Privacy

The editor runs in your browser. Your diagrams are saved on your own device and are never sent to us — we could not show you one of them if you asked.

We count page views without cookies, and we ask before measuring anything more than that. We do not sell data, run advertising, show third-party ads, record your session, or train AI on anything you draw.

If you answer the feedback survey, we receive what you typed and a random browser identifier — never your diagram.

The controller for this processing is %% registered business name %%, %% business address %%, tax identification number %% NIP %%. There is no Data Protection Officer at this scale; write to privacy@vibrantflow.io about anything on this page.

Everything you draw is written to your browser’s local storage and read back from there. It is not uploaded, not backed up by us, and not readable by us. The practical consequences are worth stating plainly: clearing your browser storage deletes your work, and a diagram made on one machine does not appear on another.

A diagram may contain other people’s personal data — names on an org chart, an email address in a note. Because it never reaches us, we are not processing it; you remain responsible for what you put in it.

A diagram can show a picture by its web address. When it does, your browser fetches that picture directly from whichever site hosts it, and that site receives your IP address and can see that the request came from here. We neither proxy nor control those requests.

Two different things measure use here, and only one of them needs your permission.

Page views are counted by our host without cookies and without storing anything on your device. There is nothing to consent to and nothing to turn off.

Product analytics — which features get used, how far people get — is Mixpanel, and it stores a random identifier on your device. That needs your consent, so we ask before switching it on. In the European Union, the EEA and the United Kingdom nothing is measured until you accept. Elsewhere it is on by default and you can turn it off at any time; either way the control is in the same place, under Privacy choices in the diagram menu and in the footer of our home page.

Mixpanel receives what you did, never what you drew: an event name such as “diagram exported” and a handful of properties such as the file format. No label, note, title or diagram identifier is ever sent. Its project is hosted in the European Union.

We use no cookies at all. What we do store is listed here by name, so you can check it in your browser’s developer tools.

Under Poland’s Prawo komunikacji elektronicznej (art. 399), storing or reading anything on your device needs consent unless it is strictly necessary for something you asked for. The entries marked Essential and Preference are exempt on that basis; the analytics one is why there is a banner.

• vibrant-flow:diagram:Essential

  Your diagram itself, one entry per diagram. This is the only copy — it is never sent to us, and we cannot read it.

  Until you delete the diagram or clear your browser storage.

• vibrant-flow:consentEssential

  Your answer to the analytics question on this site, and the date you gave it.

  Until you change it or clear your browser storage. Without it we would have to ask again on every visit, and could not remember a refusal.

• vibrant-flow:editor-libraryPreference

  Which shape libraries you switched on, and which shapes you marked as favourites.

  Until you change it or clear your browser storage.

• vibrant-flow:node-libraryPreference

  Element styles you saved for reuse.

  Until you change it or clear your browser storage.

• vibrant-flow:panel-sectionsPreference

  Which panel sections you left open or collapsed.

  Until you change it or clear your browser storage.

• vibrant-flow:inspector-tabPreference

  Which inspector tab you last had open.

  Until you change it or clear your browser storage.

• vibrant-flow:focus-palette-searchPreference

  Whether the element search box takes focus when the panel opens.

  Until you change it or clear your browser storage.

• vibrant-flow:guidePreference

  How far you got through the first-visit tour, so it does not start again.

  Until you clear your browser storage.

• vibrant-flow:feedbackPreference

  Whether you have been offered or answered the feedback survey, and a random identifier that lets us tell two answers from the same browser apart. It is not linked to you.

  Until you clear your browser storage.

• mp_…_mixpanelAnalytics — only with your consent

  Mixpanel’s own record: a random device identifier and the properties attached to it. Written only if you accept analytics, and removed if you withdraw.

  Until you withdraw consent or clear your browser storage.

• __mp_opt_in_out_…Analytics — only with your consent

  Mixpanel’s own record of whether you allowed analytics, so it does not start again by itself.

  Until you withdraw consent or clear your browser storage.

• __mpq_…_evAnalytics — only with your consent

  Events waiting to be sent, batched so that a page does not make a request per action. Emptied as they are sent.

  Until sent, or until you clear your browser storage.

• __anon_idAnalytics — only with your consent

  A random identifier for this browser, used to tell one visitor’s actions apart from another’s. It is not linked to you and is written only if you accept analytics.

  Until you withdraw consent or clear your browser storage.

• Vercel, Inc.

  Hosting, CDN and serverless functions; cookieless page-view statistics.

  Serverless functions in the EU (Frankfurt); the edge network is worldwide. US company — EU–US Data Privacy Framework and Standard Contractual Clauses.

• Mixpanel, Inc.

  Product analytics — how the editor is used. Only if you accept analytics.

  EU data residency (api-eu.mixpanel.com); the project is hosted in the EU. US company — EU–US Data Privacy Framework and Standard Contractual Clauses.

• GitHub, Inc. (Microsoft)

  Stores feedback survey responses as issues in a private repository.

  United States — EU–US Data Privacy Framework.

Where a recipient is outside the European Economic Area, the transfer relies on the EU–US Data Privacy Framework adequacy decision or on Standard Contractual Clauses, as noted above.

Anything on your device stays until you clear it — the table above gives each entry. Server logs are kept by our host for days to weeks. Feedback survey responses are kept for 24 months and then deleted or stripped of any contact address. Analytics events are kept for as long as the Mixpanel project retains them, and are deleted on request.

You can ask for access to your data, its correction or erasure, a restriction of processing, a copy in a portable format, and you can object to processing we base on legitimate interest. Where we rely on consent you can withdraw it at any time, and doing so does not affect what was done beforehand. Write to privacy@vibrantflow.io; we answer within one month.

You may also complain to the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl), or to the supervisory authority where you live.

For most of what is described here the fastest route is your own browser: clearing storage for this site removes everything we have written to your device, including your diagrams.

We do not sell personal data and we do not share it for cross-context behavioural advertising, as those terms are used in California and comparable state laws. There are no advertising trackers on this site.

The service is not directed at children under 16, and we do not knowingly collect their data.

Everything is served over TLS. The feedback endpoint is rate-limited and its credentials are held only on the server. Because your diagrams never leave your browser, there is no store of them for anyone to breach. Should a breach of what we do hold occur, we notify the supervisory authority within 72 hours and affected people where the law requires it.

The date at the top of this page is the last change. If a change materially affects what we collect or why, we will ask again rather than quietly widen an existing consent.