← Back to Diagravo

Privacy Policy

Last updated October 2026

This Privacy Policy explains what personal data Diagravo ("we," "us," "Diagravo") collects, why, and how it's handled. Diagravo is run by Powerzam Studio, a sole proprietorship based in Denmark, which is the controller of your personal data. If you have questions, contact contact@diagravo.com.

1. Data we collect

Account data (only if you sign up — guests are not tracked, see section 2): email address, name (if provided), and authentication data handled by our authentication provider (Better Auth).

Sign in with Google (optional): if you choose "Continue with Google", Google tells us your name, email address and profile picture, and we use them to create or sign in to your account. We receive nothing else from your Google account (not your contacts, mail, files or calendar), and only when you choose to sign in this way. If you already have a Diagravo account with the same email, the two are linked into one account. Google handles your data under its own privacy policy.

Diagram data: the architecture diagrams you create — component layout, attributes, connections, and the diagram's name. This is the core content of using the product and is tied to your account once saved.

Custom icons: if you upload your own images to replace component icons, we store them for your account.

Sign-in sessions: each time you sign in on a device, we keep a session record so you stay signed in. It holds the browser and system the sign-in came from (read from the browser's user-agent text, for example "Chrome on Windows"), the IP address it came from, and when it was created and last used. You can see the devices in the Account window under Signed-in devices and sign any of them out; we do not show the IP address or share this information with anyone. A session record is deleted when you sign out, when it expires, or when you delete your account.

Collaboration data: if you invite someone to a diagram, or are invited to one, the people involved can see each other's name and email address and, while the diagram is open, who else is in it and what they have selected or where their cursor is. The invitation email shows the inviter's email address. Live changes pass through our servers so they can reach the other people in the diagram.

Waitlist: if you join the waitlist for a plan that is not available yet (today, Team) on the pricing page, we keep your email address, the plan, the date, and the note about what your team would need if you wrote one. We use them only to email you once when that plan is available and to decide what to build first, and we do not share them or use them for anything else. We keep them until the plan launches or you ask us to remove them (write to contact@diagravo.com). Joining is optional, needs no account, and the same address is stored once.

Billing data: paid plans are processed by Creem, our payment provider and Merchant of Record — we do not receive or store your card details. We keep your plan, its status and renewal date, Creem's reference identifiers for your customer record, subscription and checkout, and, if you are refunded, the number of refunds and the date of the last one (so that the once-per-customer refund in our Terms can be applied).

Technical data: standard server logs (IP address, browser type, timestamps) generated by our hosting infrastructure (Cloudflare) for security, abuse prevention, and debugging. In addition, when you sign up, sign in, ask for a password reset, ask for a new verification email or join a waitlist, we keep a counter tied to your IP address so that a flood of attempts can be slowed down. These counters are deleted automatically within a few hours.

2. Guest usage — nothing about you is collected

Diagravo's core diagramming features (drag-and-drop, JSON editing, validation, flow-playback animation, JSON/PNG export) run entirely in your browser and can be used without an account. If you don't sign up, we do not create an account or profile for you, do not track you by IP or device, and store nothing about your session. Your diagrams are saved only in your own browser's storage on your device, where we cannot see them. Data about you is only created the moment you choose to sign up and sync a diagram.

Anonymous usage counts. To learn whether Diagravo is useful — for example, how many visits lead to someone pressing "Create Diagram" — the app sends one small message when one of a fixed list of things happens: the home page or the pricing page is opened, "Create Diagram" is pressed, the editor is opened, a diagram is played or saved for the first time in a visit, a share link is published, an account is created, and whether the "keep your diagrams safe" reminder was shown or used. Our server adds one to that day's total for that event. That total is the only thing kept: no identifier, cookie, IP address, device or browser details, account, or diagram content is attached or stored, so a count cannot be traced back to a person. Each message is sent at most once per visit, and nothing is written to your device for it. If your browser sends Do Not Track or Global Privacy Control, nothing is sent. (Like any website, our hosting provider still sees your IP address in its standard server logs; see section 1.)

What stays in your browser. Diagravo uses your browser's local storage — not cookies — to keep your diagrams saved on your device, a backup of unsaved work in case the page is closed or crashes, and the reminder date described next. This stays on your device and is not sent to us unless you choose to sync a diagram to your account, or to download the starter code (Export Code): that sends the diagram to our server for the moment it takes to build the files, and it is not stored.

