Privacy Policy

Last updated 14 October 2026

This policy explains what UMLEdit, run by Jehad Abughazaleh, South Africa, knows about you and what is done with it. Questions: support@umledit.com.

In short

On the free plan your diagrams stay in your own browser, on your own device. We never receive them. With Pro they are also kept in your account, for you alone.
An account stores your e-mail address and your plan. We never see your password or your card details.
No advertising, no tracking cookies, no selling of data. Visits are counted without cookies, as daily totals only.
You can delete your account yourself, at any time.

1. What we store

What	Why	How long
E-mail address	To log you in and send codes and notices about your account	Until the account is deleted
Password	To log you in. It is turned into a scrambled key in your browser and stored only as a salted hash	Until the account is deleted
Plan, and the customer and order numbers from Paddle	To unlock Pro and handle payment questions	As long as the law requires payment records to be kept
Team seats: the e-mail addresses a team gives seats to, and who added them	To give those people Pro while the team is active	Until they are removed from the team or the team is deleted
Sales requests: name, e-mail, organisation, seats and message	To answer you	Up to 2 years
Refund requests and our answers	To answer you and keep a record	As long as the law requires
Confirmation and reset codes	To prove an e-mail address is yours. Stored as hashes	They stop working after 15 minutes
Log-in session	To keep you logged in	30 days, or until you log out
Internet address (IP), in counters of attempts	To stop password guessing and abuse	Up to one day
List of e-mails sent to you: address, kind, delivered or not	To find out why an e-mail did not arrive. Codes and texts are not kept	90 days
The country of an account (only the country, worked out from the internet address when you log in or open UMLEdit; never the town or the address itself)	To know where our users are	Until the account is deleted
Pro codes you entered: which account used one, and when	So each code works once	As long as the code's records are kept
Pro only: your projects (compressed), with their names and sizes	So they open on every computer you log in from	Until you delete them for good in UMLEdit, or delete your account

Visit statistics, without cookies

To know how many people use UMLEdit, the server counts per day: pages opened, visitors, the website that sent them (its name only), their country, how many people changed a diagram, exported a file, looked at the prices, opened the checkout or Contact sales. To count a person once a day it makes a one-way code from the internet address and the browser's name, with a key that changes every day; the codes and keys are deleted after a day, so nobody can work out who a visitor was or link one day to the next. Only the daily totals are kept.

While UMLEdit is open and visible, the page tells the server every two minutes that it is still open, with a random number made for that browser tab (and your account, if you are logged in), so the owner can see how many people are online. These notes are deleted after two days. Your browser also remembers the day of your last visit, so a returning visitor can be counted; with Do Not Track or Global Privacy Control switched on, it does not. Bots and the owner's own visits are not counted.

The e-mails about codes may name the town and country the request seemed to come from. That is worked out from the internet address at that moment and is not stored.

2. What stays on your computer

On the free plan, your projects, diagrams, versions and settings are stored in your browser only (IndexedDB and local storage), and nothing is uploaded. Clearing the browser's site data deletes them. With Pro, your projects are also kept in your account (see the table above), compressed, in a database on Cloudflare; only you can open them. UMLEdit also remembers in your browser which account was last logged in and its plan, so Pro keeps working when you are offline.

3. Cookies

One cookie is used, named ue_session. It keeps you logged in and is needed for accounts to work. There are no advertising or analytics cookies.

4. Payments

Our order process is conducted by our online reseller Paddle.com. Paddle.com is the Merchant of Record for all our orders. Paddle provides all customer service inquiries and handles returns. Paddle receives your payment details directly; we never see your card number. Paddle tells us that a payment was made, for which plan and for which account. Paddle's use of your data is described in its privacy policy.

5. Who handles data for us

Cloudflare hosts the website and the account database.
Resend delivers our e-mails.
Paddle handles payments as the merchant of record.

Fonts load from Google Fonts, and the SQL playground loads its engine from jsDelivr the first time it opens. Those services see your internet address, as any website you visit does.

6. Your rights

Deleting your account: open Account in UMLEdit and choose Delete account. After you enter your password, the account, its sessions, its codes and its team seats are deleted at once. Records of payments are kept only as long as the law requires, and no longer lead to an account.

You can also ask what we store about you, or have it corrected: write to support@umledit.com from the e-mail address of the account and we answer within 30 days. You also have the right to complain to the data protection authority of your country.

7. Children

Accounts are for people aged 13 and over. If you believe a younger child has made an account, tell us and we will delete it.

8. Changes

If this policy changes, the date at the top changes, and important changes are announced to account holders by e-mail.