Legal
Privacy policy
What Diagramma collects, why, who else receives it, how long we keep it, and how to have it erased.
The short version
- We keep your account, your projects and what you put in them. We don’t sell data or show ads.
- Diagramma uses no AI. Nothing you put in is sent to an AI provider, by us or for us.
- A share link shows a copy of a project to anyone who has the link, without an account, until you revoke it.
- This site, www.diagramma.design, sets no cookies and stores nothing in your browser.
- To have data erased, email privacy@diagramma.design. Deleting a project in the app doesn’t erase its data or revoke its share links.
Who we are
Diagramma is run by AGBK Productions LLC, 240 Harriman Road, Irvington, NY 10533, USA (“we”, “us”). We decide how the data on this page is used, which makes us its controller. Email us at privacy@diagramma.design.
This policy covers www.diagramma.design, the Diagramma app at app.diagramma.design, and the pages that share links open. The app runs on Iridiom, the software platform Diagramma is built on, so some screens and emails there may use the Iridiom name, and share links open at an address ending in iridiom.com.
What we collect about you
Everything below comes from you, or from Stripe and your sign-in provider. We don’t buy data about you.
Your account
| Data | What it is, and why we have it | How long we keep it |
|---|---|---|
| Account details | Your name, email address and password, which we store only as a one-way hash. If you sign in with Google or Microsoft instead, the name, email address and profile picture they share with us. Also your workspace. Used to sign you in and run your account. | Until you ask us to delete your account. |
| Sign-in and security records | Each sign-in and failed attempt, with your email address, IP address and browser details. Used to keep accounts secure and to limit repeated attempts. | 90 days, then deleted by the weekly clean-up. A count of failed attempts is kept on your account until you next sign in or change your password, and the time of the last failed attempt until your account is deleted. Counters that limit repeated attempts last at most an hour. |
| Purchases | What you bought, when, and how much you paid, plus the customer record Stripe keeps for us: your email address and our internal account IDs. You type your card and billing details into Stripe’s own form, and they never reach us. Used to take payment, give you what you bought, and keep accounting records. | Kept as accounting records. We don’t delete them on request while tax or accounting law requires us to keep them. |
Your projects
| Data | What it is, and why we have it | How long we keep it |
|---|---|---|
| Your design system | Everything you set in a project: its name and description, its colours, typefaces, scale, spacing, shape, elevation, motion, layout and icon settings, and which tab you last had open. Used to show and edit your design system and to make its deck and files. Saving replaces the previous version; we keep no history. | Until you ask us to erase it. Deleting a project in the app doesn’t erase it. |
| Names and contact details you add | The client name, and your own name, email address and website, if you type them into a project’s Settings. Used to print them on the deck: the client’s name on the cover, yours at the foot of each slide. | Until you clear them in Settings. Links you have already shared keep the details they were made with until you revoke them. |
| Logo and voice | The logo and icon you upload (SVG files of up to 64 KB each) and what you write about the brand’s voice and tone. Used for the logo and voice pages of the deck and the matching parts of the files. | Until you remove the logo or clear the text. Otherwise kept until you ask us to erase it. |
| Font files you upload | Font files of up to 5 MB each, with the family name, weight and style you give them and your confirmation that the licence allows web embedding. Used to show the typeface in the editor and to embed it in the deck. | Until you remove the font in the app. A link you have already shared keeps its own copy until you revoke it. |
| Share links | For each link you make: a copy of the design system as it was at that moment, with the label you gave it and any uploaded fonts it uses. Also a list of your project’s links, with their labels and the dates they were made. Used to show the deck, the previews and the files to anyone who opens the link. | Until you revoke the link. Deleting a project doesn’t revoke its links, so revoke them first, or ask us to. |
| Project cards | For each project, its name, its brand colours and the names of its two main typefaces. Used to draw the project’s card on Your projects. | Until you ask us to erase it. |
Records of use
| Data | What it is, and why we have it | How long we keep it |
|---|---|---|
| Records of use | A record of each request the app makes to our platform: your account, what was asked for and how long it took. Used to run the service, control costs and investigate faults. | Kept as business records. If you ask us to delete your account, we remove your details from them. |
| Logs and error reports | Technical records of requests and errors, which can include a project’s ID or a font’s name. Some errors go to Sentry, our error-monitoring service. On app.diagramma.design’s own pages (sign-in, checkout and the frame around the app), Sentry may also record a small share of visits, with anything typed into forms hidden. It doesn’t record inside the Diagramma app itself. | Deleted by a weekly clean-up once they’re old enough: app logs after 7 days, error records after 90 days, audit records after 1 year. Error records we flag for an investigation are kept until we unflag them. What Vercel and Sentry keep follows their own retention. |
| Emails to us | Anything you send to hello@ or privacy@. Used to answer you and handle your requests. | As long as we need it to answer you or to show we handled your request. |
To have an account, you need to give us your name, email address and a password, or sign in with Google or Microsoft. To buy a plan, you give your payment details to Stripe. Without these we can’t provide Diagramma. Everything else is up to you.
