Privacy Policy

Last updated: June 27, 2026

Modudraft ("we", "us", or "our") operates the Modudraft system-design platform at modudraft.com and app.modudraft.com. This policy explains what data we collect, why, and how you can control it.

1. Data We Collect

Account information

When you sign up, we store your email address, display name, and (if you use OAuth) a profile image URL. We never see your OAuth provider password.

Diagram content

Diagrams you save are stored on our servers so you can access them from any device. We treat your diagrams as private by default — only you can access them unless you explicitly create a share link.

Usage data

We use privacy-first analytics that do not use cookies, do not track users across sites, and do not collect personally identifiable information. We use it only to understand aggregate page traffic and feature usage.

Payment information

Payments are processed by our payment provider. We never see or store your credit card number. We store only the customer ID and subscription status required to gate plan features.

Log data

Our servers generate request logs that include IP addresses, timestamps, and HTTP request metadata. These logs are retained for up to 30 days and are used solely for debugging and security monitoring. Email addresses are stripped from log lines before writing.

2. How We Use Your Data

• To provide and improve the Modudraft service
• To authenticate you and secure your account
• To send transactional emails (password reset, magic link sign-in) — no marketing emails without explicit opt-in
• To process subscription payments
• To detect and prevent abuse

3. Data Sharing

We do not sell your data. We share data only with trusted third-party service providers necessary to operate the platform (such as hosting, databases, payment processing, and authentication). Each provider is bound by a data processing agreement and may not use your data for any other purpose.

If required by law, we may disclose information to comply with a valid legal process. We will notify you unless prohibited from doing so.

4. Data Retention

• Diagrams in the Bin are permanently deleted 30 days after you move them there.
• Account deletion triggers a soft-delete immediately. All your data is hard-deleted within 30 days. You can request immediate deletion by emailing [email protected].
• API request logs are retained for up to 30 days.
• Backups may retain copies for up to 90 days after deletion.

5. Your Rights (GDPR / CCPA)

Depending on where you live, you may have the right to:

• Access a copy of your data — use the "Export my data" button in Dashboard → Settings.
• Delete your account and all associated data — use "Delete account" in Dashboard → Settings, or email [email protected].
• Correct inaccurate personal data — update your display name in Settings.
• Portability — your diagrams can be exported as .modudraft JSON files at any time.
• Object to processing — contact us at [email protected].

We respond to data requests within 30 days.

6. Cookies and Local Storage

We use a single httpOnly session cookie (domain .modudraft.com) to keep you signed in. This cookie is strictly necessary and cannot be opted out of while using the service. We do not use advertising cookies or third-party tracking cookies.

The app also uses localStorage to store your diagram preferences (view mode, theme) and autosave drafts. This data stays on your device and is never sent to our servers.

7. Security

All data in transit is encrypted via TLS. Authentication cookies are httpOnly, Secure, and SameSite=Lax. Passwords are hashed with bcrypt. API keys are stored as SHA-256 hashes. We run on Cloudflare's infrastructure, which provides DDoS protection and WAF.

If you discover a security vulnerability, please disclose it responsibly to [email protected].

8. Children

Modudraft is not directed at children under 16. We do not knowingly collect data from anyone under 16. If you believe we have inadvertently collected such data, contact us and we will delete it promptly.

9. Changes to This Policy

We may update this policy from time to time. Material changes will be announced via email or an in-app notice at least 14 days in advance. The "Last updated" date at the top of this page always reflects the current version.

10. Contact

Questions about this policy? Email us at [email protected] or write to:
Modudraft, [email protected]

← Back to home