allowlist).

crash_loop_detected

Once per session if the app crashed twice within 60 seconds. Properties: tier (always 1), the 60-second window, and the activity label.

onboarding_path

Once when a new install picks a folder. Property: default, suggestion, custom, or existing.

$exception

When an uncaught error escapes a React boundary, an async catch, or an unhandled rejection.

• Sanitized error message (paths stripped, capped at 500 characters)
• Sanitized stack trace (paths stripped, capped at 4000 characters)
• An error_class label from a fixed list: render_error, export_error, update_error, fs_error
• Narrow context fields: which UI panel crashed, update phase (check/install), filesystem operation, export format, or a base filename without path or extension. None of these carry user content.

What is NOT captured

• Your diagram content. The DSL you type, the diagrams you render — none enters any event.
• File or folder names. Path shapes in messages and stack traces are stripped before sending.
• Browsing. No pageview tracking, no docs-page tracking, in these events. The web editor’s page views are counted separately, without a cookie, by Cloudflare Web Analytics — see Who else touches your data, in Part 2.
• Session replay. Not used.
• Funnels, cohorts, A/B tests. Not used.

Pseudonymity, not anonymity

The per-install ID is a random UUID generated on your device the first time Diagrammo starts. Diagnostics carry no name, no email, and no account identifier — they are not joined to a Cloud account even if you have one. But because the same UUID is reused across launches, two events from the same install are linkable to each other. That’s pseudonymity, not anonymity.

Opting out

Settings → Send error reports to help fix bugs. The opt-out is honored at the SDK level so any in-flight events are dropped.

Part 2 — Diagrammo Cloud

This part applies only once you sign in. Signing in is optional; the app is fully usable without it.

The short version

• We store your email address, your display name if you set one, and the diagrams you push to a space. Diagram source is text you wrote, so it is whatever you put in it — treat a space the way you’d treat any shared drive.
• We don’t sell anything, show ads, or run behavioural profiling. There is nobody to sell it to; the product is the product.
• We never run AI over your diagrams. Diagrammo’s AI features run on your own machine with your own key. Your diagram content is never sent to a model by us.
• Your export always works — including after you cancel a paid plan, if and when paid plans exist. Diagrams are plain text files and you can take them and leave at any time.
• You can have all of it deleted, and you can do it yourself — from the app, confirmed by a link we email you. Or email privacy@diagrammo.app and we’ll export what you want and destroy the rest.

What Cloud stores

What	Why it exists	How long we keep it
Your email address	It is your identity — sign-in links go to it, and invites are addressed to it	For as long as your account exists
Display name, if you set one	So teammates see a person rather than an address	For as long as your account exists
Sign-in sessions — including the browser or app user-agent string	So you stay signed in, and so you can see and revoke your own devices	30 days, then automatically deleted
Sign-in link and code records — always hashed, never the raw token	To make each link single-use and stop replays	Minutes. Deleted automatically once used or expired
Failed sign-in counters, keyed by email address or IP address	To stop somebody brute-forcing or spamming sign-in links	24 hours
Team space membership and role	To decide who may read or edit what	For as long as the membership exists
Pending invitations — the invited email address and role	So somebody who isn’t a user yet can be let in	Accepted: kept, as the record of how that person joined. Unaccepted: deleted a week after the invitation expires
Your diagram content — the .dgmo source you push and its title	It is the thing you asked us to host	The current version only — saving replaces the copy before it, and no version history is kept. Deleted diagrams are recoverable for 7 days, then destroyed — rows and files both
A copy of a diagram you are showing on the web, held briefly in Cloudflare’s cache	So a link that many people open doesn’t cost a fresh lookup every time	Up to five minutes, then fetched again. This is the diagram source — the picture is drawn in the reader’s own browser, and we keep no copy of it
An activity log — who did what and when, by account ID	Security. It is how a team can tell who granted access, who viewed a private diagram, and who deleted something	Kept for the life of the space (see Deleting everything, below)
Usage measurements — space and diagram IDs, action names, timings	To see whether the product works. No names, no email addresses, no content	3 months
Billing records, if paid plans exist and you subscribe	To take the payment	Handled by Stripe, the payment provider; we store only their reference IDs

Your diagrams on your own machine

The desktop app and the web editor keep a local copy of the diagrams in a space, so you can keep working offline. That copy is on your device, under your control, and is not encrypted by Diagrammo — it relies on your operating system’s disk encryption (FileVault, BitLocker). If you are removed from a space, the app deletes that space’s local copy the next time it runs.