A design system is colours, type and measurements. Please don’t put sensitive information about anyone in a project’s name, description or voice text. Diagramma doesn’t need it.
Share links, and the people who open them
When a Diagramma customer makes a share link, we store a copy of that project as it was at that moment: its settings, its logo and voice text if any, the names and contact details the customer added, and any font files it uses. Anyone who has the link can open it.
If you open a share link, you don’t need an account and we don’t ask who you are. The page sets no cookies and stores nothing in your browser. We don’t count or record who views a link.
What is processed. Standard request data (your IP address, your browser, the address asked for) reaches Vercel and Cloudflare, who serve the page and the deck. The deck loads its typefaces from Google Fonts, and the page loads a styling script from Tailwind’s CDN, so those services receive your IP address and browser details too. See Who else receives it.
Who controls the link. The customer who made it. They can revoke it at any time, and it then stops opening.
People named in a project
A customer can type a client’s name, and their own name, email address and website, into a project. Those are printed on the project’s deck and included in any link shared from it. If your name or contact details are in a Diagramma project or deck and you want them removed, ask the person who shared it with you, or email privacy@diagramma.design with the link. You don’t need an account or a reason.
What we use it for
- Making your design system. Your settings are used to work out the tokens, the deck, the example screens and the files. That happens on our own systems. No AI is involved, and nothing you put in is sent to an AI provider.
- Showing what you share. A shared copy is shown to anyone who opens the link you made.
- Running the service. Signing you in, taking payment, counting the projects your plan has used, stopping abuse and fixing faults.
- Answering you. Support and privacy requests.
We don’t sell personal data, share it with advertisers, or show ads. We don’t use your data to train AI models.
Diagramma makes no decision about anyone that has legal or similarly significant effects.
Legal bases (UK and EU GDPR)
- Contract: running your account and projects, showing what you share, and taking payment.
- Legitimate interests: security and preventing abuse; logs, error monitoring and page analytics; serving a shared link to whoever opens it; keeping the names a customer adds to a project.
- Legal obligation: keeping purchase records, and answering rights requests.
Who else receives it
These providers process data for us, to run Diagramma. Each gets what its job needs.
| Who | What they do | What reaches them |
|---|---|---|
| Supabase | Database | Everything described on this page except font files: accounts, projects and their design systems, share links and the copies behind them, purchase records and logs. |
| Cloudflare | Runs the Diagramma app, and stores font files | Every request the app handles, including your name and email address, and requests from people who open a share link. Stores the font files you upload. |
| Vercel | Hosting for this site, for app.diagramma.design and for the address share links open at, and page analytics on app.diagramma.design | Standard request data (IP address, browser, the page asked for), all traffic to app.diagramma.design and to share links, and page views and load times on app.diagramma.design’s own pages. |
| Stripe | Payments | Your email address, our internal account IDs, what you’re buying and the amount, plus the card and billing details you type into Stripe’s form. |
| Resend | Account emails, such as welcome and password reset | Your name, email address and the email’s content. |
| Sentry | Error monitoring | Error details and browser information. From a small share of visits to app.diagramma.design’s own pages, a recording of what was on screen, with form fields hidden. |
| Upstash | Limits on repeated requests, and short-lived caching | Your email address or IP address, as a counter that lasts at most an hour, and short-lived copies of some account settings. |
| Google or Microsoft | Sign-in, only if you choose it | Your sign-in with them. They send us your name, email address and profile picture. |
| Google (Fonts) | Serves typefaces on app.diagramma.design, inside the app and in every deck | Your IP address and browser details, when a page loads its fonts. This includes anyone who opens a share link. |
| Tailwind Labs | Serves a styling script the Diagramma app loads | Your IP address and browser details, when the app or a share link loads. |
| DreamHost | Email for hello@ and privacy@ | The emails you send us. |
We’ll also disclose data when the law requires it, to protect our rights or someone’s safety, or to a buyer if the business is sold. In a sale, this policy keeps applying until you’re told otherwise.
How long we keep it
The tables under What we collect about you give the period for each kind of data. In short:
- Project data (settings, names, logo, voice, fonts and project cards) isn’t deleted automatically, and stays when you delete a project. It’s erased when you remove it in the app, where the app lets you, or when you ask us.
- Share links and the copies behind them stay until you revoke them, including after the project is deleted.
- Logs are deleted by a weekly clean-up, at its first run after they reach their age:
- App logs: 7 days.
- Sign-in and security records: 90 days.
