Privacy Policy

Effective date: October 2, 2026 · Version 5.0

1. Who we are

Diagramium is made and operated by DhuRee Labs Inc. ("we", "us"), a small company in Ontario, Canada. We follow Canada's Personal Information Protection and Electronic Documents Act (PIPEDA). The person accountable for our compliance with it is our founder, who can be reached at admin@dhureelabs.com. Where privacy laws outside Canada apply to our processing, we intend to comply with their applicable requirements.

This policy covers the Diagramium service available on this website only, including what the app stores in your browser (section 4) and the service providers behind it (section 5).

2. Your diagrams stay on your device

Diagramium's editing, autosave, presentation and export features keep your diagram content on your own device: every editor saves your work to your browser's storage, and exports and recordings are produced locally as files you keep. No feature uploads your diagram content to us — there is no upload path in the app.

Two consequences worth knowing:

• We cannot recover your work. Clearing your browser's site data — or the browser itself evicting storage, or a private/incognito window closing — permanently deletes locally stored diagrams. Save files (File → Save) for anything you care about.
• A presentation share link contains no diagram data — only the identifier of a ready-made diagram from our gallery.

Two device features the app uses on your instruction. One of them can involve your browser's own online speech service — the details matter, so they are spelled out:

• Narration voices. Diagramium uses speech voices exposed by your browser and operating system. Where the browser identifies a voice as local, Diagramium treats it as an on-device voice. Some browsers may process certain voices through their own online services. Browser-reported information about where a voice is processed may not always be complete or reliable. Voices believed to require online processing are labelled where reasonably identifiable. Diagramium does not operate its own text-to-speech server. Your browser or operating-system provider controls any processing performed by its speech service under that provider's privacy terms. Two things the app itself does: its automatic pick uses only voices the browser reports as on-device (and stays silent when none is reported, rather than falling back to an unidentified engine voice), and a voice labelled as an online (cloud) voice speaks only if you select it yourself — the app shows a notice when you do, and switching back to any other voice (or to the automatic pick) ends it.
• Screen and tab recording. Recording a presentation asks your browser for permission to capture the tab or screen, and your browser shows you what is being shared. The video is assembled on your device and saved as a file you keep. We never receive the recording.

3. What we collect or process

3.1 Nothing through the app

Diagramium has no accounts and no sign-in, and the app sends nothing about you or your use of it to us or to anyone else: no usage counts, no analytics, no error reports, no advertising identifiers. We do not record which diagrams you open, present or export, what you search for, or how long you stay.

Former accounts. Until October 2, 2026, Diagramium offered an optional sign-in with Google. We retired it on that date. The account information we held — names, email addresses, avatar image URLs, favourites lists, Terms-acceptance records and messages sent through the Contact page — was deleted, together with the anonymous daily totals of finished exports we used to keep, and the database service that held them was shut down. Copies may persist for a short period in that provider's routine backups before they cycle out under its schedule; they are not used for anything. If you signed in before then, the app also removes the sign-in session it left in your browser (section 4.4).

3.2 Ordinary web requests

Loading any website sends technical data to the server: your IP address, browser type (user agent), the time of the request and the URL requested. Our web host sees this in its standard server and security logs, retained under its own schedule; we do not use it to identify or track you. Requests to this website pass through our web host's own infrastructure, which may apply automated traffic protection and security verification before a page is served. All of Diagramium's software is served from this website's own address, and this website is the only server the app talks to.

3.3 Email you send us

If you email us — a question, a correction, a report — we receive your email address and whatever you choose to include, and we use it only to handle the matter you wrote about. Those messages live in our email mailbox for as long as the correspondence is useful.

3.4 Children

Diagramium is a general-audience service and is not directed to children. It has no minimum age, because using it does not involve giving us personal information. If a child emails us, we use the message only to answer it; a parent or guardian who wants such a message deleted can write to admin@dhureelabs.com.

4. What is stored in your browser — cookies and local storage

This section is the complete inventory of what Diagramium keeps in your browser, on your device. In plain language, the three mechanisms it uses:

• A cookie is a small piece of data a website saves in your browser that is automatically sent back to the website's servers with every request — the classic tool for tracking people. Diagramium's own code sets no cookies at all — not for analytics, not for advertising, not for anything — and we use no third-party analytics services, tag managers, advertising pixels, error reporters or fingerprinting techniques. (We verified this against the production site. One honest caveat: our hosting provider could set operational cookies of its own to serve and protect the site — none were observed at the time of writing.)
• localStorage and sessionStorage are browser features whose data stays on your device and is never automatically sent anywhere. A website's own code can read it on your next visit, but it does not travel with your web requests. localStorage persists until deleted; sessionStorage is wiped when the tab closes.
• IndexedDB is a browser database, similar in spirit: it lives on your device and is not sent anywhere automatically.

Diagramium is built "local-first": your diagrams live on your device, and local storage is how that promise is kept. Everything below is storage that works for you, not storage that watches you — none of it is analytics or marketing storage, which is why there is no cookie banner: under PIPEDA and the Privacy Commissioner's consent guidance, storage that is strictly necessary for a feature you are using, or that records your own preferences on your own device, may rely on implied consent. If we ever introduce optional analytics or marketing storage, we will update this policy first and ask for opt-in consent before any of it is set.

