Privacy policy.

Line9 is operated by Moverve Limited (the controller, in GDPR terms). Reach the controller at privacy@line9.ai.

The web viewer renders your diagrams in your browser. The CLI renders on your machine. The Mermaid source you type, all node and edge labels, your node IDs, your comments, your colours, and any other free-form content never leave your device unless you explicitly publish a diagram, save one to a workspace, or yourself type or paste content into a feedback message. We do not store your diagram to render it.

Two product paths can send diagram-derived data to our servers, and they are not the same thing. Anonymous diagram telemetry (see § 7) records the structure of a diagram you render: an anonymised canonical graph — nodes in canonical order, edges, node shape categories, subgraph nesting — plus a solve event and a render event covering outcome, timing, viewport, theme, and the referrer host. It carries no node or edge labels, no node IDs, and no Mermaid source; its wire format structurally cannot. Render feedback (see § 8) is different: it stores the free-text message you type, an optional email if you opt in on the web panel, and account identifiers when you are signed in or when the CLI call carries a machine token — and, from the web panel only, an optional topology-key reference (a structural hash of the on-screen diagram, not the graph itself). Telemetry never carries your words; anything you type or paste into that message is stored as you wrote it.

We rely on four legal bases under GDPR Art. 6: contract for the data needed to deliver your subscription and workspace; legitimate interests for security logs, anti-abuse, operating the rendering engine, product analytics needed to understand usage and improve Line9 (with a durable first-party id you can decline — see § 9), and the product-signal render feedback that helps us improve layout quality — the message you type, its optional topology reference, and the account identifiers recorded when you submit while signed in, or when the CLI call carries a machine token; consent for the optional feedback email broadcast opt-in (you type the address and accept the opt-in wording below — withdraw by emailing privacy@line9.ai); and legal obligation for tax, billing, and audit records we are required to retain. We do not process special categories of personal data and do not run advertising or profiling pipelines.

• Cloudflare — hosting, DNS, CDN, edge runtime, D1 database, R2 object storage, KV, Queues, Analytics Engine. Feedback submissions are stored in D1 on Cloudflare. Anonymous diagram telemetry (solve/render events and the topology corpus) stays on Cloudflare only.
• PostHog (EU cloud, eu.i.posthog.com) — product analytics for the growth funnel: page views and curated usage metadata. Events are reverse-proxied through Line9's first-party path (/api/ph) so the browser talks to line9.ai, not a third-party host. Diagram source and labels never go to PostHog. See § 9.
• Stripe — subscription billing, payment processing, Stripe Tax, invoice receipts, and payment-failed / dunning customer emails. Card numbers and tax-residency data live with Stripe; Line9 holds only the identifiers and the derived subscription state.
• Resend — transactional email (magic-link sign-in, workspace invites, welcome / cancel-acknowledgement / access-ended billing notices, security notices such as refresh-token compromise, and internal founder notices when feedback is submitted). Payment receipts and payment-failed mail are Stripe-owned. We do not use Resend to email you about feedback unless you left an address under the broadcast opt-in and a future broadcast is sent.
• GitHub — OAuth identity provider, when you choose "Continue with GitHub". We read your primary email and username; nothing else.

You may request access to the personal data we hold about you, correction of inaccurate data, deletion, restriction, or portability. The simplest path is the self-serve account deletion at /app/account: it anonymises the personal data tied to your account, removes you from every workspace, and follows the billing-continuity rules in our EULA. Audit and billing records remain for compliance, pointing at an anonymised tombstone rather than your name and email.

Account deletion does not reach a render-feedback submission. Self-serve erasure anonymises your user record in place — it does not delete the feedback row, its message, or any email you left on it. Those are a separate store: to delete a feedback submission (including an email you left), email privacy@line9.ai and include the address you submitted, if any, and an approximate time. For any other request, email privacy@line9.ai. EEA and UK residents have the additional right to lodge a complaint with their local supervisory authority.

The capture pipeline sends three things per diagram: an anonymised canonical-graph write to the topology corpus, a solve event, and a render event — outcome, timing, viewport, theme, and the referrer host, with no labels, node IDs, or Mermaid source. That data stays on Cloudflare (Analytics Engine + R2); it is not sent to PostHog. A separate diagram-capture transparency page walks through them, explains what the canonical fingerprint is and is not, and gives you a switch to opt out of the corpus — the solve and render events continue as operational signal. Render feedback is a separate path with its own field list; see § 8 below. Product analytics (PostHog) is a different system — see § 9. We keep the capture detail on its own page because it is the most surprising thing the renderer does, and we want it to be auditable rather than buried.

