Privacy Policy

1. Overview

Diagram2Code ("we", "us", "the Service") is a developer tool that converts entity-relationship diagrams into SQL DDL and ORM model code. This Privacy Policy explains what data we collect, why we collect it, and how we handle it. We are committed to collecting the minimum data necessary to operate the Service.

2. Diagram Data

We do not store your diagrams. When you submit a diagram for conversion, it is processed in server memory to produce the output and then discarded. Diagram content is never written to a database, persisted to disk, included in logs, or used for any purpose other than generating the requested output.

The same applies to diagrams submitted through the REST API: each request is stateless, and diagram text is not retained after the response is sent.

3. Data We Collect

3.1 Server Logs

Our web server produces standard access logs containing the following fields for each request:

• Timestamp
• HTTP method and path (e.g., POST /api/v1/convert/sql)
• HTTP response status code
• Response size in bytes
• Request latency in milliseconds
• IP address (anonymised to /24 subnet for IPv4 after 24 hours)

Request bodies are never written to logs. Log data is retained for a maximum of 30 days and used solely for debugging, abuse detection, and service reliability.

3.2 Rate-Limit and Quota Counters

To enforce rate limits and monthly conversion quotas, we maintain counters in Redis. These counters are keyed to your anonymised IP address. They contain no personal information and expire automatically.

3.3 Analytics

We use Google Analytics to measure aggregate traffic patterns (page views, referrers, country-level geolocation). If you are in the European Economic Area, the UK, or Switzerland, analytics cookies are off by default and are used only if you consent in Google's consent dialog — the same dialog that covers advertising. If you decline, analytics runs without cookies and without identifying you. Elsewhere, analytics is enabled by default; you can opt out with the Google Analytics opt-out browser add-on.

4. Cookies

The Diagram2Code web UI stores one first-party preference in your browser: d2c-theme (light/dark mode). It contains no personal data.

Third-party cookies may be set by Google for analytics (§3.3) and advertising (§5). In the European Economic Area, the UK, and Switzerland, a single Google consent dialog asks for your choices before any of these cookies are used, and both analytics and advertising honour that choice. Google also stores your consent decision itself so it does not have to ask again.

5. Third-Party Services

5.1 Advertising

We show ads served by Google AdSense. Google and its partners may use cookies and similar technologies to serve and measure ads. If you are in the European Economic Area or the UK, Google's certified consent dialog will ask for your choices before any advertising cookies are used, and ads are served according to that choice (including the option of non-personalised ads). Google may use data as described in How Google uses information from sites that use its services.

You can manage ad personalisation in Google Ads Settings and opt out of third-party advertising cookies at aboutads.info.

Beyond the services listed above, we do not sell, rent, or share personal data with any third parties.

6. Data Retention

• Diagram content: Not retained (processed in-memory only)
• Server logs: 30 days, then deleted
• Rate-limit counters: Expire automatically at the end of each rate-limit window

7. Your Rights

Depending on your jurisdiction, you may have the right to access, correct, export, or delete the personal data we hold about you. To exercise any of these rights, contact us. We will respond within 30 days.

If you are located in the European Economic Area, you have rights under the GDPR. If you are a California resident, you have rights under the CCPA. These rights include the right to know what data we collect, the right to deletion, and the right to opt out of sale (we do not sell data).

8. Security

All traffic between your browser and our servers is encrypted via TLS 1.2+. We follow security best practices including regular dependency audits, least-privilege server configuration, and automatic OS patching.

9. Children's Privacy

The Service is not directed at children under the age of 13. We do not knowingly collect personal data from children. If you believe a child has submitted personal data to us, contact us and we will delete it promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date at the top of this page. Continued use of the Service after the update constitutes acceptance of the revised policy.

11. Contact

Questions about this Privacy Policy? Use our contact form or open an issue on GitHub.