Privacy Policy

What we store

• Your documents. The content you create is saved so it is there when you come back, and so the people you share it with can see it. It is stored in our database on Cloudflare. A document you create in Offline Mode is the exception: it stays in your browser and never reaches our servers, unless you ask the AI assistant about it, read sticky notes from a photo (see AI features), or add a web link to it (our server fetches the link's preview).
• Images you upload. Images placed in a document are kept in Cloudflare object storage and served back through the same API. Before a JPEG is stored, identifying metadata such as GPS location and camera details is stripped from it, so it never reaches anyone you share the document with.
• A browser id. If you use livediagram without an account, we keep a random identifier in your browser's local storage to link documents to your browser. It is not tied to your name or email.
• Your display name and colour. The name and cursor colour collaborators see are stored on our server against your browser id or account.
• Account details, if you sign in. Sign-in is handled by our authentication provider, Clerk. If you create an account we receive your email address, and, if you choose Google sign-in, basic profile details from Google. We use these to identify your account and to send you the account and onboarding emails described under Emails we send below.
• Your profile picture's address, if you sign in. Your profile picture is a picture you uploaded to your account, or your Google picture. We store only its web address (hosted by Clerk), never the image, so we can show it to the people you collaborate with who are signed in: on your presence avatar, your cursor, your comments and your team's member list. People who open your share links without signing in always see your initials. Turn it off in Settings > Account > Show My Profile Picture; it is removed when you delete your account.
• API tokens, if you create them. If you create an API token to call the API from your own scripts, we store a one-way hash of it (never the token itself), its name, and a last-used timestamp, so the token can be verified and you can see when it was last active. Tokens are a signed-in-only feature, expire after six months, and are deleted when you delete your account.
• Connecting an AI tool, if you do. If you connect an AI tool via our MCP server, we store the app's registration (its name and redirect address, kept for 30 days), short-lived authorization sessions and codes that expire within minutes, and, for an hour, a count of registrations from your IP address to stop abuse. The connection itself is an API token, covered above, and you can revoke it any time.
• Google Drive, if you connect it. If you mirror your documents to Google Drive, we store an encrypted refresh token from Google, the id of the Google account you connected, the ids of the files and folders livediagram created in your Drive, and the state livediagram last wrote to them. See Google user data below.
• Community posts, if you share to the Community. A post holds the title, description, category and tags you write, which document it shows, when you shared it, and its like and copy counts. Your account id is stored with it so you can manage it, but it is never shown: the post appears as Anonymous, or, if you turn that off, with your display name and profile picture. Removing the post, or deleting the document or your account, deletes it.
• Community likes and reports. A like is stored against a random key your browser keeps for the Community, not against you, together with a one-way hash of your network (your address range combined with the post's id), so one network can add only a few likes or copies. When someone copies a Community post we record that their account or browser id copied it, with the same kind of network hash, so each person counts once; this is deleted with their account. A report stores its reason, the optional note, the same random key, and a one-way hash of the reporter's internet address combined with the post's id, so that reports from one network can't hide a post on their own. These hashes are used only to cap counts and reports, and a post's reports are deleted when the post is removed or its document is deleted. Reports are counted automatically; nobody reads them by hand.
• Team invitations. If a teammate invites you by email, we store that address with the team, send you the invitation, and may send you action and mention emails at that address before you create an account.
• Votes from guests. To stop one person voting many times, a guest's vote stores a one-way hash of their network address combined with the document's id. It is deleted with the document.
• Document activity. Your Timeline records what happened to your documents (created, renamed, shared, commented on) and which ones you opened, so the Explorer can show you. These records are kept for a year.
• Basic operational logs. Our host, Cloudflare, keeps standard request logs that help us run the service securely.

AI features

The AI features run only when you use them, and only on a deployment that has an AI provider configured.

• The AI assistant. When you ask the assistant something, your prompt, the tab's name, the elements on the current tab (their text, shapes and positions) and your last few messages in that conversation are sent through our API to OpenAI, which writes the answer. Nothing is sent until you ask, and the assistant is off until you turn it on in Settings.
• Reading sticky notes from a photo. When you import a photo of sticky notes, the notes are found in your browser, and crops of them are sent through our API to Google (Gemini) to read the handwriting. We do not store the crops.
• Connected AI tools. If you connect an AI tool such as Claude, that tool reads and changes your documents through our API using the token you approved. What the tool does with what it reads is governed by that tool's own terms and privacy policy, not this one.

We do not use your documents to train AI models. The providers above process what is sent to them under their own API terms.

Anonymous product analytics

To understand which features actually help, we record anonymous, first-party product events, for example "a document was created" or "a square was added". Each event is just three fixed labels: a category, an action, and an optional type like "Square" or "Edit". They never include anything that identifies you or your work: no names, no document or element content, no account id, no IP address. Page views are counted the same way: which page was opened, with ids and anything after a ? or # removed in your browser before it is sent. When one of our own buttons opens the New Document page, we count which button it was (from a fixed list, like the landing page's hero) and whether a document followed; the label is removed from the address straight away. Error health is counted the same way too: a failed request or a browser-side exception is recorded only as a generic status or kind, never a message or stack trace. How long key moments take (a document opening, a save, a page loading) is counted the same way: only the range it fell in, like "under one second", never the exact time. Events are deleted after 60 days.

To count sign-ups and sign-ins once each, our server also remembers which sign-in sessions it has already counted, for 90 days, and that an account has been seen before (deleted when you delete your account). These records are never published; only the totals are.

We collect this ourselves, store it in our own database, and use no third-party analytics vendors. The data is never sold or shared, and the only place it goes beyond our own use is our public telemetry dashboard, where you can see exactly the same anonymous totals we do. You can turn off the events your browser sends at any time from Settings (see What We Collect). A few anonymous totals are counted by our server and can't be turned off: sign-ups and sign-ins, first visits to a share link, multiplayer sessions, emails sent, and server errors.

Emails we send

If you have an account, we use your email address to send you a small number of emails:

• Account and service emails: an invitation when someone invites you to a team, a confirmation when you delete your account, and a one-time reminder a week before an API token expires.
• Notifications about your work: when someone opens a document you shared for the first time, comments on a document you own, responds to a team invite you sent, assigns you an action, or mentions you in a comment. A mention email quotes the comment (up to about 280 characters) and an assigned-action email includes the action's name and the start of its description; the others name the document but not its contents.
• A short onboarding series: a welcome message, a few tips during your first two weeks, a nudge if you have not made a document after a few days or have been away for about four weeks, and the occasional milestone.

You can turn off every notification, tip and milestone email in Settings, under Account, then Notifications, or from the link at the bottom of each one (see Email Notifications). We do not send advertising or marketing beyond these, and we never share your address other than with our email provider for the sole purpose of delivering them. Apart from team invitations and the emails that follow from them, people who use livediagram without an account are never emailed.

Sharing and visibility

Anything you put in a document you share becomes visible to people who have the share link. You can protect a link with a password or give it an expiry, and revoking a link stops further access through it. See Share Link Security.

Community posts are public. A document you share to the Community can be found, viewed and copied by anyone, and it shows the document's latest version, including its document and tab names, until you remove it. Comments are never shown with it, and the names of people on its cards, actions and votes are left out. Copies people made before you removed it remain theirs.

Security

We protect your data with authentication and access controls on every request, and the code is public so the controls can be checked. If you find a security vulnerability, please report it privately as described in Reporting a Vulnerability.

Changes

We may update this policy from time to time. The date at the top of this article reflects the latest version.