Privacy Policy

Last updated: 3 August 2026

Indented ERD ("the Service") is a browser-based tool for visualising database schemas. This policy explains what happens to your data when you use it.

What the Service does with your input

Everything you type, paste, or drop into the Service — DDL, DBML, and the resulting diagram — is processed entirely inside your browser. It is never transmitted to a server operated by us. There is no account to create, and we never ask you for personal information.

Data stored on your device

The Service stores the following in your browser. None of it leaves your device.

• Editor contents, undo history, and your current view settings, in session storage (erd:editor-state, erd:ui-state). Your browser clears session storage when you close the tab.
• Your Google Analytics choice from the consent banner, in local storage (erd:consent). This persists until you clear your browser storage, so that we do not ask you again on every visit.

Share links

The share button encodes your schema into the fragment of a URL — the part after the #. Browsers do not send fragments to servers, so the schema is not transmitted when the link is opened. Anyone who receives the link can see the schema it contains, so please treat share links for confidential schemas accordingly.

Hosting

The Service is hosted on Cloudflare Workers. When you access the Service, Cloudflare processes connection metadata — including your IP address, user agent, request time, and requested URL — in order to deliver the site and protect it from abuse. Cloudflare may also set security cookies such as __cf_bm. This processing is carried out by Cloudflare, not by us. See the Cloudflare privacy policy at https://www.cloudflare.com/privacypolicy/.

Analytics

We use two analytics services, and they work differently. Google Analytics 4 tells us how the Service is used, and it runs only if you agree to it. Cloudflare Web Analytics tells us how many people visit, and it runs without asking, because it stores nothing on your device. The two sections below describe each of them.

Google Analytics 4

We use Google Analytics 4 to understand how the Service is used — for example, how many people visit and which features they reach.

Google Analytics is loaded only if you select Accept on the consent banner. If you select Decline, or make no choice at all, no Google Analytics script is loaded and no Google Analytics cookies are set. Declining does not change how the tool works.

When it is active, Google Analytics sets cookies (_ga and _ga_ followed by a container identifier) and collects page views, interactions, referring pages, device and browser information, and an approximate location derived from your IP address. We do not receive your IP address in a form that identifies you, and we do not combine analytics data with any other information.

For how Google processes this data, see https://policies.google.com/privacy and https://support.google.com/analytics/answer/6004245. You can also install the Google Analytics opt-out browser add-on at https://tools.google.com/dlpage/gaoptout.

Cloudflare Web Analytics

We use Cloudflare Web Analytics to see how many people visit the Service. It does not use cookies, local storage, or any other storage in your browser, and it leaves no identifier on your device. Because there is nothing for you to consent to storing, it is not covered by the consent banner: it runs whether you select Accept or Decline, and there is nothing it has set that you could remove.

For each page it records the address of that page, the site that linked you to it, your country, your browser, your operating system, whether you are using a desktop, mobile, or tablet device, and measurements of how quickly the page loaded. It does not record the query string of the address — the part after the ?.

It also does not send the fragment — the part after the #, where share links carry your schema. We have confirmed on the live site that the address it reports ends at the path, so opening a share link does not send the schema it contains to anyone.

This data is collected and processed by Cloudflare, which also hosts the Service — the connection metadata that comes with hosting is described under Hosting above. See the Cloudflare privacy policy at https://www.cloudflare.com/privacypolicy/.

Changing your choice

You can change your Google Analytics choice at any time using the control on this page. Withdrawing consent stops Google Analytics from loading and removes the Google Analytics cookies this site has set. Cloudflare Web Analytics is not affected by this control, because it does not rely on your consent and has set nothing to remove.

Your rights

If you are in the European Economic Area or the United Kingdom, you have the right to access, correct, erase, restrict, and port your personal data, and to object to its processing. Our legal basis for Google Analytics is your consent, which you may withdraw at any time without affecting processing that took place beforehand. Hosting metadata and Cloudflare Web Analytics are processed on the basis of our legitimate interest in delivering and securing the Service and in knowing how many people reach it.

Because we do not operate servers that store your data, requests relating to hosting metadata and to Cloudflare Web Analytics are best directed to Cloudflare, and requests relating to Google Analytics data to Google, using the links above. You are welcome to contact us first and we will help where we can.

Changes to this policy

If this policy changes, the date at the top of this page will be updated.

Contact

Questions, bug reports, and privacy-related requests can be sent through our contact form. The form is provided by Google Forms, so anything you submit through it is stored by Google. Giving an email address is optional and is used only to reply to you.