When you use the in-product "report this render" panel or the line9 feedback CLI verb, we store a single row in our Cloudflare D1 database so we can improve layout quality. We do not automatically capture or attach your diagram. The CLI verb sends only your message; the web panel may also attach an optional anonymous topology reference (a structural hash of the on-screen diagram from the capture pipeline) — never Mermaid source, node labels, or free text pulled from the editor. Content you type or paste into the message field is stored as you wrote it; if you paste diagram source there, it is stored. Nothing about the HTTP request (IP, User-Agent, Origin, headers) is persisted on the feedback row; rate limiting is stateless and does not write request context into the table.

Each feedback row holds exactly these fields:

• id — Server-generated identifier for the submission.
• created_at — Timestamp when the submission was received.
• kind — Which surface sent it — web-anon (browser, logged out), web-authed (browser, signed in), or cli. For the browser this tracks signed-in vs logged-out; a CLI submission is always cli whether or not it carried a machine token, so any identity lives in user_id/account_id, not here.
• message — The free-text note you typed. If you want diagram content included, you paste it yourself — we never pull source from the editor.
• email (optional) — Contact address you chose to leave under the opt-in "Email me when layout improves for diagrams like this". Never derived from the request or your account without you typing it.
• topology_key + topology_key_version (optional) — Anonymous structural fingerprint of the on-screen diagram from the capture pipeline — a hash of graph shape, not labels or Mermaid source. Web panel only; the CLI verb never sends it. Absent for non-flowcharts, unsupported kinds, or before the first successful render. Opting out of the anonymous topology corpus (see § 7) stops the corpus write, not this per-submission reference — the panel still attaches it to the render you are reporting.
• user_id / account_id (optional) — Present only when you were signed in (or the CLI used a machine token), linking the row to your account. Deleting your account does not remove the feedback row — see § 6 for how erasure and feedback deletion differ.
• status — Internal triage marker (open on insert). Not personal data about you.

Optional email opt-in. If you leave an email, the product shows this wording verbatim:

Email me when layout improves for diagrams like this

Optional. This is a broadcast opt-in only — not a promise that we will reply to your report.

That address is stored so we can later send a broadcast when layout improves for diagrams with a similar structure. It is not a ticket, and it is not a promise of a personal reply. The broadcast itself is not built yet — in v1 the opt-in address is only stored, and no broadcast is sent. Every submission does trigger one internal founder-notification email (via Resend — see § 5) that includes your message and any address you left; that is how we read feedback, not a reply to you. Lawful basis: legitimate interests for the message, the optional topology reference, and the account identifiers recorded when you are signed in, or when the CLI call carries a machine token — all as product signal to improve layout quality; consent for the optional email opt-in. Retention: until you request deletion at privacy@line9.ai.

Line9 uses PostHog EU cloud for product analytics — funnels, retention, and usage paths — separate from the Cloudflare Analytics Engine stream that powers engine telemetry (§ 7). Browser events go through a first-party reverse proxy on line9.ai (/api/ph) to PostHog's EU ingest. What is sent is usage metadata only: automatic page views/leaves (with URL hashes and query strings stripped so diagram source in a fragment never leaves), and curated events such as render, export, and share. Mermaid source, node labels, and free-text diagram content are never included; the client drops forbidden property keys if a bug tries to send them. Session replay, autocapture of element text, heatmaps, and exception capture are disabled in code.

Durable first-party id. By default we set a durable analytics id in this browser (localStorage + first-party cookie) so we can tell that the same browser rendered, then exported, then returned — without knowing who you are. A slim notice discloses this on first visit. Choosing No thanks records a decline: analytics continues in-memory for that session only (no durable id). You can also change the preference on the privacy transparency page. Clearing site data clears the stored choice and the id.

When you sign in, we may link the prior anonymous analytics id to your account id so conversion paths can be measured for subscribers — still without diagram content. That link is part of the same product-analytics purpose described here.

Line9 runs on Cloudflare's global network, on Stripe's payment infrastructure, and on PostHog's EU cloud for product analytics. Personal data may be processed in countries other than your own. Our sub-processors operate under Standard Contractual Clauses or equivalent transfer mechanisms where required.

When we change this policy, the last updated date at the top of the page changes too. Material changes that affect the data we collect or how we use it will be announced via email to the billing-primary address on file at least thirty days before they take effect.