The short version
Pasting, rendering, switching themes and exporting to PNG / SVG / PDF / Word / PowerPoint all happen inside your browser. That content is not uploaded. Data leaves your device only when you choose to do one of these: sign in, save to the cloud, run an AI fix / tidy / edit, create a share link, buy something, submit a support ticket, or use the support chat.
Diagramate is run by Shenzhen Dianle Trading Co., Ltd. Contact: support@diagramate.com. The two sites are separate: diagramate.cn runs on servers inside mainland China; diagramate.com runs on servers outside it. Accounts and data do not cross between them — an account exists only on the site where it was created.
When you are not signed in
Not collected: the code you paste, the diagram it renders, the files you export. They never reach our server (unless you tick "attach this diagram" when submitting a support ticket — see "Support tickets" below).
Collected:
- Product analytics: an event name (such as "render succeeded" or "export PNG") plus small pieces of metadata (diagram type, theme, error type, duration), your browser's user-agent string, a timestamp, a randomly generated anonymous visitor number and where you came from (the hostname of the site that linked you, or the
utm_sourcein the link). The visitor number lives only in your own browser's local storage, is random, carries no identifying information and is not shared across sites; it turns "how many events" into "how many people". Clearing browser data removes it. No diagram content and no IP address. We use it to see which features get used, where people come from and where they hit errors. - Outline of a failed render: when a diagram fails to render and the error stays for a few seconds, we receive an "outline" of that code — every word you wrote is replaced by a placeholder (Latin letters become "A", digits "9", and a run of Chinese or any other script becomes a single placeholder character), keeping only Mermaid keywords, brackets, punctuation and indentation, plus the error line number and error type. Our server replaces everything again before storing it, so the words you wrote never leave your device. We use it only to find which ways of writing fail most often and to improve automatic fixes; at most 5 per page.
- Diagnostic metadata: to investigate rendering, exports and AI operations, we also record the client build version, diagram and canvas dimensions, requested and actual export scale, retry counts, duration, file size, failure stage and recovery method, plus AI response receipt, validation, cancellation, adoption or dismissal states and HTTP status codes. Temporary random page, editing-task and operation numbers plus a revision counter connect events from the same operation and are regenerated after a page reload. We do not use content hashes or collect source code, SVG, images, filenames or raw error messages through these diagnostics. A download event only means the page triggered a download; it cannot confirm that a file reached your phone or photo library.
- Access logs: as on any website, our server and content-delivery provider log IP address, time and requested path for security and troubleshooting.
- Free AI allowance and daily export counting: for anonymous AI fix / tidy / edit calls, and for each export (from 2026-10-25; only the format and where it came from are sent, never the diagram), we count the month's usage per device — the device number is randomly generated, lives in the
dgz-aidcookie, is used only for this, is not tied to any account, is not shared across sites, and disappears when you clear browser data. We also keep a monthly ceiling per IP address so that clearing the cookie cannot be used to collect allowance over and over. Both are stored only as salted hashes (not reversible, raw values are not stored), cleared about 30 days after the counting period ends. There is also a site-wide daily total that is not tied to anyone. Exports are counted over a rolling 24 hours, and per account when you are signed in (again stored only as salted hashes).
Accounts
- Phone code sign-in (diagramate.cn): we store your phone number. The code itself is stored only as a hash and is cleared after one day. Sending is rate-limited per number and per IP to prevent abuse. The number is used only for signing in and account recovery — never for marketing texts, and never passed to third parties for other purposes.
- Email code sign-in: we store your email address. The code itself is stored only as a hash and is cleared after one day. Sending is rate-limited per address and per IP to prevent abuse.
- WeChat sign-in (diagramate.cn): we request sign-in authorization only (
snsapi_loginfor the desktop QR code,snsapi_userinfowhen the page is opened inside WeChat) and store the user identifier WeChat returns (openid) plus the nickname and avatar URL, used in the interface. We do not receive your phone number, contacts, moments or messages. - Google sign-in (diagramate.com): we request the
openid email profilescopes and store your email address plus the display name and avatar URL Google returns (used in the interface). - One account can have several sign-in methods: link them in your account settings and any of them opens the same account; email-code and Google sign-in with the same address also resolve to one account automatically. Linking and unlinking both live in account settings, and unlinking never deletes the account.
- Sessions: your signed-in state lives in the
dgz-sessioncookie (HttpOnly). A session record holds its creation time, user-agent and a hash of the IP address, and is cleared 30 days after it expires or you sign out.
Diagrams saved to the cloud
- Uploaded only when you choose "save to cloud": the diagram's Mermaid code, its name, theme settings and version history.
- Your diagrams are yours. We use them to give you cloud storage and cross-device access, and to troubleshoot problems and improve the product — never to train models.
- Deleting moves a diagram to the trash; after 30 days it is physically deleted from the database, versions included.
- Share links exist only if you create one. You can set a password (stored as a hash), an expiry and revoke it at any time; the link follows the current cloud version.
AI fix, AI tidy and AI edit
- Your current code (plus the error message when fixing, or your instruction when editing) is sent to a third-party AI inference provider once, and only when you press the button. Nothing is sent on page load.
- We do not store the code that is sent. Server logs hold only length, duration, mode, outcome and a temporary random operation number to connect the same request; the usage ledger records time, mode, success, credits spent and a hash of the IP address.
- What is sent is not used to train models.
- This site uses no image or video generation model of any kind. The AI reads text code and returns text code; every diagram you see is drawn by the Mermaid rendering engine inside your browser.
Support tickets
- When you submit a ticket we store: the topic, what you wrote, the email address or phone number you left (your account's if you are signed in), where you opened it from, the language, the time, a hash of your IP address, and the replies that follow.
