Privacy policy

Last updated October 15, 2026

This policy explains what information diagramkit collects, how we use it, who we share it with, and the choices you have. diagramkit is an AI diagram builder. You can use it in our web app, through our API, or from an AI assistant such as Claude or ChatGPT through its MCP connector. It turns a description into a finished diagram or animation. In this policy, “diagramkit,” “we,” and “us” mean the operator of diagramkit, and “you” means anyone who uses the service or views a diagram made with it.

Information we collect

Account information. When you sign up, we receive your name, email address, and sign-in details from our authentication provider. We keep your plan, usage counts, and account settings, such as your brand and data retention.

What you ask for. In the web app and through the API, we receive your requests: the text you write, any images you attach, and your follow-up changes. We keep the conversation with each diagram so you can revise it later.

Diagrams. We create each diagram’s source code, notes, title, preview images, versions, and exports, and store them. When your AI assistant uses diagramkit, it sends us that source, notes, and title instead. Edits you make on the canvas are stored as new versions. All of this can include anything you or your assistant put into it, so avoid including sensitive personal information you do not want stored.

Brand information. On Team and Enterprise plans, you can save a brand: a name, colors, fonts, logos, house-style notes, and design tokens you import. We store it with your account or your organization.

Payment information. Stripe processes payments. We receive your subscription status, billing cadence, and the Stripe customer record for your account. We never see or store your full card number.

API keys. If you create API keys, we store only a one-way hash of each key, with its name and when it was created, last used, or revoked.

Usage and device information. Our servers log requests, including IP address, browser type, and timestamps, to run and secure the service. We count the diagrams and animations you make for your plan’s limits. The web app and diagramkit’s MCP server also record product analytics, described below.

Messages you send us. If you use our contact form or email us, we keep your message and contact details so we can reply.

Feedback through your assistant. If you ask your AI assistant to send feedback to diagramkit, we receive the feedback text and, when it names one, the title and ID of the diagram it is about. We use it only to improve diagramkit.

When you use an AI assistant, we do not receive your full conversation with it. We only receive what the assistant sends to diagramkit when it calls one of our tools.

How we use information

• To provide diagramkit: make, compile, store, display, export, and share your diagrams.
• To manage your account, plan limits, and subscription.
• To apply your brand and sharing settings.
• To secure the service, prevent abuse, and fix problems.
• To understand how diagramkit is used and improve it.
• To respond to your messages and send service notices, such as billing receipts.
• To comply with the law.

We do not sell your personal information. We do not use your requests or diagrams to train AI models, and we do not let our AI providers use them for training.

Service providers

We share information with providers that help us run diagramkit. They may use it only to provide their services to us.

• Clerk for sign-in and account management.
• Stripe for payments and subscriptions.
• Render for hosting our websites, servers, and database.
• Cloudflare R2 for storing diagrams, previews, and related data.
• Modal for compiling diagram source code and recording images, PDFs, SVGs, and videos in isolated sandboxes.
• OpenAI for the AI model that makes and revises diagrams. It receives your request, attached images, the conversation so far, and the diagram it is working on, and may run web searches to check facts. We ask OpenAI not to store these requests. OpenAI also turns short search phrases into embeddings so we can find the right diagram parts.
• OpenRouter, if we route a request to a model from another provider. It then receives the same information as OpenAI would.
• Langfuse for tracing how the AI model made each diagram, so we can fix problems and improve quality. Traces include your request text, the model’s steps, and its reply. Attached images are removed before a trace is sent.
• PostHog for product analytics in the account app and product events from diagramkit’s MCP server, such as a diagram being displayed or feedback being sent.
• Resend for delivering contact form messages and email.
• Google Fonts, when a brand names a Google Fonts family. Our server downloads the font from Google. Your visitors’ browsers do not contact Google for it.

If you use diagramkit from an AI assistant (for example Claude or ChatGPT), that assistant is run by its own provider under its own privacy policy. We do not control how that provider handles your conversations.

We may also disclose information if the law requires it, to protect the rights and safety of diagramkit or others, or as part of a merger, acquisition, or sale of assets. In a sale, we will require the buyer to honor this policy.

Private diagrams and downloads

Your diagrams are private. Only you, and on Team and Enterprise plans the members of your organization you share them with, can see them in diagramkit. When you download a diagram or animation, we create a download link that expires after 15 minutes. Images exported on the Free plan carry a small “Made with diagramkit” tag. We cannot recall copies of downloaded files that you pass on.

Data retention and deletion

We keep each diagram’s drawing, previews, and exports for 90 days from when it is made, then delete them automatically. Enterprise customers can set a different retention period. The conversation and version history of a diagram in the web app are kept until you delete the diagram or your account.

A preview that is never displayed or exported is deleted after one day. While your assistant revises a preview, we keep that preview’s source for up to two hours so a fix can be sent as a small edit, then delete it. Feedback is kept in our product analytics.

We keep brand information until you change or remove it, or until your account is deleted. We keep account and billing records while your account is open. After you close your account, we delete your account data within a reasonable time, except records we must keep for tax, accounting, legal, or security reasons. Backups and logs are cleared on their normal schedule.

You can delete any diagram in the web app at any time. To delete your account or anything else before it expires, email [email protected]. We will confirm the request and complete it promptly.

Enterprise customer storage

Enterprise customers can choose to store diagram content in their own S3-compatible bucket. In that case, we store the access credentials for that bucket in encrypted form. We keep only minimal metadata ourselves: diagram IDs, owner, title, and dates. The customer controls the content in its bucket, including how long it is kept.

Security

We protect your information with encryption in transit, access controls, private storage, and checks that each diagram is shown only to its owner or to people they share it with. Visual source code is compiled in isolated sandboxes. No system is perfectly secure, so we cannot guarantee absolute security. If we learn of a breach that affects your personal information, we will notify you as the law requires.

Cookies and analytics

We use cookies that are needed to sign you in and keep your session secure. The account app and this website use PostHog to understand how people use them, such as which pages they leave from. PostHog does not record every click, and it creates a person profile only for signed-in users. We do not use advertising cookies or sell data to advertisers. You can block cookies in your browser, but sign-in may stop working.

International transfers

diagramkit is operated from Canada, and our providers may process information in the United States and other countries. These countries may have different data protection laws than where you live. When we transfer information, we rely on appropriate safeguards, such as our providers’ contractual commitments.

Children

diagramkit is not intended for children under 16. We do not knowingly collect personal information from children under 16. If you believe a child has given us information, contact us and we will delete it.

Your rights

Depending on where you live, you may have the right to:

• Access the personal information we hold about you.
• Correct information that is wrong or incomplete.
• Delete your information.
• Receive a copy of your information in a portable format.
• Object to or restrict certain uses of your information.
• Withdraw consent where we rely on it.

To use these rights, email [email protected]. We may need to verify your identity first. We will not treat you differently for using your rights. If you are not satisfied with our response, you can complain to your local data protection authority.

Changes to this policy

We may update this policy. If a change is significant, we will tell you by email or in the service before it takes effect. The date at the top shows when the policy last changed.

Contact

Questions or requests about privacy: [email protected].