- Error records: 90 days (any we flag for an investigation are kept until we unflag them).
- Audit records: 1 year.
- Purchase records are kept for accounting.
- Backups. Our database provider keeps backups so data can be recovered after a fault. Data you’ve asked us to erase can remain in those backups until they expire.
Cookies and browser storage
www.diagramma.design sets no cookies, runs no analytics and stores nothing in your browser. Its typefaces are served from this site itself, not from a font service.
The page a share link opens sets no cookies and stores nothing in your browser either.
The app at app.diagramma.design uses the cookies and storage below. None of them is for advertising.
| Name | What it’s for | How long |
|---|---|---|
__Secure-Cookie | Keeps you signed in. | 24 hours. |
next- __Secure-Cookies | Protect the sign-in form, and return you to the page you were on. | Until you close the browser. |
tenant-Cookie | Knows you’re signing in to Diagramma. | 1 hour. |
iridiom-Cookie | Remembers whether you chose light or dark. | 1 year. |
theme activeWorkspaceIdLocal storage | Your light or dark choice, and the workspace you last used. | Until you clear it. |
iridiom:Session storage | Which error notices you’ve already seen. | Until you close the tab. |
dg:Local storage, inside the app | Carries the name you gave a new project from the project list into the editor. | Removed once used, and ignored after 2 minutes. |
| Stripe’s own cookiesAt checkout | Set by Stripe to process payment and prevent fraud. | See Stripe’s privacy policy. |
app.diagramma.design also runs Vercel Web Analytics and Speed Insights, which count page views and measure how fast pages load, and Sentry, described under Records of use. Its pages and the app load fonts from Google Fonts, and the app loads a styling script from Tailwind’s CDN, so those services receive your IP address and browser details. See Who else receives it.
A deck you export as a file is yours, on your own machine. Opened in a browser, it remembers the width of its slide list in that browser’s storage, and loads its typefaces from Google Fonts.
Deleting your data
- A share link. Revoke it in the project’s Share dialog. The shared copy is deleted and the link stops opening.
- A font. Remove it on the Typography tab. The file is deleted. Links already shared keep their own copy until you revoke them.
- A logo, names or voice text. Remove or clear them in the project.
- A project. Deleting a project removes it from your list, but doesn’t erase its data from our systems and doesn’t revoke its share links. Revoke the links first.
- Everything else. To erase a project’s data, the links of a project you’ve already deleted, or your whole account, email privacy@diagramma.design from the address on your account. We’ll confirm when it’s done.
Your rights
Depending on where you live, you can ask us to:
- tell you what data we hold about you, and give you a copy;
- correct it;
- erase it;
- limit how we use it;
- give it to you in a machine-readable form to take elsewhere; or
- stop using it where we rely on legitimate interests.
Email privacy@diagramma.design. It’s free. We may ask you to confirm who you are first. We answer within one month. If a request is complex, we may take up to two more months, and we’ll tell you why.
If you’re in the UK or EU and not happy with our answer, you can complain to your data protection authority: the ICO in the UK, or the authority where you live in the EU.
US state privacy rights
If you live in a US state with a consumer privacy law, such as California:
- What we collect: identifiers (name, email address, IP address), commercial information (purchases), internet activity (sign-in and usage records, logs), and the content you give us. The sources and purposes are described above.
- Who receives it: only the service providers listed above, for those purposes. We don’t sell personal information, or share it for cross-context behavioral advertising.
- Sensitive information: we collect your Diagramma sign-in (email address and password), which the law counts as sensitive, and use it only to sign you in and keep your account secure. We don’t use it to infer anything about you.
- Your rights: to know, correct and delete what we hold. Email privacy@diagramma.design, yourself or through an authorized agent. We’ll confirm who you are, answer within the time given under Your rights and never later than the law allows, and won’t treat you differently for asking. If we turn a request down, you can appeal by replying to our answer.
Security
Every page and request uses HTTPS. Passwords are stored only as one-way hashes. Card details never reach us. A share link is long and random, so it can’t be guessed; anyone you give it to can open it.
No system is perfectly secure. If a breach affects your data, we’ll tell you and the relevant authorities as the law requires.
Where data is processed
We’re based in the United States, and our providers process data in the United States and in other countries where they operate. If you’re in the UK or EU, your data is transferred to the United States.
Children
Diagramma is for people 18 and over. We don’t knowingly collect data from anyone younger. If you think a child has given us data, email privacy@diagramma.design and we’ll delete it.
Changes to this policy
If we change what we collect, who receives it or how long we keep it, we’ll update this page and the date at the top. If a change matters to account holders, we’ll email them before it takes effect.
Contact
AGBK Productions LLC, trading as Diagramma
240 Harriman Road, Irvington, NY 10533, USA
privacy@diagramma.design
See also the terms of service.