- Attaching a diagram is optional: only if you tick "attach this diagram" are its Mermaid code, theme, error message and your browser's user-agent string submitted with the ticket. Support staff can see a diagram you attach to a ticket; it is deleted 90 days after the ticket is closed.
- We use it only to investigate and answer your question; our new-ticket alerts do not contain what you wrote or your diagram.
- When we reply: you see a notice under My tickets in your account; we may also email the address you left (with the reply), or on diagramate.cn send the phone number you left a short text that does not contain the reply. Several replies in a row trigger only one notice until you have read them.
- Tickets waiting on you close automatically after 7 days without a response; several tickets from the same person within a few minutes are merged into one.
Support chat
- Available to signed-in users only; a request is made only when you send a question in the chat panel, never on page load.
- Each time you ask, the following is sent to a third-party AI inference provider to generate the answer: your question and the earlier questions and answers in this conversation; an account summary (plan and expiry date, remaining Pro AI credits, number of cloud diagrams, product and status of your last 3 orders, number of open tickets, sign-in methods and sign-up date); and your activity in the last 30 minutes — metadata only, such as whether a render succeeded or failed and the error type, results of AI features, checkouts started and their outcome, export formats. To find that activity your browser sends its anonymous visitor ID (see "Product analytics" above). No diagram code, ticket content, order numbers, phone numbers or email addresses are sent.
- Conversations are stored in our database and deleted 30 days after the last message. We use them so you can continue a conversation, to carry the conversation into a ticket when you ask for a human, and to check answers for accuracy and improve help articles; every time staff open a conversation in the admin console an audit record is written.
- When you choose "Talk to a human", a summary of the conversation is prefilled into the ticket form and you can edit it before submitting; the ticket is then kept under the "Support tickets" rules above.
- What is sent is not used to train models. The support chat only answers questions about using this site; it cannot see or change your orders or plan, and matters such as refunds are still handled by a person.
Payments
- International payments are handled by a third-party payment provider acting as Merchant of Record; that provider's name is what appears on your statement, and it is identified on the checkout page before you pay. Card numbers and payment account details go straight to that provider — they never pass through our server and we never see them.
- What we store: order number, product, amount and currency, order status, the payment provider's order and subscription identifiers, membership start and end dates, and your AI credit balance with its transaction history.
- Refund rules are in the Refund Policy.
Email and text messages
Sign-in codes and necessary account notices are delivered through a third-party email provider and contain your address and the code. Phone codes are delivered through a third-party SMS provider and contain your number and the code; ticket-reply texts carry only a short notice, not the reply. We do not send marketing email or marketing texts.
Where you came from
When you reach this site through a link we published ourselves on a social or content platform, that link carries source parameters (such as utm_source and a content number). We keep those parameters in a first-party cookie named dl_ft for 30 days. It holds no personal information and is not used for advertising; only the first visit is recorded, so a later link never overwrites it.
If you then create an account or pay, we pass that source information, a salted one-way hash of your account identifier and the order amount to our own content operations system. We do not pass your phone number, email address or IP address, and we do not give any of it to a third party. It answers one question only: which piece of content brought a sign-up or a payment. Clearing your browser data removes the cookie.
Cookies and local storage
Cookies (none are advertising cookies; there is no cross-site tracking):
dgz-session: signed-in state, HttpOnly.dgz-signed-in: lets a page know you are signed in so anonymous visitors never call the API for nothing.dgz-plan: plan hint, used to show membership-related entry points.dgz-oauth: a one-time verification value during Google sign-in, deleted as soon as it is used.dgz-wx-oauth/dgz-wx-pending: a one-time verification value during WeChat sign-in, and a short-lived credential (10 minutes) for "authorized, waiting for a phone number". Both are deleted as soon as they are used.dl_ft: a snapshot of where you came from (the source parameters on a link we published, plus the landing path), valid for 30 days, HttpOnly, with no personal information and no advertising use. See "Where you came from" above.
Browser local storage (stays on your device, never uploaded): the code and theme in the editor, interface preferences, anything left over from the retired “Arrange by hand” canvas, and whether you have seen the feature tour. Clearing your browser data clears all of it.
How long we keep things
| Data | Retention |
|---|---|
| Phone / email / WeChat identifier | Kept with the account; unlinking one in account settings deletes it (an account must keep at least one sign-in method) |
| Cloud diagrams and versions | Trash on delete, physically deleted after 30 days |
| Sign-in codes | 1 day |
| Sessions | 30 days after expiry or sign-out |
| Anonymous AI allowance (hashed device number and IP) | 30 days |
Source snapshot cookie (dl_ft) |
30 days |
| Unpaid orders | Marked expired after 24 hours |
| Support tickets (replies and attached diagrams included) | Deleted 90 days after the ticket is closed |
| Support chat conversations | Deleted 30 days after the last message |
| Order and accounting records | Kept as long as tax and accounting rules require |
| Product analytics (no personal identifiers) | Kept long-term for product statistics |
| Access logs | Per our server's and the CDN provider's own policies |
Your rights
- See and export: the account page shows your plan, credits, usage and orders; cloud diagrams can be opened in the editor and exported to your device at any time.
- Delete: delete a single diagram in the editor. To delete your whole account and its data, write to support@diagramate.com — we action it and reply within 7 business days.
- Object or complain: same address; we normally reply within 2 business days.
Children
Diagramate is not directed at children under 13 and we do not knowingly collect their information.
Changes
Changes update the date at the top of this page, and significant ones are announced in the product. Continuing to use the site means you accept the updated version.