Privacy Policy

Effective date: August 22, 2026 · Version 3.1

1. Who we are, and who may use Diagramium

Diagramium is made and operated by DhuRee Labs Inc. ("we", "us"), a small company in Ontario, Canada. We follow Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), which requires us to name someone accountable for privacy. DhuRee Labs Inc. has designated a Privacy Officer who can be reached at admin@dhureelabs.com. Where privacy laws outside Canada apply to our processing, we intend to comply with their applicable requirements.

Diagramium is available only to people aged 18 or older — every feature, with or without an account. Section 3.5 explains what that means for personal information; the Terms of Use state the full rule.

This policy covers the Diagramium service available on this website only, including what the app stores in your browser (section 4) and the service providers behind it (section 5).

2. Your diagrams stay on your device

Diagramium's editing, autosave, presentation and export features are designed to keep your diagram content on your own device: every editor saves your work to your browser's storage, and exports and recordings are produced locally as files you keep. No feature uploads your diagram content to us — there is no upload path in the app.

Two consequences worth knowing:

• We cannot recover your work. Clearing your browser's site data — or the browser itself evicting storage, or a private/incognito window closing — permanently deletes locally stored diagrams. Export files (File → Save, or Export → Project) for anything you care about.
• A presentation share link contains no diagram data — only the identifier of a ready-made diagram from our gallery.

Two device features the app uses on your instruction. One of them can involve your browser's own online speech service — the details matter, so they are spelled out:

• Narration voices. Diagramium uses speech voices exposed by your browser and operating system. Where the browser identifies a voice as local, Diagramium treats it as an on-device voice. Some browsers may process certain voices through their own online services. Browser-reported information about where a voice is processed may not always be complete or reliable. Voices believed to require online processing are labelled where reasonably identifiable. Diagramium does not operate its own text-to-speech server. Your browser or operating-system provider controls any processing performed by its speech service under that provider's privacy terms. Two things the app itself does: its automatic pick uses only voices the browser reports as on-device (and stays silent when none is reported, rather than falling back to an unidentified engine voice), and a voice labelled as an online (cloud) voice speaks only if you select it yourself — the app shows a notice when you do, and switching back to any other voice (or to the automatic pick) ends it.
• Screen and tab recording. Recording a presentation asks your browser for permission to capture the tab or screen, and your browser shows you what is being shared. The video is assembled on your device and saved as a file you keep. We never receive the recording.

3. What we collect or process

3.1 Engagement events (not linked to your account)

When a ready-made diagram from our gallery is opened, presented, liked, shared or watched, the app sends our database one row containing exactly these fields: the diagram's identifier; what happened — use (the diagram was opened), present, like, share or watch; and, for watch events, how many seconds the playback ran. We do not attach an account identifier, session identifier, authentication token or diagram content to these engagement events — the table has no user or session column at all. Our infrastructure providers may nevertheless process ordinary technical request information, such as an IP address, user agent and request time, in their server and security logs (section 3.3); the stored row itself carries none of that.

These rows are kept as aggregate totals per diagram (opens, plays, likes, shares, watch time), shown publicly on that diagram's tile and its presentation's title slide; the underlying event rows are retained indefinitely and describe the diagram, not any person.

Turning it off. Open the account panel and clear “Help improve the templates” (no sign-in needed), or use the “Usage counts” button on the gallery toolbar. If your browser sends Do Not Track or Global Privacy Control, we record nothing at all without your having to ask. Either way no feature is taken away.

What we deliberately do not collect: what you type into the search box, which filters you use, which pages you move between, how long you stay, what device you are on, or which site you arrived from.

3.2 If you create an optional account

Signing in is optional and uses your existing Google account through our authentication provider, Supabase. There is no Diagramium password — we never see or store one. Google authentication is an identity and sign-in method only: it tells us who you are, and it does not verify your age or enforce our age requirement. Before starting Google sign-in you must confirm yourself, by ticking an unchecked box, that you are at least 18 years old and accept the Terms of Use and this policy. An account holds:

• your name, email address and avatar image URL, as supplied by Google;
• an internal account identifier and standard authentication metadata created by Supabase to operate sign-in — such as the identity provider used, sign-in timestamps and session records;
• your account type — every account is the same free account;
• the identifiers of the diagrams you favourited and liked, so they follow you across devices;
• your acceptance record — when your account is created (and again if you accept updated documents after a material change), we store your account identifier, the versions of the Terms of Use and Privacy Policy you accepted, and the time of your confirmation. That record shows what you agreed to; it is your own declaration, and we do not treat it as verified proof of age. We do not ask for or store your date of birth.

