Legal
Privacy
Last updated: October 2026
Archboard is a hosted workspace for smart, structured diagrams. We store the account details we receive when you sign in with Google or GitHub, your organization memberships, workspaces, diagram documents, and encrypted session cookies used to keep you signed in.
We use that data to run the product: authentication, workspaces, autosave, and billing (Polar, when you subscribe). We do not sell your diagrams. Data lives in our hosted cloud infrastructure.
What we collect
OAuth profile fields (name, email, avatar) from Google or GitHub; organization, workspace, and diagram JSON; session cookies; billing customer and subscription state if you upgrade. We do not offer email/password accounts. If you connect an AI app through MCP, we keep the name the app registered, the name you give it, the access you approved (including which organizations and workspaces it can use and its permission there: read, edit, or delete), and token records. Token records are deleted when they expire or when you remove the app; the app’s name stays with the changes it made, in version history and audit records. The app can read the diagrams you can access in the organizations and workspaces you allow (all of them unless you limit it), including who is working on them and what you have selected; if you approved write access, it can change them where you gave it edit or delete permission, and also move them to the trash where you gave it delete permission. What it does with that data is governed by its provider’s terms. With add_image, Archboard’s servers download the image from the address the app gives, on your behalf (public https only), and keep only the processed image. The address is not stored; only the host name of an address Archboard refuses (for example a private or internal one) can appear in its server logs. Image metadata (location, camera, comments) is always removed. With upload_image, the app gets a one-time upload link: it places one image, expires after 5 minutes, and only a hash of it is stored. The upload’s audit record keeps the IP address of the device that sent the file, which organization owners and admins can see; it is anonymized when you delete your account. A log of diagram edits, including who made each change, is kept for 7 days for live sync and undo. The state of in-product tips (which ones you’ve seen, dismissed or used) is stored in your account.
Processors
Google and GitHub for sign-in. Polar as merchant of record for paid plans. Cloud hosting and database providers that run the application. Share and embed links expose the diagram you choose to publish and the names and live cursors of people with edit access who have it open in the editor and of AI agents working on it, so keep those links private.
Cookies
An encrypted session cookie (archboard-session) keeps you signed in. A locale cookie (archboard_locale) remembers language. Color mode may be stored in the browser. These are needed to run the product; there is no advertising pixel on marketing pages. When you approve an AI app, the sign-in and consent steps use cookies from our authorization server (archboard_oauth_session, archboard_oauth_interaction, archboard_oauth_resume). The editor keeps your personal canvas settings (grid, snapping, rulers, view position) in your browser’s local storage and a per-tab connection ID in session storage. The tip budget and device-specific tips are kept in your browser’s local storage.
Contact
Email [email protected]. If you need a DPA or security review, that is an Enterprise conversation.
Questions? Email [email protected].