diagrams.free (https://diagrams.free)
Last updated: 11 June 2026
Plain-language summary, not legal advice.
diagrams.free is a free drawing app that runs in your browser. Your diagrams are stored on your device by default. We do not run application servers that receive or store your canvas data — the site is static files on GitHub Pages. We use Google Analytics 4 for basic visit statistics. Optional Google sign-in is only for features you turn on (such as Drive backup).
diagrams.free is maintained independently of excalidraw.com and Excalidraw+. For privacy questions or requests, contact support@diagrams.free.
When you use diagrams.free, the following may be stored locally in your browser:
This data stays on your device unless you export a .excalidraw file, copy a
share link, or use an optional sync feature. Clearing site data in your browser removes local
storage for diagrams.free.
Because there is no diagrams.free backend for drawings, we do not receive your canvas content, vault contents, or exports unless you deliberately send them somewhere else (for example by uploading to your own Google Drive or emailing a file). Messages you send through Contact us are handled by Google as described in the contact form section below.
If you use Contact us in the app menu or Help dialog, you send your name, email address, subject, and message to a small Google Apps Script service we operate. That service uses Google Gmail to deliver your message to support@diagrams.free and to send you a short confirmation email. We use this only to respond to your request, not for advertising. Your drawing data is not included unless you type it into the message field. You can also email us directly at support@diagrams.free without using the form.
If you choose Support diagrams.free in the app menu, you are sent to Stripe to complete a voluntary one-time or monthly payment. Stripe processes your payment; we do not receive or store your card number on diagrams.free servers (there is no application server for drawings). Stripe’s Privacy Policy applies to checkout. You can manage or cancel monthly support through Stripe’s customer tools or receipts.
We use Google Analytics 4 (Google LLC) to understand how the site is used — for example page views, approximate location (country/region), device type, and referral source. Google may set cookies or use similar technologies. Analytics data is processed by Google under the Google Privacy Policy.
Your drawings are not sent to Google Analytics. Custom events in the app are limited to coarse product actions, not diagram content. Examples include: opening the command palette, exporting an image or file, starting a new saved canvas, first use of the drawing surface, app load metadata (version, embedded vs top-level page), voluntary donation modal and checkout clicks, donation reminder prompts (shown, snoozed, or support click), and when a return from Stripe applies a local supporter preference.
If you are in the European Economic Area or the United Kingdom, we ask for your choice before enabling analytics cookies. You can Accept analytics or Reject using the banner at the bottom of the page. Your choice is stored in your browser (local storage) so we do not ask again on every visit.
Until you accept, analytics storage stays off for your region (Google Consent Mode). Visitors outside the EEA/UK are not shown the banner; analytics may run under default settings for those regions unless you block it in your browser.
To decide whether to show the banner, we perform a one-time country lookup via api.country.is (your IP is processed by that service to return a country code). If the lookup fails, we show the banner to be safe.
You can change your mind later by clearing site data for diagrams.free in your browser, which removes the stored consent choice and will show the banner again on your next visit (in the EEA/UK).
You can also limit analytics by blocking scripts from
googletagmanager.com / google-analytics.com, or installing
Google’s Analytics opt-out add-on
(where available for your browser).
If you choose to connect Google Drive, sign-in and file access are handled by Google under
Google’s privacy policy. diagrams.free
requests only the access needed to work with files the app creates or opens for you, such as
backup and restore under a diagrams.free/ folder on your Drive.
Typical OAuth scopes include:
https://www.googleapis.com/auth/drive.file — access to files created or opened
by the app
openid, email, profile — basic account info if shown
in the UI
You can revoke access anytime in your Google Account permissions. Files on Drive remain under your Google account and sharing settings.
To keep Drive backup working without asking you to sign in every hour, diagrams.free uses a
small Cloudflare Worker at api.diagrams.free as an OAuth helper.
When you connect Google Drive, Google may issue a long-lived refresh token;
that token is stored in Cloudflare Workers KV (edge storage operated by
Cloudflare, Inc.), not in the static site on GitHub Pages. The browser keeps only a short-lived
access token and a signed HttpOnly cookie
(df_oauth on diagrams.free) that points to your server-side session.
Your drawings and vault contents are not sent to this service — only OAuth
tokens needed for Drive API calls. When you sign out of Drive in the app, we delete the KV
session and clear the cookie. Cloudflare’s
Privacy Policy applies to that
infrastructure.
If you sign in, the app may store a small JSON file at
diagrams.free/app/donate-reminder-state.json on your Drive. It holds only
donation-reminder preferences and coarse counters (for example snooze dates, supporter flags,
tab-session counts, and accumulated active-time milliseconds since the last prompt). It does
not contain your drawings or vault contents.
If you use a share feature that uploads a scene to Google Drive, anyone with the link you distribute may be able to open that file according to the sharing settings you set in Google Drive. diagrams.free does not host shared diagram files on its own servers.
Loading diagrams.free may contact other providers, for example:
libraries.excalidraw.com and library files from
raw.githubusercontent.com (Excalidraw’s public library repository). Only
what you choose to install is stored locally.
diagrams.free.
api.diagrams.free (OAuth refresh tokens only; see
Google sign-in and Drive).
Each third party has its own privacy practices.
diagrams.free itself does not set authentication cookies for a diagrams.free account (there is
no account). We store your analytics consent choice in browser local storage. If you connect
Google Drive, api.diagrams.free may set an HttpOnly session cookie
(df_oauth) as described above. Google Analytics and Google sign-in may set
cookies or use local storage as described above when those features load and when you have
allowed them.
Data on your device persists until you clear browser storage or uninstall site data. Analytics retention is controlled by Google Analytics settings. Drive files follow Google’s retention until you delete them. Google Drive refresh tokens held in Cloudflare KV are removed when you sign out in the app or when the session is revoked; otherwise they remain until you revoke access in your Google Account or we delete them as part of service maintenance.
Depending on where you live, you may have rights to access, correct, delete, or restrict processing of personal data. For data held only on your device, you can clear site data in your browser. For Google Analytics or Google Drive data, use Google’s tools or contact us at support@diagrams.free and we will help where we can.
diagrams.free is not directed at children under 13. We do not knowingly collect personal information from children.
We may update this page from time to time. The “Last updated” date at the top will change when we do. Continued use of the site after changes are posted means you accept the updated policy.
Email: support@diagrams.free · open an issue on GitHub.