Private, shown on the web, and what that really means

Diagrams are private by default. Private means private: every read is checked against your membership on the server at the moment you ask for it, and files are never served straight from storage.

If you deliberately show a diagram on the web, it becomes a genuinely public web page — anybody with the link can open it, its source is cached on servers around the world to make it fast, and search engines may index it. Stop showing takes it down, but neither instantly nor everywhere: our own cache can go on answering for about five minutes, and nothing we do reaches a copy somebody else has already saved, cached or archived. Only show what you’d be comfortable posting.

Who else touches your data

We keep this list short on purpose. It covers the app and Cloud together: for every service that receives personal data from Diagrammo, what it receives, where that is kept, and what makes sending it there lawful. Most of these services are in the United States, and for someone in the EU or UK that last column is the question.

Two terms the last column uses. The DPF is the EU–US Data Privacy Framework, which a US company joins so that personal data may be sent to it from the EU; the UK and Switzerland have extensions to it. SCCs are the European Commission’s standard contractual clauses, the fallback if a company’s DPF certification lapses; the module says who is the controller and who is the processor.

Who	What they receive	Where it is kept	What makes the transfer lawful
Cloudflare — hosting, the database and file storage	Everything in Cloud: accounts, diagrams, spaces. Usage measurements, which carry your country, the page path and a keyed hash of your IP address and browser whose key is deleted the next day. The Web Analytics beacon on this website and in the web editor: page views, no cookie. The desktop app’s update checks, which ask this website for the newest version with the app’s version, platform and processor type, and the app downloads counted here on their way to GitHub	The database and file storage: Western North America. A diagram you show on the web: cached worldwide. Analytics events and service logs: Cloudflare’s core data centres, worldwide	The DPF; if that lapses, SCCs — Module 2 for a personal account (we are the controller), Module 3 for team content (we hold it on the team’s instructions). The UK Addendum and the Swiss adaptations
Cloudflare Turnstile — the bot check at sign-in and on this website’s Send to my computer	Your IP address, passed on by our server with the check’s token	Cloudflare’s network	Cloudflare’s own terms. Its Turnstile privacy notice makes Cloudflare an independent controller of the signals it uses to improve bot detection, so the agreement in the row above does not cover this
GitHub — where the reports you send from the app become issues	A problem or diagram report you send from the app: your note (as the issue title), the diagram’s source, app and platform details, the tail of the app’s log, your account ID, and your email address unless you untick the box. It lands in a private repository. Your IP address whenever you download the app or the desktop app installs an update, because both files are served from GitHub	The United States and elsewhere; we choose no region	GitHub’s own terms. We have no customer agreement with GitHub, so it holds reports and download requests as an independent controller under its privacy statement, which relies on the DPF and SCCs
Stripe — payments, not live yet	Nothing today. When paid plans open: your account email and user ID, the space ID and its seat count. Card details go to Stripe directly and never touch our servers	The United States and India	The DPF; if that lapses, SCCs Modules 1 and 2 (we are the controller of our own billing data). The UK Addendum
PostHog — the app’s diagnostics (Part 1)	The per-install random ID, app version and platform, the named events and sanitized exceptions listed in Part 1. Your IP address is visible to it. No session recording, no automatic capture	The United States	The DPF, then SCCs Module 2, through PostHog’s data processing agreement, signed by Diagrammo LLC on 26 September 2026
Resend — every email Cloud sends	The recipient, subject and body of: sign-in links, account-deletion links, invitations, access requests to a space’s admin (with the requester’s name and message), and access-granted notices (with who granted it). An invitation also carries the space name, who invited you, the role and the diagram count	The United States (sent from US-East)	The DPF, with its UK extension; SCCs by role, Modules 1 to 3. Resend’s data processing agreement is accepted with its terms of service, so it is in force
Google	Only if you choose “Sign in with Google”. We receive your email address and name from them; they learn that you signed in to Diagrammo. And in the desktop app, when Cloud keeps failing and this website does not answer either, the app asks www.gstatic.com for an empty page to tell a dead connection from an outage of ours; Google sees your IP address	—	Nothing of yours is sent by our servers. The sign-in happens between you and your Google account, and the connectivity check is an ordinary web request; Google handles both under its own privacy policy

That’s the complete list. If it ever changes, this page changes first.

