Privacy policy

1. What we collect

• Account data. Email address, and either a hash of your password or, if you sign in with Google or GitHub, that account's ID and the name and email it gives us. We never store your plaintext password. We also record when the account was last used.
• Workspace data. Workspace name, plan tier, billing state, and Stripe customer reference (if the workspace has subscribed to Pro or Team). For a team workspace, also its people and their roles, pending invitations, the email domains it lets join, which owner pays for it, and which owner last opened Manage subscription.
• Connected apps. When you allow an app such as Claude or ChatGPT to use your account, the app's name as it states it, the site it returns to, when you connected it and when it last used your account. Its sign-in tokens are stored only as hashes. An app you connect acts in the one workspace you choose, with the access you choose (read and write, or read only). You can disconnect it at any time from the API keys page.
• Team workspaces. If you belong to a team workspace, everyone in it sees your name, email address and role. Each version you save there records your account and the key, connected app or session you used. People in the workspace see your name on it, and its owners see your keys and connected apps for that workspace. If you sign in with Google, we keep the Google Workspace domain Google reports for your account, to check who may join a workspace by domain. Invitations keep the invited address until 30 days after they are accepted, revoked or expire. A request to join by email domain is kept until 90 days after an owner decides it. If the owner who pays for a team workspace stops being an owner, we remove their card from it and give Stripe the email of the remaining owner who joined first, as the workspace's billing contact.
• Scene content. The diagrams you create: nodes, edges, labels, layout, styles, and revision history. It is stored in our database, which encrypts all data at rest (AES-256), and returned only to authenticated requests in its workspace (yours, in your personal workspace; everyone's in it, in a team workspace) unless someone with write access publishes it, shares its images with a link, reports a problem with it or attaches it to feedback. Making a diagram private stops its public link at once, and revoking a share link stops that link. Deleting the diagram stops both until it is restored; restoring it within 24 hours brings them back. Copies people already fetched, including services that cache images, stay with them. We keep the image of each saved version in Cloudflare R2, which also encrypts it at rest. A version's image never changes. A deleted diagram's images are removed within a day of the diagram itself.
• Problem reports. When you report a problem: the version it covers, your one-line description, the app that sent it and when you confirmed. An anonymized report also keeps the anonymized copy you can see, encrypted at rest like your diagrams; a report sent as it is keeps no copy. A report lasts until you withdraw it or the diagram is removed.
• Feedback. When you send Zindex feedback, or an agent sends it after asking you: its kind, summary, what was expected and observed, how sure the sender was, the engine version, the app that sent it and when. Feedback can carry a version of one of your diagrams or a scene or Mermaid snippet, which we keep anonymized unless you turn that off. Zindex staff read feedback and give it a status, a note and, once it's fixed, the version that fixed it; you see all of them, with the item as staff see it, on your dashboard. Feedback that carries a diagram is removed with the diagram, and all of it is removed when you close your account.
• Content reports. When anyone reports a public diagram, or a diagram they opened with a share link: the reason, the description, the version they saw, the share link it came through (by the link's ID, never its address) and, if they give one, the reporter's email address. A report is kept only for a diagram its reporter could see, and is removed with the diagram.
• Security records. When you ask to reset your password or delete your account: the IP address and browser of the request, which the email shows so you can spot a request you didn't make. We keep them only until the request is used or replaced, or the account is closed.
• Contact form. Your name, email address and message, which we send to our support inbox through Resend.
• Operational telemetry. For each request to our API: timestamp, method, route, status code, owner identifier, and a truncated user-agent. For each request to the website: the path, method, user-agent and Accept header, without the IP address. A count of each workspace's renders per month. We do not log request bodies, response bodies, or scene content in operational telemetry.
• Audit log. Account creation, deletion, plan changes, and access to diagram content, kept for security and compliance. Closing your account removes its entries, except the deletion audit log (§7).

2. How we use it

We use your data to provide the service - storing your diagrams, rendering them on request, validating your operations, and managing your subscription. Operational telemetry feeds engine improvements (which endpoints and diagram families are used most). Scene content is not used for anything other than serving authenticated requests in the diagram's workspace.

We do not sell your data. We do not share it with advertisers. We do not use it to train AI models, and we do not send it to third-party AI providers.

3. Who we share it with

We use a small set of subprocessors to run the service. The full list is in Appendix A; the summary:

• Neon - Postgres database hosting. Encrypts all data at rest (AES-256, including backups) and in transit (TLS).
• Fly.io - API hosting.
• Cloudflare - website hosting (Pages), the network every API request passes through (api.zindex.ai), and storage of each saved version's image (R2), encrypted at rest.
• Stripe - payment processing for Pro and Team.
• Resend - transactional email delivery (verification codes, account-deletion confirmations, inactive-account warnings, team invitations and workspace notices, contact-form messages, support replies).

No AI / LLM subprocessors. Our subprocessor list does not include OpenAI, Anthropic, Google, or any other large-language-model vendor. The agent that uses Zindex (Claude Code, Cursor, etc.) is your own LLM session - Zindex never sees it.

