Privacy Policy

Last updated: October 24, 2026

Modudraft ("we", "us", or "our") operates the Modudraft system-design platform at modudraft.com and app.modudraft.com. This policy explains what data we collect, why, and how you can control it.

1. Data We Collect

Account information

When you sign up, we store your email address, display name, and (if you use OAuth) a profile image URL. We never see your OAuth provider password.

Diagram content

Diagrams you save are stored on our servers so you can access them from any device. We treat your diagrams as private by default - only you can access them unless you explicitly create a share link.

Usage data

We use privacy-first analytics that do not use cookies, do not track users across sites, and do not collect personally identifiable information. We use it only to understand aggregate page traffic and feature usage.

Payment information

Payments are processed by our payment provider. We never see or store your credit card number. We store only the customer ID and subscription status required to gate plan features.

Log data

Our servers generate request logs that include IP addresses, timestamps, and HTTP request metadata. These logs are retained for up to 30 days and are used solely for debugging and security monitoring. Email addresses are stripped from log lines before writing.

2. How We Use Your Data

• To provide and improve the Modudraft service
• To authenticate you and secure your account
• To send transactional emails (password reset, magic link sign-in) - no marketing emails without explicit opt-in
• To process subscription payments
• To detect and prevent abuse

3. Data Sharing

We do not sell your data. We share data only with trusted third-party service providers necessary to operate the platform (such as hosting, databases, payment processing, and authentication). Each provider is bound by a data processing agreement and may not use your data for any other purpose.

AI Architect. Nothing is sent to an AI model until someone runs a review or sends a chat message. Then the diagram content needed for that run is sent to Cloudflare Workers AI, and only there: the models run on Cloudflare, and no data goes to Moonshot or OpenAI. Cloudflare does not train on customer data. The latest review is stored with the diagram, so everyone who can open the diagram can read it. Organization admins can turn AI Architect off for the organization's diagrams; on those diagrams members then get only the free rule checks, which run in the browser and send nothing. See the AI Architect docs.

If required by law, we may disclose information to comply with a valid legal process. We will notify you unless prohibited from doing so.

4. Data Retention

• Diagrams in the Bin are permanently deleted 90 days after you move them there.
• Account deletion triggers a soft-delete immediately. All your data is hard-deleted within 90 days. You can request immediate deletion by emailing [email protected].
• API request logs are retained for up to 30 days.
• Backups may retain copies for up to 90 days after deletion.

5. Your Rights (GDPR / CCPA)

Depending on where you live, you may have the right to:

• Access a copy of your data - use the "Export my data" button in Dashboard → Settings.
• Delete your account and all associated data - use "Delete account" in Dashboard → Settings, or email [email protected].
• Correct inaccurate personal data - update your display name in Settings.
• Portability - your diagrams can be exported as .modudraft JSON files at any time.
• Object to processing - contact us at [email protected].

We respond to data requests within 30 days.

6. Cookies and Local Storage

We use a single httpOnly session cookie (domain .modudraft.com) to keep you signed in. This cookie is strictly necessary and cannot be opted out of while using the service. We do not use advertising cookies or third-party tracking cookies.

The app also uses your browser's localStorage for display preferences and templates: your theme (light or dark), the minimap setting, which sidebar sections, workspaces and properties cards are open, the organization you last picked in the sidebar, the view settings of each diagram (view mode, node style, lock, active tab, canvas lens, focus mode and security view), a flag that the welcome screen has been shown, and the diagram templates and Notes templates you save. This data stays on your device and is never sent to our servers.

While you sign up or sign in, the app also keeps a few short-lived entries in your tab's sessionStorage: the plan and workspace name you picked, the single sign-on notice, and a marker that the trial-end check has run. The browser clears them when you close the tab. The app reads the sign-up entries to finish setting up your account; nothing else in them is diagram data.

7. Security

All data in transit is encrypted via TLS. Authentication cookies are httpOnly, Secure, and SameSite=Lax. Passwords are hashed with bcrypt. API keys are stored as SHA-256 hashes. We run on Cloudflare's infrastructure, which provides DDoS protection and WAF.

If you discover a security vulnerability, please disclose it responsibly to [email protected].

8. Children

Modudraft is not directed at children under 16. We do not knowingly collect data from anyone under 16. If you believe we have inadvertently collected such data, contact us and we will delete it promptly.

9. Changes to This Policy

We may update this policy from time to time. Material changes will be announced via email or an in-app notice at least 14 days in advance. The "Last updated" date at the top of this page always reflects the current version.

10. Contact

Questions about this policy? Email us at [email protected] or write to:
Modudraft, [email protected]

← Back to home