Privacy

The short version: nothing about you leaves your machine.

The app

• The editor sends nothing about you or your diagrams. There is no account, no sign-in, no telemetry, no crash reporting. After the first visit it is fully cached and works with the network cable pulled.
• The one thing it does ask for is itself: now and then it checks this site for a newer version, which is what puts the “Update available” prompt on screen. That is a request to this site for the app’s own code — no third party, no identifier, nothing about what you have drawn — and the new version is only applied when you click Reload.
• Your diagrams are saved to files you choose and to your browser’s local storage for autosave. They are never uploaded anywhere.
• The desktop app has exactly one optional network call: a notify-only update check against this site’s release feed. It sends nothing but the request itself, downloads nothing without you clicking, and can be turned off in settings.
• Collaboration is end-to-end encrypted between the participants, always. Who carries it depends on which version you are using, and this changed in August 2026, so it is worth being exact.
  
  In the desktop app it is peer-to-peer: your diagram travels directly between the participants’ machines, and where that works nothing passes through us at all. Where a direct connection cannot be made — a strict firewall, an awkward NAT — it falls back to the same relay of ours described below. It used to fall back to a public relay operated by n0; it no longer does, because a browser and a desktop can only reach each other if they meet on the same relay, and the browser can only use ours.
  
  In the browser it is always relayed — a web page cannot make the kind of direct connection this uses — and that relay is ours, running on this site rather than n0’s. We changed it so that everything the app touches is one address, which is what lets people behind strict firewalls use it at all. Be clear about what that means: your diagram passes through a server we run. It is end-to-end encrypted between the participants, so what reaches us is ciphertext we cannot read, and we store none of it — the relay forwards packets and keeps nothing. But it is our machine in the path, where before it was somebody else’s, and you should know that rather than infer it.
  
  The app tells you when it is happening, on both sides: the status pill reads relay whenever anyone in the session is.
• AI assistants (desktop) — running Drawbridge --mcp turns the app into a local MCP server an assistant of your choosing can call to read, render and generate drawings. The server itself makes no network call — it speaks only over its own stdin/stdout to the assistant that started it. Be clear about the boundary, though: a drawing you let an assistant read, and a topology you ask it to draw, are handed to that assistant — and so to whoever runs it. That is your choice to make per assistant; nothing crosses that boundary until you configure a client yourself.
• The hosted API (beta) — when you use our server instead of your own installation, a document you send is uploaded to it, rendered, returned, and forgotten: it is held in memory and scratch space for the duration of your request and is not written to any log, database or file. We do not record what you sent or what came back; the access log records that a request happened — the time, the size, the status, and what the service was asked to do: which capability, which export format, how long it took, and whether one of our limits refused it — never its content, and documents never appear in URLs. That last part is how we size the service, and it is deliberately the most we keep: not the name you asked us to call the file, not your address, not one byte of the drawing. If you would rather nothing left your machine at all, every one of these capabilities also runs locally — the desktop app is the same engine.

This website

• No cookies. No analytics. No trackers. No third-party requests — with exactly one exception, which only happens if you ask for it: see the tip panel below.
• The web server keeps only the short-lived technical logs any web server produces, used for keeping the service running and for two numbers we care about: how often the app is downloaded, and how much it is used and costs to serve. Three things are logged and nothing else — fetches of the release files, requests to the web app at /app, and requests to the hosted API and MCP door (the request line, and what the service says it was asked to do — see above: never a document). All three are counted into daily totals: downloads per file, and for the app how many requests, how many bytes, how many times it was opened, and how many distinct addresses that day. The stored counts are plain integers: no addresses, no user agents, no identifiers, nothing that can single anyone out or link one day to the next, and the raw log is emptied as it is counted. Browsing the rest of the site — these pages, the docs, the download page itself — is not logged at all, and nothing about what you draw or do inside the app is ever sent here.
• The feedback form sends exactly what you type — the channel you pick for a reply travels with the contact line you write — plus a file if you choose to attach one; nothing else is collected with it. Leave the contact field empty and the submission is anonymous. See attaching a file below.

Attaching a file to feedback

The feedback form has an optional file field. It exists for one thing: Drawbridge’s Report a bug can save a drawbridge-bug-report.zip containing the screenshots you chose to include, and pictures cannot travel inside the text of a report. Nothing is attached unless you pick the file yourself.

If you attach it, the .zip is stored in a private repository that only the maintainer can read, and the report it belongs to links to it. It is stored as you sent it — never unpacked, scanned, or looked inside on the way through. Nothing is extracted from it, and it is not shared with anyone else or used for anything but fixing what you reported.

The app never uploads anything by itself. It writes the .zip to your own downloads folder and you decide whether to send it — and it shows you every file it put in there first. If you would rather not send pictures at all, simply do not attach the file; the written report goes through on its own.

The tip panel

The donate page can show a Ko-fi tip panel inline, so you do not have to leave this site to support the project. That panel is loaded from ko-fi.com, and it is the only thing anywhere on this site that is not served from this domain.

It does not load until you press the button. Open the donate page, read it, and leave again, and nothing is ever requested from Ko-fi — no frame, no script, no cookie. Press the button and you are choosing to load Ko-fi's page inside ours, at which point Ko-fi's own privacy policy applies to what happens inside that panel. Payment is handled entirely by Ko-fi; card details never touch this site, and we never see them.

If you would rather not load it at all, the same page has a plain link to Ko-fi that works exactly as any link does.

External links

Other outbound links (GitHub, Ko-fi, licence texts) are plain links you choose to follow. Following one takes you to a site with its own privacy policy.