What we hold, and why.

Last updated 6 September 2026

You are trusting us with diagrams of how your systems are built. That is not ordinary marketing data, and this page is written to be specific about it rather than comprehensive-sounding.

What we collect

• Your account. Email address, and a name if you give one. Passwords are stored only as an argon2id hash — we cannot read yours.
• What you make. The Mermaid source you paste, the tour, and the saved versions of both. This is the substance of the service.
• Your workspace. Its name, who is in it, and their roles.
• Billing. If you subscribe, Stripe holds the card. We store your Stripe customer and subscription identifiers and whether the subscription is active. We never see or store card numbers.

We do not sell anything to anyone, and we do not train models on your diagrams.

Where your diagrams go

Playing a Stage happens in your browser. The 3D scene, the camera and the narration are rendered on your machine; no diagram is sent anywhere to be played. If you never save, nothing leaves your computer at all.

When you do save, your Stage is stored against your workspace. Postgres row level security separates workspaces at the database, not in application code — a query made for one workspace cannot return another’s rows even if we wrote it wrongly.

Who else is involved

• Stripe — payments, if you subscribe. They receive your email and payment details directly.
• Resend — sends invitations, password resets and billing notices. They receive the recipient address and the message.
• Google — only if you choose Sign in with Google, and only to confirm who you are.

We host on our own infrastructure. There is no advertising network, no analytics product tracking you across other sites, and no third party with access to your Stages.

Sharing is something you do deliberately

A Stage is private to your workspace unless you publish it. If and when you do, a published Stage is visible to anyone holding the link — treat that as making it public, because a link can be forwarded.

How long we keep it

Saved versions are immutable and kept while your workspace exists, so a presentation somebody reviewed cannot change under them. Delete a Stage and its versions go with it. Ask us to close your account and we remove your workspace and everything in it.

What you can ask for

• A copy of what we hold about you.
• Correction of anything wrong.
• Deletion of your account and its contents.

Email support@mermaidstage.com. We will not make you go through a support maze for any of it.

Children

MermaidStage is for professional use and is not directed at anyone under 16.

Changes

If this changes materially we will say so in the product rather than quietly editing the date at the top.

Questions about any of this: support@mermaidstage.com.