A reminder stored on your device. If you use Diagravo without an account and have saved more than one diagram, we may remind you that they live only in your browser and offer to create an account. If you dismiss it, your browser remembers that for two weeks (a single date in local storage); nothing about it is sent to us.

3. Published diagrams are public

If you click Publish, your diagram becomes viewable by anyone who has the generated link — no account or password is required to view it. Don't publish diagrams containing information you consider confidential or sensitive. You can tell who has viewed a published link only in aggregate (a view counter); we don't track individual viewer identities. Publishing again updates the same link rather than creating a new one.

You can take a link down yourself: removing the diagram from the cloud (in My Diagrams) or deleting your account removes the link at once. To report a published diagram that you believe is unlawful or infringes your rights, email contact@diagravo.com with the link and what is wrong, and we will review it.

4. How we use your data, and why

  • To provide the service — save your diagrams, let you collaborate, serve published links, manage your account, and send the emails it needs (verification, password reset, invitations). Legal basis: performance of our contract with you (GDPR Art. 6(1)(b)).
  • To enforce usage limits, to take payment for paid plans and to keep the accounting records the law requires. Legal basis: performance of our contract with you, and legal obligation (Art. 6(1)(b) and (c)).
  • To keep the service secure and working — server logs, the abuse-prevention counters in section 1, rate limiting, and debugging. Legal basis: our legitimate interest in protecting the service and its users (Art. 6(1)(f)).
  • To understand, in aggregate, whether Diagravo is useful and where people get stuck (the anonymous daily counts described in section 2). Nothing personal is stored for this; to the extent any data is involved, our legitimate interest in improving the product is the basis.
  • To communicate with you about your account (for example, password resets and security notices) — not for marketing without your separate consent.

We do not sell your personal data, we do not make decisions about you by automated means that have legal or similarly significant effects, and we do not use your diagram content to train any AI model.

5. Data storage and processors

Your data is stored using the following third-party processors, each under their own data processing terms:

  • Cloudflare (D1 database, R2 storage for custom icons, Workers, Pages, and Durable Objects for live collaboration) — hosting and infrastructure.
  • Better Auth — authentication (self-hosted on our infrastructure; no separate third-party data transfer for auth itself).
  • Brevo — delivery of verification, password-reset and collaboration-invitation emails, a short email confirming a refund when one is issued to you, and the one email telling you that a plan you joined the waitlist for is available.
  • Google — sign-in, only if you choose "Continue with Google". Google decides for itself how it handles the data it holds about you.
  • Creem — payment processing and billing (Merchant of Record).

6. Your rights (GDPR)

If you're in the EU/EEA (or otherwise entitled to these rights), you can:

  • Request a copy of the personal data we hold about you.
  • Request correction of inaccurate data.
  • Request deletion of your account and associated data ("right to be forgotten").
  • Object to or restrict certain processing.
  • Request data portability.
  • Withdraw any consent you have given, at any time.
  • Complain to a supervisory authority: in Denmark, the Danish Data Protection Agency (Datatilsynet, datatilsynet.dk), or the authority where you live.

You can do two of these yourself, at any time, from the Account window (click your initial, top right): Download all my data (everything we hold about you, plus the diagrams saved on your device, as a zip) and Delete account (immediate and permanent). For anything else, or if you can't sign in, contact contact@diagravo.com. We will respond within the timeframe required by applicable law.

7. Data retention

We retain your account and diagram data for as long as your account is active. If you delete your account in the Account window, your account and its cloud data (diagrams, share links, custom icons) are removed from our live database straight away; copies held in our database provider's backups expire within 30 days. If you ask us to delete it by email instead, we do the same within 30 days. Billing records may be kept where retention is required by law (e.g., for tax purposes). Server logs and email delivery records kept by our providers follow those providers' own retention periods.

8. Cookies

Diagravo uses only the essential cookies needed for authentication and session management (your sign-in session, and a short-lived cookie while you sign in with Google). We do not use third-party advertising or tracking cookies.

9. International data transfers

Our infrastructure (Cloudflare) operates a global network, and some of our providers (for example Cloudflare and Google) may process data outside the EU/EEA. They rely on appropriate safeguards for such transfers, such as the EU Standard Contractual Clauses or the EU–US Data Privacy Framework.

10. Children's privacy

Diagravo is not directed at children under 16, and we do not knowingly collect personal data from children under that age.

11. Changes to this policy

We may update this policy from time to time. Material changes will be communicated via the email associated with your account or a notice on the site.

12. Contact

Questions about this policy or your data: contact@diagravo.com