4. Your rights

Under GDPR (if you're in the EU/UK) and CCPA (if you're in California), you have the following rights. They apply to every Zindex user regardless of residence; the legal frameworks just give them more teeth in some jurisdictions.

• Access. Request a copy of the personal data we hold about you. Email [email protected].
• Correction. Email [email protected] to correct your email address; a team workspace's owners can rename it in Settings → Workspace; change your password with Forgot password on the sign-in page.
• Deletion. Delete your account from Settings → Account. See §7 for the full mechanics.
• Portability. Download any version as SVG, PNG, Mermaid or JSON, or a diagram's whole history in one file, from the dashboard or the API. Settings → Account, or the API, downloads every diagram in a workspace with its whole history in one file (only owners can export a team workspace). Every scene is a JSON document you can take anywhere.
• Objection / restriction. Tell us not to process your data for a specific purpose, or to restrict processing pending a complaint.
• Complaint. Lodge a complaint with your local data-protection authority. We hope you'll talk to us first - [email protected].
• Non-discrimination. We will not retaliate against you for exercising any of these rights.

5. Internal access

We don't look at your diagrams. Our admin tooling, used by Zindex staff for billing, account management, and platform operations, shows account and usage metadata, such as email, plan, diagram counts and sizes, and request counts, and the problem reports and feedback you send us. It shows diagram content only in the cases below.

Staff see a diagram's content only in these cases:

• You report a problem with a diagram, typically a rendering issue. A report covers one version. It is anonymized unless you turn that off: we keep that anonymized copy, staff see only it, and you can see the same copy on the diagram's page. Without anonymizing, staff can read that one version until you withdraw the report or delete the diagram.
• You attach a diagram version or a snippet to feedback. We keep a copy, anonymized unless you turn that off; staff see only it, and you see the same copy on your dashboard. A diagram's copy goes with the diagram, and every copy goes when you close your account.
• You made a diagram public and someone reports it for abuse. Moderators open it through its public link, the same way any visitor can. If it breaks our hosted-content policy, we make it private, revoke every share link to it and email you the reason.
• You shared a diagram with a share link and someone who has the link reports it for abuse. While the report is open, moderators see what the link shows: each version's image and the dates of its versions, never the title, description or scene JSON. Once every report through the link is closed, or the link is revoked or the diagram deleted, they see nothing. If a diagram shared only with links breaks our hosted-content policy, we revoke that link and email the reason to the person who made it, or to the workspace's owners if they are no longer in it.

Every support view, and every moderator's view of what a reported share link shows, is recorded in an internal audit log with the staff member who viewed it, which supports our forensics and operational review. Views of a public diagram's page, a moderator's included, are recorded without identifying the viewer. The log does not surface in a customer-facing dashboard.

6. AI / training

Zindex does not use customer scene content to train models. We never send your data to an LLM. Our only LLM use is an internal test harness that has a model build and score Zindex's own sample diagrams on a test account. There is no opt-out flag because there is nothing to opt out of.

A note on customer-engaged LLMs. The question worth getting ahead of: many of you use Zindex through a coding agent (Claude Code, Cursor, ChatGPT) that runs on top of a large language model. The agent's LLM is your sub-processor (or simply your tool of choice) - not ours. The data flow is your LLM session → your agent → Zindex's API: we receive the resulting API call but have no relationship with the LLM. The LLM's handling of your data is governed by your contract with the LLM provider (Anthropic, OpenAI, etc.), not by us. The same model applies to any IDE, editor, or automation layer you choose to pipe in front of the Zindex API.

Concretely, on the Zindex side:

• Our rendering engine is deterministic code (planner → layout engine → SVG renderer). No LLM is involved in render, validate, diff, or any persistence path.
• Our subprocessor list (Appendix A) names no AI / LLM providers - and never has.
• Our MCP server, remote or the npm package, calls no LLM.

This commitment has no exceptions, no enterprise-only carve-outs, and no "by default" qualifier.

7. Deletion

You can restore a deleted diagram for 24 hours. After that, a daily cleanup job removes it and all of its revisions permanently, and a second job removes their stored images within the next day.

To delete your account, the "Delete account" button in Settings triggers a two-step flow: type the workspace name to confirm, then click the link in a confirmation email. The two steps protect against accidental deletion and against a compromised session triggering deletion on your behalf.

When you click the confirmation link, the following are removed at once:

• Your user record (email is freed for re-signup immediately)
• Every API key you've issued, in every workspace (existing keys stop working at the next request)
• Every app you connected, with its sign-in tokens (they stop working at the next request)
• Every diagram in your personal workspace, with all revisions (their stored images follow within a day)
• Every problem report and feedback item you sent
• Every share link you made in your personal workspace
• Your personal workspace record, and any team workspace you are alone in
• Operational telemetry that references you (request logs, monthly render counts, plan-change history)
• The audit log's record of access to the diagrams in your personal workspace, staff views included
• Your personal workspace's Stripe customer record (its subscription canceled in the same flow)

Closing your account deletes your personal workspace and everything in it. Diagrams in team workspaces belong to those workspaces and stay. Your account's ID stays on the versions you made there, including inside each version's recorded content, which its hash chain covers; your name and email go with your account, and the workspace sees a former member. Share links you made in a team workspace stay until an owner revokes them. You can't close your account while you are the last owner of a team workspace with other people in it; make someone else an owner, or delete the workspace, first. A team workspace you are alone in is deleted with your account. If you paid for a team workspace you leave, your card is removed from it and its billing contact moves to a remaining owner; invoices already issued keep the details they were issued with.