That is the whole list. We use it to sign you in, to sync those two lists, and to show what you agreed to — nothing else. We never sell it, never share it for advertising, and never use it to build a profile of you.

3.3 Ordinary web requests

Loading any website sends technical data to the servers involved: your IP address, browser type (user agent), the time of the request and the URL requested. Our web host and our database provider see this in their standard server and security logs, retained under their own schedules; we do not use it to identify or track you. Requests to this website pass through our web host's own infrastructure, which may apply automated traffic protection and security verification before a page is served. All of Diagramium's own software, including the sign-in library, is served from this website's own address — loading the app contacts no separate software CDN, and the only servers the app itself talks to are this website and our database provider.

3.4 Email you send us

If you email us — a question, a correction, a report — we receive your email address and whatever you choose to include, and we use it only to handle the matter you wrote about. Those messages live in our email mailbox for as long as the correspondence is useful.

3.5 Age requirement — no one under 18

Diagramium is not directed to, and is not available for use by, anyone under 18 years of age. People under 18 must not access the accountless editor, browse or play ready-made diagrams, create diagrams, or use account features. We do not knowingly collect personal information through an account from anyone under 18, and we do not verify age — the sign-in confirmation described in section 3.2, and the first-use acknowledgement described in section 4, are declarations made by the person using the app. If you believe that a person under 18 has created an account or provided personal information to us, contact admin@dhureelabs.com. We will investigate and delete applicable account information where appropriate and legally permitted.

4. What is stored in your browser — cookies and local storage

This section is the complete inventory of what Diagramium keeps in your browser, on your device. In plain language, the three mechanisms it uses:

• A cookie is a small piece of data a website saves in your browser that is automatically sent back to the website's servers with every request — the classic tool for tracking people. Diagramium's own code sets no cookies at all — not for analytics, not for advertising, not for anything — and we use no third-party analytics services, tag managers, advertising pixels, error reporters or fingerprinting techniques. (We verified this against the production site; two honest caveats: our hosting provider could set operational cookies of its own to serve and protect the site — none were observed at the time of writing — and Google sets cookies on its own pages during sign-in, under its own policy.)
• localStorage and sessionStorage are browser features whose data stays on your device and is never automatically sent anywhere. A website's own code can read it on your next visit, but it does not travel with your web requests. localStorage persists until deleted; sessionStorage is wiped when the tab closes.
• IndexedDB is a browser database, similar in spirit: it lives on your device and is not sent anywhere automatically.

Diagramium is built "local-first": your diagrams live on your device, and local storage is how that promise is kept. Everything below is storage that works for you, not storage that watches you — none of it is analytics or marketing storage, which is why there is no cookie banner: under PIPEDA and the Privacy Commissioner's consent guidance, storage that is strictly necessary for a feature you are using, or that records your own preferences on your own device, may rely on implied consent. If we ever introduce optional analytics or marketing storage, we will update this policy first and ask for opt-in consent before any of it is set.

4.1 Your diagrams (autosave)

Every editor automatically saves your entire current document — titles, labels, notes, narration text, comments, structure and styling — to localStorage on each change, so a reload or crash does not lose your work. One key per diagram type: sequenceStudio.doc.v1 for the sequence tool, and flowDiagram.<tool>.v1 for the other 24 editors (fc flowchart, sm state machine, sl swimlane, kanban, mm mindmap, oc org chart, tl timeline, jm journey map, venn, gantt, site sitemap, pm process map, dt decision tree, ar architecture, df data flow, nw network, fb fishbone, uc use case, tm threat model, c4, cm concept map, uml, er, bpmn). Category: essential (saves your work). Lifetime: until you clear it.

4.2 Other content you create

4.3 Settings, preferences and privacy choices

These store how you like the app to look and behave. They contain no diagram content and no personal information — only settings values and template/icon identifiers.

4.4 Sign-in session (only if you sign in)

Signing out removes the session. These keys are stored in localStorage, not cookies, and are not sent automatically with ordinary web requests.

4.5 sessionStorage and IndexedDB

One sessionStorage key, flowDiagram.pr2.resume, keeps the current presentation's title and step number so you can resume a show you exited mid-way; it is deleted when the presentation completes or the tab closes. One small IndexedDB database, flowDiagram.files, keeps your Recent files list (up to 8 entries: file name, a "this device" label, a browser file handle — your browser asks permission again before any reopen — and a timestamp; file names, never file contents). Remove entries from the File menu; the downloadable single-file offline copy of Diagramium uses the same storage keys and behaves the same way.

4.6 Clearing this storage

Warning — read before clearing. Your diagrams live only on your device (and in files you export). Clearing this site's data permanently deletes your locally saved diagrams, custom icons, style presets and settings. We cannot recover them, because we never had them. Export important work first.