What Cloud never does

• No AI on your content. No model, ours or anybody’s, is shown your diagrams by us.
• No training on your diagrams. Not by us, not by a partner.
• No selling or sharing your data with advertisers, brokers, or anyone else.
• No behavioural profiling, session replay, ads, or cross-site tracking.
• No reading your private diagrams, other than the narrow case below.

The narrow case: we may look at specific content if you ask us to for support, if we must to investigate abuse or a security incident, or if we are legally compelled. Every private view is written to the activity log.

Your rights

Wherever you live, you can ask us to:

• See what we hold about you
• Export it — diagrams are plain text and you can take them at any time, with or without asking us
• Correct anything wrong
• Delete all of it
• Object to a particular use

Email privacy@diagrammo.app. We aim to reply within 30 days, and always inside the deadline the law where you live sets. We won’t charge you or make you jump through hoops.

Children

Diagrammo Cloud is not meant for children, and you must be 13 or older to create an account. We don’t ask anyone’s age when they sign up. If you learn that a child under 13 has an account, email privacy@diagrammo.app and we will delete it and everything in it.

Deleting everything

You can do this yourself. In the app, type your own email address to ask for deletion; we send you a link, and pressing the button on the page it opens destroys your account, your diagrams and their stored files. The link is good for a day, and opening it does nothing on its own — a person has to press the button, because mail security scanners follow links automatically and an act performed by merely opening one would not be your act.

Two acts through two channels is the point: typing the address makes it deliberate, and the emailed link proves it is you rather than somebody at your unlocked laptop.

Or just ask, and we will export anything you want to keep, then destroy the same things by hand.

One exception, and we’d rather be straight about it: the security activity log is deliberately tamper-evident, because a log a person can quietly edit is not a security log. Rather than delete those entries, we cut the link to you — your account ID is severed from them, so what remains records that something happened without recording that you did it.

Working out who you are

We are not trying to build a profile of you. But we should be clear that an email address is a direct identifier, and that an IP address counts as personal data in the EU and UK. We use IP addresses to rate-limit sign-in attempts and stop abuse — which includes passing yours to Cloudflare Turnstile, the bot check, when you sign in or ask this website’s phone page to email you its link — and to count visits without keeping them: usage measurements carry only a keyed hash of the address and your browser, and the key is deleted the next day. We don’t build any profile from them, and we throw the addresses themselves away after 24 hours.

Where your data lives

Cloud’s database and the files your diagrams live in are held by Cloudflare in Western North America. A diagram you show on the web is also cached worldwide, and Cloudflare keeps analytics events and service logs in its core data centres worldwide. We are based in the United States, so if you are in the EU or UK, using Diagrammo sends your data to us in the US. Every service we pass it on to is named in Who else touches your data, above, with what makes that transfer lawful.

Teams and companies

If you use Cloud as part of a team, there are two layers. We decide how account data works — that’s on us. Your team decides what goes in its diagrams — we hold that content on their instructions, not our own. If your organisation needs a data-processing agreement covering that arrangement, email privacy@diagrammo.app and we’ll provide one.

If something goes wrong

If your data is exposed in a breach, we will tell you and the relevant regulators as fast as the law requires and, where we can, faster.

Children

Diagrammo isn’t built for or aimed at children under 16, and we don’t knowingly keep accounts for them.

Part 3 — Asking to be told when something ships

At the foot of this website there is one field, labelled Stay up to date, where you can leave an email address to hear from us. It has nothing to do with the app or with a Cloud account, so it gets its own part.

What we store: the address you typed, which of the asks it was, the page you asked from — the path only, never the query string — and the date. No name, no cookie, no profile, and it is not joined to a Cloud account even if you have one with the same address.

And, for 24 hours, a counter. Submitting also increments an abuse counter keyed by your email address and by your IP address, in the same table used for sign-in attempts. It is what stops one machine filling the list with addresses. Those counter rows are deleted automatically 24 hours later; your IP address is not stored anywhere else and never reaches the record above.

What we do with it: count it, and sometimes write to you.

Counting is the main thing — we are working out whether enough people want to hear from us to be worth running a mailing list at all. Alongside that, a real person may write to you directly: a short question about what you are building with Diagrammo, or news we think you specifically would want. It comes from a person, it is not automated, and replying to it reaches that person.

What we are not doing is sending bulk announcements to everyone on this list. If that starts, this page changes first and every one of those messages will carry a way to unsubscribe.