If you never verify your email, we delete the account and everything in it 7 days after sign-up, the same way.

If a free account goes unused for 12 months, we delete it and everything in it the same way. We email you twice first, 30 days and 7 days before the deletion date, and each email gives the date. Any use before then keeps the account for another 12 months: using the website signed in, a request with one of its API keys, or use by an app you connected (such as Claude or ChatGPT). Other people opening your public diagrams, share links or image links doesn't count. We never delete an account for being unused while it is on a paid plan, is in a team workspace that pays, or is the last owner of a team workspace with other people in it.

Backup snapshots containing the data age out within 30 days per our storage provider's retention window. After that, no copy exists on our side.

Besides team-workspace content and the invoices a team subscription already issued (above), two things are retained:

• The deletion audit log - kept for security and compliance, with no automatic expiry. The log records, by ID, that the account and each of its diagrams were deleted; it does not include their contents.
• Stripe billing records - retained per Stripe's privacy policy and applicable tax law (typically 7 years), governed by your relationship with Stripe rather than us.

An owner can delete a team workspace. After an emailed confirmation, its diagrams with every version, its keys, connected apps, invitations and share links are deleted at once, its subscription is canceled without a refund for the rest of the period, and everyone in it loses access.

There is no recovery on our side. Support cannot restore a deleted account; if you change your mind after confirming, the account is gone.

8. Sub-processors

See Appendix A for the full sub-processor list with role, region, and the data each one receives. Material changes to the sub-processor list are announced with at least 15 days' notice via [email protected]; if you would like advance notice, email us and we'll add you to the notification list.

9. Contact

For privacy questions, data-subject requests, or to report a privacy concern, email [email protected]. We respond within 5 working days; statutory rights (GDPR access / deletion requests) are handled within the regulatory deadline (30 days under GDPR Article 12).

Appendix A: Data Processing Addendum

This appendix is the Data Processing Addendum (DPA) that governs Zindex's processing of personal data on your behalf. A counter-signed copy is available on request.

A.1 Roles

For data in your personal workspace, you are the controller and Zindex is the processor. For a team workspace, the organization its owners act for is the controller of the workspace's content, and Zindex is its processor. The owners decide who can read the workspace's diagrams, which email domains can join, and when the workspace is deleted. The controller determines the purposes and means of processing; we process on its documented instructions.

A.2 Sub-processors

The current sub-processor list:

Material additions to this list are announced with at least 15 days' advance notice. We do not currently use any AI / LLM sub-processors; if that ever changes, the announcement will include the proposed provider, the data they would receive, and your right to object.

A.3 Security commitments

• Encryption in transit. TLS 1.2 or higher for every HTTP and database connection.
• Encryption at rest. All data, including every diagram and every prior revision, is encrypted at rest with AES-256 by our database provider, including backups, and every stored version image by Cloudflare R2.
• Access controls. Production database access is restricted to Zindex operators. Admin tooling shows account and usage metadata, the problem reports and feedback you send us, and, while a report through a share link is open, what that link shows. Staff open a private diagram's content only when you send it to us, or when anyone who has a share link to it reports it, as described in section 5; moderators review a reported public diagram through its public link, and a diagram reported through a share link as that link shows it, while the report is open.
• Audit logging. Support access to diagram content, including a moderator's view of a reported share link, is recorded with timestamp, the diagram's ID when there is one, and the staff member who viewed it. Views of a public diagram's page, moderators' included, are recorded without identifying the viewer.

A.4 Personal-data breach notification

If we become aware of a personal-data breach affecting your data, we will notify you without undue delay - within 72 hours of confirming the breach. Notification will include what we know about the breach, the categories and approximate number of data subjects affected, the likely consequences, and the measures taken or proposed to address it.

A.5 Audit rights

You may request a copy of our most recent independent security audit (when available) under NDA. For controllers requiring on-site or remote inspection, contact [email protected] to arrange access scoped to legitimate audit purposes.

A.6 International transfers

Zindex processes personal data in the United States and the United Kingdom. Requests pass through Cloudflare's network at the location nearest the sender. For controllers in the EU, UK, or Switzerland, transfers are governed by the European Commission's Standard Contractual Clauses (2021/914) and the UK International Data Transfer Addendum, incorporated by reference into this DPA.

A.7 Term and termination

This DPA is effective as long as Zindex processes personal data on your behalf. On termination of your account, we delete the personal data we hold about you per Section 7 of the privacy policy above.