Privacy Policy

Last updated: 8 September 2026

Indented ERD ("the Service") is a browser-based tool for visualising database schemas. This policy explains what happens to your data when you use it.

What the Service does with your input

Everything you type, paste, or drop into the Service — DDL, DBML, and the resulting diagram — is processed entirely inside your browser. It is never transmitted to a server operated by us. There is no account to create, and we never ask you for personal information.

Data stored on your device

The Service stores the following in your browser. None of it leaves your device.

• Editor contents, undo history, and your current view settings, in session storage (erd:editor-state, erd:ui-state). Your browser clears session storage when you close the tab.
• Your color theme choice — follow your operating system, always light, or always dark — in local storage (erd:theme). This persists until you clear your browser storage, so that the Service keeps the appearance you chose on every visit.

Share links

The share button encodes your schema into the fragment of a URL — the part after the #. Browsers do not send fragments to servers, so the schema is not transmitted when the link is opened. Anyone who receives the link can see the schema it contains, so please treat share links for confidential schemas accordingly.

Hosting

The Service is hosted on Cloudflare Workers. When you access the Service, Cloudflare processes connection metadata — including your IP address, user agent, request time, and requested URL — in order to deliver the site and protect it from abuse. Cloudflare may also set security cookies such as __cf_bm. This processing is carried out by Cloudflare, not by us. See the Cloudflare privacy policy at https://www.cloudflare.com/privacypolicy/.

Analytics

We use Cloudflare Web Analytics to see how many people visit the Service. It is the only analytics service we use. It does not use cookies, local storage, or any other storage in your browser, and it leaves no identifier on your device. There is nothing for you to accept or decline, and nothing it has set that you could remove.

For each page it records the address of that page, the site that linked you to it, your country, your browser, your operating system, whether you are using a desktop, mobile, or tablet device, and measurements of how quickly the page loaded. It does not record the query string of the address — the part after the ?.

It also does not send the fragment — the part after the #, where share links carry your schema. We have confirmed on the live site that the address it reports ends at the path, so opening a share link does not send the schema it contains to anyone.

This data is collected and processed by Cloudflare, which also hosts the Service — the connection metadata that comes with hosting is described under Hosting above. See the Cloudflare privacy policy at https://www.cloudflare.com/privacypolicy/.

Your rights

If you are in the European Economic Area or the United Kingdom, you have the right to access, correct, erase, restrict, and port your personal data, and to object to its processing. Hosting metadata and Cloudflare Web Analytics are processed on the basis of our legitimate interest in delivering and securing the Service and in knowing how many people reach it.

Because we do not operate servers that store your data, requests relating to hosting metadata and to Cloudflare Web Analytics are best directed to Cloudflare, using the links above. You are welcome to contact us first and we will help where we can.

Changes to this policy

If this policy changes, the date at the top of this page will be updated.

Contact

Questions, bug reports, and privacy-related requests can be sent through our contact form. The form is provided by Google Forms, so anything you submit through it is stored by Google. Giving an email address is optional and is used only to reply to you.