Inside the app: the “Clear cache” / “Clear locally cached data” buttons ask for confirmation, then remove Diagramium's localStorage entries except your theme choice, your usage-signal opt-out (clearing it would silently switch measurement back on for someone who turned it off) and your first-use acknowledgement. They do not sign you out and do not clear the Recent-files store. In your browser: use your browser's site-data controls to remove everything, including any sign-in session. Private/incognito windows delete everything in this section automatically when they close — including any diagrams made during that session.

5. Service providers, and where information is processed

Diagramium's local-first design keeps the sensitive part — your diagrams — off servers entirely, so the provider list is short. A service provider (subprocessor) is a company that processes personal information on our behalf; under PIPEDA we remain accountable for information we transfer to one, and we must use contractual and other means to see that it receives comparable protection.

Independent services you choose to use. Google LLC (Google sign-in) is not our service provider: it acts as an independent controller of its own service, only if you choose "Continue with Google". It authenticates you on its own pages under Google's privacy policy, receives the technical request data any site you visit receives, and shares with us only your name, email address and avatar image URL; your signed-in browser also fetches your avatar image from Google's image servers. Google sign-in does not verify your age or enforce Diagramium's 18+ requirement. If you select a narration voice labelled as an online (cloud) voice, your browser — not Diagramium — may send the narration text to that browser's speech provider, as described in section 2; Diagramium does not operate its own text-to-speech server.

International processing. Some providers store or process information outside Canada, including in the United States. PIPEDA permits transfers for processing but holds us accountable: information in a provider's hands must receive comparable protection, and you should know it may be accessible to the courts and authorities of those jurisdictions. We address this by transferring only the minimum each provider needs, relying on each provider's data-processing terms, and keeping your diagram content off servers entirely, by design. We use no analytics provider and no separate cloud-storage service, and no separate content-delivery network or security company sits in front of the site — traffic protection is part of our web host's own infrastructure (verified against the production site's network configuration and response headers, August 22, 2026). If we add a provider, we will update this section before it goes live.

6. Retention and deletion

• Account data, including the acceptance record: kept for as long as your account exists.
• Delete your account yourself — account panel → Delete my account. Deletion runs immediately and permanently removes your profile, authentication records, account type, favourites, likes and acceptance record from the live database. Copies may persist for a limited period in our providers' routine backups and security logs before they cycle out under the providers' schedules; they are not used for anything in that period.
• Engagement counts: kept indefinitely as event rows and running totals. They contain no account or session identifier, so there is nothing in them to link back to you or expire on your behalf.
• Provider logs: IP-level request logs at our web host and database provider are retained under those providers' own schedules.
• Email: kept in our mailbox for as long as the correspondence is useful.

Your requests. Email admin@dhureelabs.com to ask for access to, correction of, or deletion of your information. We respond to written access requests within 30 days, subject to any extension permitted by PIPEDA; if an extension is required, we will notify you within the initial 30-day period, explain the reason for the extension and tell you about your right to complain to the Office of the Privacy Commissioner of Canada. Access is provided at minimal or no cost, subject to applicable law. The same address is where to report a suspected under-18 account (section 3.5). Deleting your account does not touch the diagrams on your device; they were never ours to delete.

7. Your choices

• Use everything without an account. That is the default.
• Turn off the engagement counts — account panel → “Help improve the templates”, the gallery toolbar's “Usage counts” button, or a Do Not Track / Global Privacy Control signal from your browser.
• See or correct your account data — it is shown in the account panel; email us for anything else.
• Prefer on-device narration — the automatic pick uses only voices your browser reports as on-device; avoid selecting voices labelled as online (cloud) voices.

8. Security and breaches

Sign-in runs over HTTPS through Supabase, which stores account records with row-level access rules designed to prevent one account from reading another's, and we keep the amount of personal information we hold deliberately small — the most reliable protection we can offer. No system is perfectly secure, and we cannot guarantee absolute security. If an incident affects personal information, we assess it and provide notification to affected people and to regulators, and keep breach records, where applicable law — including PIPEDA — requires it.

9. Changes

If we change what we collect or store, we will update this policy and change the effective date at the top before the change takes effect, and — for material changes — ask signed-in users to confirm acceptance again. We keep this document matched to the software: the lists in sections 3, 4 and 5 are the complete lists, and they are meant to stay short.

10. Contact

Email admin@dhureelabs.com with any privacy question, correction or complaint. If you are not satisfied with our answer, you may contact the Office of the Privacy Commissioner of Canada (priv.gc.ca).