Privacy and local storage

Project data stays in this browser

The editor stores project names, shapes, connections, freehand drawings, and canvas settings in IndexedDB on this device. Editing, saving, importing, and exporting do not upload project data. Other devices and browser profiles only receive a copy if you share a link or file.

This is browser storage, not a backup service. Clearing site data, removing a browser profile, private browsing limits, storage eviction, or a device failure can remove projects. If local saving fails, the editor reports the failure. Export JSON copies for projects you want to keep.

Optional 24-hour sharing

Choosing Share and then Create link uploads a snapshot containing the diagram title, shapes, labels, notes, connections, drawings, and canvas settings. The browser encrypts it with AES-GCM before upload. Cloudflare stores the encrypted snapshot; its decryption key is in the part of the share link after # and is not sent to the sharing API.

Anyone with the complete link can view the snapshot or save a separate copy. Treat the link as access to the diagram. Later edits to the original do not update it. Shared pages are marked not to be indexed by search engines.

Links expire 24 hours after creation. The sharing API checks the expiry on every read, and the stored snapshot is configured to expire automatically. We do not use snapshots for analytics or advertising. Expiry does not remove copies that recipients have already saved, screenshots, downloaded files, or links from browser history. Cloudflare’s handling of infrastructure logs and backups is governed by its policies.

Opening a shared diagram does not automatically save it in browser storage. Save a copy creates a separate local document. Diagrams larger than 512 KiB cannot be shared by link; export a file instead.

Files you import and export

Imported JSON is read and checked in the browser. JSON, PNG, SVG, and PDF exports are generated in the browser and downloaded to the location you choose. These operations do not send the file contents to an external service. Copy and paste can use the system clipboard when the browser allows access. A file or clipboard selection you later share is subject to the recipient or service you choose.

Website requests

Your browser still requests the application and its assets from the website host. The host may keep ordinary request logs, such as IP addresses, requested URLs, browser information, and request times. Log handling and retention depend on the hosting provider. Do not put private information in a page URL.

The application does not include analytics, advertising trackers, or external fonts. The sharing API receives encrypted snapshots and ordinary request information only when a link is created or opened. The complete share link, including its decryption key, is not sent in HTTP requests. It does not use cookies for sign-in or tracking.

Deleting local data

Delete individual projects in the editor, or clear this site’s data in your browser settings to remove its saved projects. Deleting local projects does not delete downloaded files, recipients’ copies, or shared snapshots. Existing share links remain available until their 24-hour expiry.

Connection and shared devices

An already loaded editor can continue working without a connection, but this version does not install an offline application cache. Reopening or reloading it offline is not guaranteed.

Anyone with access to the same browser profile may be able to open its projects. Use a separate browser profile or device when you need to keep work separate.