4.1 Your diagrams (autosave)

Every editor automatically saves your entire current document — titles, labels, notes, narration text, comments, structure and styling — to localStorage on each change, so a reload or crash does not lose your work. One key per diagram type: sequenceStudio.doc.v1 for the sequence tool, and flowDiagram.<tool>.v1 for the other editors (for example fc flowchart, sm state machine, sl swimlane, mm mind map, ar architecture, and vs Visual Story, whose key is flowDiagram.vs.v1). Category: essential (saves your work). Lifetime: until you clear it.

4.2 Other content you create

4.3 Settings and preferences

These store how you like the app to look and behave. They contain no diagram content and no personal information — only settings values and template/icon identifiers.

4.4 Left over from former accounts

If you signed in before October 2, 2026, your browser may still hold the sign-in session the former account system stored (a localStorage key beginning with sb-, holding sign-in tokens and your name, email address and avatar URL), a usage-count opt-out marker (diagramium.analytics) and a pending Terms confirmation (diagramium.legalAccept.pending). The app deletes these keys from your browser the next time you open it; they are no longer used for anything, and the sign-in tokens no longer work.

4.5 sessionStorage and IndexedDB

One sessionStorage key, flowDiagram.pr2.resume, keeps the current presentation's title and step number so you can resume a show you exited mid-way; it is deleted when the presentation completes or the tab closes. One small IndexedDB database, flowDiagram.files, keeps your Recent files list (up to 8 entries: file name, a "this device" label, a browser file handle — your browser asks permission again before any reopen — and a timestamp; file names, never file contents). Remove entries from the File menu; the downloadable single-file offline copy of Diagramium uses the same storage keys and behaves the same way.

4.6 Clearing this storage

Warning — read before clearing. Your diagrams live only on your device (and in files you save). Clearing this site's data permanently deletes your locally saved diagrams, custom icons, style presets and settings. We cannot recover them, because we never had them. Save important work to files first.

Inside the app: the “Clear cache” / “Clear locally cached data” buttons ask for confirmation, then remove Diagramium's localStorage entries except your theme choice. They do not clear the Recent-files store. In your browser: use your browser's site-data controls to remove everything. Private/incognito windows delete everything in this section automatically when they close — including any diagrams made during that session.

5. Service providers, and where information is processed

Diagramium's local-first design keeps the sensitive part — your diagrams — off servers entirely, and the app collects nothing, so the provider list is short. A service provider is a company that processes personal information on our behalf; under PIPEDA we remain accountable for information we transfer to one, and we must use contractual and other means to see that it receives comparable protection.

Independent services. If you select a narration voice labelled as an online (cloud) voice, your browser — not Diagramium — may send the narration text to that browser's speech provider, as described in section 2; Diagramium does not operate its own text-to-speech server. Links to other sites (for example our pages on GitHub, YouTube, LinkedIn or X) take you to those services, which have their own privacy policies; nothing from them loads in Diagramium.

International processing. Our providers may process information outside Canada, including in the United States. PIPEDA permits transfers for processing but holds us accountable: information in a provider's hands must receive comparable protection, and you should know it may be accessible to the courts and authorities of those jurisdictions. We address this by transferring only the minimum each provider needs, relying on each provider's data-processing terms, and keeping your diagram content off servers entirely, by design. We use no analytics provider, no database or cloud-storage service, and no separate content-delivery network or security company in front of the site — traffic protection is part of our web host's own infrastructure (verified against the production site's response headers, October 2, 2026). If we add a provider, we will update this section before it goes live.

6. Retention and deletion

• Your diagrams, files and settings: on your device only, for as long as you keep them; we never have a copy.
• Web host logs: IP-level request logs at our web host are retained under its own schedule.
• Email: kept in our mailbox for as long as the correspondence is useful.
• Former account data and export totals: deleted when accounts were retired on October 2, 2026 (section 3.1).

Your requests. Email admin@dhureelabs.com to ask for access to, correction of, or deletion of your information. We respond to written access requests within 30 days, subject to any extension permitted by PIPEDA; if an extension is required, we will notify you within the initial 30-day period, explain the reason for the extension and tell you about your right to complain to the Office of the Privacy Commissioner of Canada. Access is provided at minimal or no cost, subject to applicable law.

7. Your choices

• There is nothing to switch off. The app collects nothing, so there is no tracking setting to manage.
• Keep or delete your local data — section 4.6 explains how; save files of anything you want to keep first.
• Prefer on-device narration — the automatic pick uses only voices your browser reports as on-device; avoid selecting voices labelled as online (cloud) voices.

8. Security and breaches

The site is served over HTTPS, and the most reliable protection we can offer is to hold almost nothing: your diagrams stay on your device and the app collects no personal information. No system is perfectly secure, and we cannot guarantee absolute security. If an incident affects personal information, we assess it and provide notification to affected people and to regulators, and keep breach records, where applicable law — including PIPEDA — requires it.

9. Changes

If we change what we collect or store, we will update this policy and change the effective date at the top before the change takes effect. We keep this document matched to the software: the lists in sections 3, 4 and 5 are the complete lists, and they are meant to stay short.

10. Contact

Email admin@dhureelabs.com with any privacy question, correction or complaint. If you are not satisfied with our answer, you may contact the Office of the Privacy Commissioner of Canada (priv.gc.ca).