How long we keep it: until you ask us to remove it, or until we decide not to run a list and delete the lot.

Getting off it: email privacy@diagrammo.app and every record of your address here is deleted. Because nothing is sent yet there is no unsubscribe link to click, which is exactly why the address above is the answer.

If someone else entered your address: tell us and we will delete it. The field does not ask you to confirm by email, because confirming is only meaningful once something is being sent — see the note above.

Changes

If we ever expand what’s collected, this page is updated before the change ships and release notes call it out explicitly.

4 October 2026 — the phone page’s Send to my computer field now runs the same Cloudflare Turnstile bot check as sign-in, so the Turnstile row and the paragraph on IP addresses name it too. Using the field passes your IP address to Cloudflare with the check’s token, as signing in already did. The address you type is still used for that one email and not kept.

26 September 2026 — Who else touches your data now names every service that receives personal data, and for each one what it receives, where it is kept and what makes sending it abroad lawful. The list said it was complete and was not: GitHub has received the reports you send from the app and every download of it, PostHog the app’s diagnostics (Part 1 called it only “the third-party error-tracking service”), Cloudflare Turnstile the IP address of whoever signs in, Cloudflare Web Analytics the page views of this website and the web editor, and Google the desktop app’s connectivity check; the desktop app’s update checks were not mentioned at all. Stripe, until now “the payment provider”, is named and marked not live. Where your data lives said Cloud stays in a single region, and that EU and UK data is handled in the US “under the appropriate safeguards” without naming any; it now says where each copy is kept and points at the table. Nothing about what is collected, kept or shared has changed — the page now describes what was already happening.

18 August 2026 — the retention row for your diagram content said a deleted diagram was recoverable for 30 days. The real window became 7 days on 17 August 2026 and this page went on saying thirty for a day; the row now says seven. Nothing else about what is collected, kept or shared has changed, and the row above it — sign-in sessions, kept 30 days — is a different thing on a different clock and is unaffected. The terms were corrected the same day.

17 August 2026 — erasure is now something you can carry out yourself, so Deleting everything and the summary bullet above it describe how instead of only telling you to email us. The mechanism shipped to the web editor today: you type your own address in the app, we email a link, and pressing the button on the page it opens destroys the account, the diagrams and their stored files. Emailing us still works and is still the route if you want an export first. Nothing about what is collected, kept or shared has changed, and the activity-log carve-out below is unaffected.

16 August 2026 — the row describing your diagram content said we keep the last ten versions of each one. We stopped keeping any on 13 August 2026: only the current version is stored, and saving replaces the copy before it. The row now says so, and no longer lists “recent versions” among the things we hold. Nothing else about what is collected, kept or shared has changed — in particular the 30-day window for restoring a deleted diagram is unaffected. The terms were corrected the same day.

10 August 2026, later — the addresses on this page moved from a personal Proton mailbox to the domain itself. Data export, erasure, data-processing agreements and removal from the mailing list now go to privacy@diagrammo.app; general questions to hello@diagrammo.app. Security reports and copyright complaints in the terms moved to their own addresses too. All of them reach the same person; separating them is so a request carrying a legal deadline is not buried among general mail. Nothing about what is collected, kept or shared has changed.

10 August 2026 — the website now has a field for leaving an email address to hear about releases, and Part 3 describes it. Nothing is sent to those addresses; they are being counted to see whether a mailing list is worth running. Nothing about the app or Cloud changed.

9 August 2026 — this notice now names the company behind it. Diagrammo LLC was formed on 8 August 2026; until today the terms named it and this page said only “we”. Nothing about what is collected, kept or shared has changed. The link to this page was also added to the footer of every page — before today it could be reached only from inside the terms.

7 August 2026 — we stopped drawing diagrams on our servers, so the row describing a store of cached pictures was removed; nothing of the kind is kept any more, and a diagram is drawn in the reader’s own browser. In its place is the one copy that does exist: the source of a diagram you are showing on the web, held in Cloudflare’s cache for up to five minutes. The section on showing a diagram now says how long stopping takes to bite.

28 July 2026 — rewritten for Diagrammo Cloud. The previous version described only the desktop app’s diagnostics and said we never see your name or email, which stopped being true when Cloud launched with accounts. Part 1 is unchanged in substance; Part 2 is new.

Contact

Questions, requests, complaints: hello@diagrammo.app, or write to Diagrammo LLC, Colorado, United States.