Privacy Policy

Last updated: July 4, 2026

noddle collects as little as it can get away with. This page says exactly what is collected, where it goes, and how to get rid of it.

What we collect

  • Account data — email, display name, and a password hash (or your identity from an SSO provider, if your team uses OIDC single sign-on). Guests joining a shared board have no account: they pick a display name that lives in their own browser session, not on our servers as identity.
  • Your content — boards (diagram data and rendered SVG), comments, version history, and files you upload for import or AI conversion.
  • Operational records — an audit trail of account and board lifecycle events (login, share, delete) visible to the board owner, subscription state, and ✦ credit usage. No advertising trackers; analytics are currently disabled on this site.
  • Payments — handled entirely by Lemon Squeezy as merchant of record. Card numbers never touch noddle’s servers; we receive only the subscription status and a customer reference.

AI processing

AI features send only the content you explicitly submit — the text prompt, Mermaid, or image you hand to generation, or the board you ask the Claude co-editor to change — to an AI model for processing. Normal drawing, editing, collaboration, import, and export never call an AI model.

  • On subscription plans, AI requests go to Claude via our model-serving provider.
  • If you bring your own API key (BYOK), requests go directly to the provider you configured (Anthropic, OpenAI, or Google), under that provider’s data terms. Your key is stored obfuscated and is never shown back in full.

Don’t submit content to AI features that you’re not allowed to share with a model provider — mask secrets and personal data first.

Where data lives, and for how long

Boards and account data are stored on noddle’s infrastructure and kept while your account exists. Deleting a board deletes its data, versions, and comments. Deleting your account (via support) removes account data and owned boards, minus what payment law requires Lemon Squeezy to retain on their side. Every plan can export boards (SVG, PNG, Board JSON, Mermaid) at any time — take your data with you whenever you like.

Cookies

One session cookie to keep you signed in. No third-party advertising cookies.

Security

Uploaded and AI-generated SVG is sanitized before storage and display; API tokens are stored as SHA-256 hashes and shown only once; access control is enforced server-side on every request. No system is perfect — if you find a vulnerability, please report it via the contact page and it will be handled with priority.

Your rights

You can access and export your data yourself, correct your profile in-app, and request deletion at any time. For anything else — questions, complaints, data requests — use the contact page. You’ll get an answer from the founder, not a form letter.

Material changes to this policy will be announced on the site before they take effect.