Legal
Privacy Policy
Effective September 2, 2026. Short, because the practices are simple.
What we collect
Account data (name, email, password hash, workspace name). Content you create or upload (diagrams, floor plans, guest lists, comments). If a diagram owner enables an email gate on a share link, the viewer emails entered there. What you ask the AI copilot, kept so we can see which requests it handles badly and fix them. And usage analytics, which we collect ourselves on our own servers rather than handing to a third-party vendor: pages viewed, features used, and your device and browser, tied together by first-party cookies (ed_aid, ed_sid, ed_ft) set on our own domain and nowhere else. We never record what you type into a form, and your IP address is stored only as a one-way hash.
Why we collect it
To run the product: sign you in, store and render your diagrams, deliver share links, send transactional email (invites, notifications, account messages), and understand aggregate usage well enough to improve the product. That’s the list.
What we never do
We don’t sell your data. We don’t sell viewer emails captured on your share links — those belong to the diagram owner’s workspace, not to us. We don’t use your private diagrams in marketing, and we don’t train AI models on your private content or on what you ask the copilot. We don’t track you across other companies’ websites: our cookies are ours alone and there is no third-party analytics or advertising script on the product.
Guest lists and attendee data
Attendee names and details you import are yours, treated as content. They’re used only to render your seating and exports, are never shared beyond the people you give access to, and are deleted when you delete them or your account.
Who processes data for us
Named plainly, under standard data-processing terms: DigitalOcean (application hosting, database, and encrypted off-site backups), Resend (transactional email), Stripe (payments — card details go directly to Stripe and never touch our servers), Anthropic (the AI copilot: when you use it, the diagram you're working on is processed to fulfil your request — it is not used to train models), Sentry (error tracking), Cloudflare (DNS and network), and Google Workspace (our support inbox). We’ll keep this list current as providers change.
Retention and deletion
Your content stays until you delete it or your account. On account deletion we remove your content from production systems promptly, and from any backup copy on that backup’s normal expiry. You can export everything first — exports are available on every plan, always.
Security
Passwords are stored as salted hashes (bcrypt), sessions use signed tokens, all traffic is HTTPS, and share links use unguessable tokens excluded from search indexing. Report security concerns to the contact below and we’ll respond quickly.
Your rights & contact
Ask us any time what we hold about you, request a copy, or request deletion: [email protected]. We’re based in Phoenix, Arizona, USA. Material changes to this policy will be announced by email or in-app.
See also our Terms of Service.