Privacy Policy

Last updated: 6 August 2026

This policy explains what data Design Beaver ("we", "us") collects, why, and the choices you have. Design Beaver is an AWS architecture diagramming tool operated by Milin Paul. It covers both the marketing site (designbeaver.app) and the app (app.designbeaver.app).

The short version

• The app requires an account. You sign in with Google or GitHub, and your diagrams are stored on our servers (via Supabase), tied to your account — not just in your browser.
• We collect the email (and basic profile info) your sign-in provider shares with us, plus your email separately if you join the marketing site's waitlist.
• Only you can access your diagrams — access is enforced at the database level, not just in the app.
• We use privacy-friendly, cookieless product analytics and a sampled, input-masked session replay to understand how the tool is used and improve it.
• You can opt out of analytics at any time, and we honour your browser's Do Not Track / Global Privacy Control signal automatically.
• You can delete your account and every diagram in it yourself, at any time, from the app’s settings — see Your rights.

What we collect

Account & sign-in

Signing in is required to use the app. We support Google and GitHub sign-in; when you sign in, your provider shares your email address, name, and profile picture with us. We use Supabase for authentication and do not receive or store your Google/GitHub password. This data identifies your account and is not used for anything else.

Your profile

In the app’s settings you can edit your first and last name, and optionally record your role and industry. Name is prefilled from your sign-in provider so you can correct it; role and industry are entirely optional, are never required to use the app, and are used only in aggregate to help us decide what to build next. All of it is stored alongside your account and is visible only to you.

Diagrams you create

Diagrams you build in the app — including node/connection data, names, and any sticky notes or comments — are stored server-side in our database (Supabase/Postgres), tied to your account. Access is restricted to you at the database level (row-level security), so we don't casually browse your diagrams, but our infrastructure provider (Supabase) processes this data as part of hosting it. The free tier currently caps each account at 5 saved diagrams.

Waitlist email

If you join the marketing site's waitlist, we collect the email address you submit so we can contact you about access and product updates. This is processed and stored by our email provider, Resend, and is separate from your app account.

Usage analytics

We collect standard, aggregate usage data — pages viewed, features used, approximate location (derived from IP, not stored as a precise location), device and browser type, and referring links — to understand what's working and what to improve.

Session replay

A sampled subset of sessions is recorded as an anonymised replay of on-screen interactions.All form inputs and free-text you enter are masked (including your email and any diagram names or notes), so the content you type is not captured in the clear.

Server logs

Our hosting provider (Vercel) and database/auth provider (Supabase) process standard request logs, including IP addresses, as a normal part of serving the site and app securely.

Cookies & local storage

Our product analytics (PostHog) is cookieless — it uses your browser's local storage rather than tracking cookies. Google Analytics, when enabled, may set its own cookies to measure usage. We also use local storage for essential preferences, such as remembering that you dismissed the privacy notice or opted out of analytics. Opting out (below) stops Google Analytics from loading at all.

Who we share data with

We use a small number of trusted processors to run the service:

• Supabase — authentication and database hosting for your account and diagrams.
• Google / GitHub — OAuth sign-in providers. When you choose to sign in with one of these, they share your email, name, and profile picture with us; we don't see or store your password with either provider.
• Vercel — hosting and infrastructure.
• Google Analytics — usage analytics.
• PostHog — cookieless product analytics and session replay.
• Resend — waitlist email delivery and storage.

We do not sell your personal data.

International transfers

These providers may process data in the United States. Where we transfer data from the EEA or UK, we rely on the providers' standard contractual clauses and equivalent safeguards.

Legal basis (EEA/UK)

We process your account and diagram data because it's necessary to provide the service you signed up for (contractual necessity). We rely on our legitimate interest in understanding and improving the product for privacy-friendly analytics, and on your consent where required — which you can withdraw at any time via the opt-out below. Waitlist email is processed on the basis of your request to be contacted.

Your choices & opt out

You can opt out of all analytics and session replay on this site. We also automatically treat a browser Do Not Track or Global Privacy Control signal as an opt-out. Waitlist emails always include an unsubscribe link.

Data retention

Your account, profile, and diagrams are retained for as long as your account exists, and are deleted from our database the moment you delete it. Analytics data is retained by our providers per their standard retention windows, and waitlist emails are kept until you unsubscribe or ask us to delete them — neither is cleared automatically by deleting your account, but both are on request (see Your rights).

Your rights

Depending on where you live, you may have the right to access, correct, delete, or export your personal data, and to object to or restrict its processing.

Deleting your account — you can do this yourself, at any time, from Settings → Account in the app. It takes effect immediately and permanently removes your account, your profile, and every diagram in it from our database. There's no grace period and nothing is recoverable afterwards, so export anything you want to keep first.

To be precise about what that doesn't cover: deleting your account clears our own database, but not the copies held by the processors listed above. Your analytics records with PostHog, and your waitlist contact with Resend if you ever subscribed, are removed on request — email hello@designbeaver.app and we'll clear those too. The same address reaches us for any other right above.

Children

Design Beaver is not directed to children under 16, and we do not knowingly collect their data.

Changes

We may update this policy as the product evolves. Material changes will be reflected by the "last updated" date above.

Contact

Questions about this policy or your data? Email hello@designbeaver.app.