Privacy policy

What your own browser stores

The tool keeps a few things in your browser local storage, on your device, readable only by this site:

• erddocs:last-session holds the last schema you pasted, so that reopening the tab restores your work instead of an empty panel. It stays on your device. Clearing your site data removes it.
• erddocs:last-layout holds where you dragged the tables. It is kept next to that schema.
• erddocs:last-page holds which page of this site you were on when you pasted it. Your work then reopens there, rather than on top of an example page that has its own schema to show.
• erddocs:theme holds light or dark, so the choice survives a reload.
• erddocs:panel-width holds how wide you dragged the schema panel, so the tool opens the way you left it.
• erddocs:license holds your license key, if you bought one. It is verified locally, which is what lets an unlocked browser keep working offline.
• erddocs:last-transaction holds the id of a purchase, kept only until its key arrives. A payment confirms in one tab, and the key is issued moments later. If that tab is closed in between, this id is what lets the next visit finish the purchase instead of losing it.
• erddocs:visitor holds a random id, made in your browser the first time it sends us an event. It is not derived from your device, your address or anything your browser reports, it means nothing outside this site, and clearing your site data ends it. This one is sent to us: see below.

None of these are cookies and none are readable by another site. Only the random id leaves your browser. The rest stay on your device.

What we count

Page views, through Cloudflare Web Analytics. It is cookieless: it sets no cookie, builds no device fingerprint, and cannot follow you to another site. It records which page was opened, the referring site, the country, a coarse browser and device type, and page-speed measurements. It sees the page you opened and nothing that is on it. The schema in your panel is invisible to it, like everything else on the page. We chose it over Google Analytics deliberately: a tool that promises your schema stays on your device should not put an advertising network on the same page.

What we receive while you use the tool

Five small events, sent so we can tell where the free limit lands and where people stop. Each one carries counts and nothing else: table counts, never table names, and never the schema. The exception is the last, which carries the email address you type into the form.

• When a schema you pasted is drawn: how many tables it has and which format it was read as. The example that ships with a page, a restored session and a followed link do not send this.
• When the free limit is reached: the same, plus how many tables were beyond it.
• When the data dictionary is opened: the number of tables.
• When the unlock offer is opened, and again if you reach for a card: the table counts and which of the two views you were looking at.
• If you type your email into that form: the address you typed, used to write to you about the launch price, once.

Every one of them also records the country from the network header, the referring page, the time, and the random id described above. The id is there so that the events from one browser can be read as one visit rather than as strangers. None of them records your IP address, and none of them can record your schema: the schema is never sent anywhere to begin with.

When you buy

Payment is handled by Paddle as merchant of record. Your card details go to Paddle and never reach us. What we receive is your email address and the order, which we need in order to issue and re-issue your license key and to answer support requests. When you press Buy, the checkout also carries where you pressed it (the page, the view, the table counts) and the random id above. Paddle returns them to us with the order, and we keep them next to the events, apart from your email and key. Paddle processes the payment under its own privacy notice, and its checkout script is loaded only when you click to buy. No other page on this site fetches it.

Links, embeds and AI agents

A share link carries the schema in the URL fragment: the part after #, which browsers never send to a server. The same is true of Agent Links built by AI assistants. The schema travels inside the link, is decoded in the reader’s browser, and reaches no server of ours. Anyone you send that link to can read the schema in it, so treat it as you would the dump itself. Diagrams embedded in other people’s pages through /embed/ are inert: they draw, and they count nothing.

The MCP server is different, and it is the only place a schema reaches our server. When you connect it to an AI agent (Claude Code, Cursor, Codex and others), the agent sends the schema text to erddocs.com/mcp. The server compresses it into a share link and returns the link. It does not parse the schema, store it, or write it to a log. For each call it counts the outcome, the format and an approximate number of tables, and nothing else. Your IP address is used for a minute to limit how often one client can call, and is not kept. The agent itself is a third party, and what it does with your schema is governed by its own terms.

Hosting

The site is served by Cloudflare, which processes requests on our behalf and keeps standard network logs for security and abuse prevention. The events described above are stored in Cloudflare storage. We use no advertising networks, no third-party trackers, and no session recording of any kind.

Your rights

Write to hello@erddocs.com to ask what we hold about you, to correct it, or to have it deleted. That includes your email address and any unlock events tied to it. There is little to hold: no account, no profile, no schema. Order records held by Paddle are subject to Paddle’s privacy notice, and we will point you to the right place if a request belongs there. The data controller is Oleksandr Miadelets, trading as Diagram Pro.