Legal

Privacy Policy

Last updated · October 4, 2026

What Tierslate holds about you, why, who else sees it, how long it lasts, and what you can make us do about it. 8 numbered sections, written to be read rather than survived.

Scope of this policy

Tierslate is an architecture-diagram editor and walkthrough player at tierslate.com. It is a professional tool, not intended for anyone under 16 or under whatever age your country sets for consent to online services, and we do not knowingly collect data from children. If you think a child has given us data, write to support@tierslate.com and we will remove it. This policy does not cover other people’s sites that we link to.

We have not appointed a data protection officer. For an operation of this size that is permitted rather than an omission, and your requests go to support@tierslate.com instead.

What we collect

Everything we hold about you, by category. Nothing here is collected for a reason that is not in this list.

Your sign-in: There are two ways in, neither with a password: any Google account, or a one-time link emailed to you (which opens new accounts for work email addresses only). With the emailed link, we keep the address you typed and a scrambled copy of the link until it expires. With Google (for example a Google Workspace account), Google tells us your name, email address, profile picture, whether it considers the address verified, and a stable identifier it calls the sub, which is what your boards are attached to. Google’s own tokens stay on our server and never reach your browser.
The boards you make: Nodes, edges, text, notes, walkthrough steps and the names you give them, so we can give them back to you and to the people you share them with.
Teams, memberships and invitations: The first time you sign in we make you a personal team of one, automatically and without asking, named after your account - it is the thing a plan and a purchase attach to, and there is no version of having an account that does not have one. Beyond that: any team you make or join, who is in it and with what role, and the invitations sent. An invitation records the address it went to and who sent it.
Images you upload: The bytes, and the SHA-256 hash of those bytes, which is the name we file them under. We compute that hash ourselves rather than trusting what your browser sends.
Collaboration edit history: When several people edit one board at once, each change is logged so the edits can be merged and replayed in order. The log records what changed and who changed it.
Your name and picture, while you are on a board with somebody: Live collaboration shows the other people on a board who is there: your display name, your Google profile picture, your cursor and what you have selected, updated as you move. It goes to everyone else currently on that board - and because a share link needs no account, that can be anybody holding the link, not only your team. Your email address and your account id are not sent to them. Someone who opened the board from a link and is not signed in appears to you with no name and no picture, for the same reason.
Sign-in sessions: Your account id, when the session started, was last used and expires, plus the user-agent string and the IP address it was created from. The last two are there so you can look at your own sessions and end one you do not recognise.
Support messages: What you wrote: the subject, the message, the name and email address you gave, the page you were on and, if you were signed in, your account id. This is the one thing here with no deletion date, and the retention card below says so.
Newsletter: Only if you type your address into the subscribe form and click the confirmation link. We keep the address, that you confirmed, when, and the IP addresses you subscribed and confirmed from, because consent evidence that cannot say when and from where is not much evidence. Signing in is not consent to marketing mail; the two lists are separate.
The early-access waitlist: Before accounts opened, the sign-in buttons took an email address instead. If you left one, we keep the address, the day you asked and the IP address the request came from, and nothing else - no name, no account, and nothing about what you drew. It sits on the same list as the newsletter and is not the same thing as being subscribed to it: you are marked as waiting, not as a subscriber, and only clicking the link in the one message we send would change that. That message has not been sent, which is also why there is no unsubscribe link for it yet - the basis card above says what to do instead.
Payments: Our own log of plan changes and payment events on your account, the plan you are on, which templates your account or team owns, and - if you used a discount code on an in-app purchase - which code, on which payment, for how much. Card numbers are typed on Stripe’s page and never reach this service.
How much you export: A paid plan comes with a monthly export allowance, so we keep one row per account per month: how many exports you took that month, and how many of each format - PNG, SVG, PDF, DOCX, Markdown, HTML. It is attached to your account and it is the one thing here that counts what you did rather than holding what you made. It records no board, no file name and nothing about what was in the export. The retention card gives the period.
Interviews, if somebody runs one: The product can run a system-design interview on a board. When it does we hold the brief, and the candidate’s name and email address; separately, in a place the candidate can never read, we hold the interviewer’s notes, rubric and scores. The candidate sees the brief and the board and nothing else. If you were interviewed through this product, that record was written by the person who interviewed you rather than by us - write to us anyway and we will answer and put you in touch with them.
Walkthrough recordings - which we never receive: You can record a walkthrough of your board, with your screen, your system audio and - if you switch it on - your microphone, which you can turn on and off in the middle of a take. None of it ever leaves your computer. The recording is assembled in your browser and saved straight to your downloads; there is no upload, no copy on our servers and nothing for us to keep, and that is a property of the code rather than a promise about how we behave. If your browser cannot record MP4 by itself, the conversion also runs on your machine, using a converter served from this site, so no video is sent anywhere to be processed. The only thing stored is the two on/off switches, in your own browser, so the next recording opens with the same choices - the cookies card lists it.
How you use the app, if you agree to it: What you do, never what you make. Named actions - a board opened, a node added, an export taken, a limit reached - with counts and labels from a fixed list, the plan you are on, and a random device id that is not your account and is not joined to it. Alongside them a session replay: a recording of the interface as you use it, with the board canvas cut out of it and the text you typed masked before it leaves your browser. None of this happens, and nothing is loaded or stored on your device, until you say yes. The analytics card below lists what is never measured, and that list is enforced in the code rather than promised.
Server logs: Ordinary web server access logs: IP addresses, paths requested, user-agent strings, so we can find faults and see abuse. This is the one thing recorded about every visitor, including one who never signs in, and it is one of the retention rows with no period.
Which country your connection comes from: Read off the address your connection comes from, on our own server, against a table we hold there - the reading every server can make, and no more. It is used to quote a price in your currency and, if the answer is India, to switch analytics on without asking you - see “Analytics, and what it never sees”. Your address is sent to nobody for this and the answer is not kept on our side; if the table cannot place the address, the answer is “unknown” and nothing is guessed.

Why we may

Under the GDPR every piece of processing needs a reason the law recognises. Ours are these, and only these. Where the reason is legitimate interests, the interest itself is named: a policy that says “legitimate interests” and stops has told you nothing.

Product analytics and advertising measurement for visitors connecting from India: Legitimate interests If your connection comes from India, you are not asked. When a page opens, your browser asks our own server which country the connection is from; the server answers from a table it holds, so your address is sent to nobody, no cookie is set, and nothing from the lookup is kept beyond the line every request leaves in the access log. If the answer is India, the switch is set to on without a question: Amplitude and the Google Ads tag run exactly as they would after a yes, and the record in your browser says it was set because of where you are, not because you agreed. We rely on our own legitimate interest - knowing how the product is used and whether our advertising works - rather than on your consent, because none was asked for. You have the right to object, and the objection is the same switch everyone else has: Help › Privacy & analytics in the editor’s menu bar, or Settings → Preferences → Privacy, which shows the switch as on because of where you are. Turning it off is a refusal and is honoured like any other, at once, and you are not asked again. Everyone connecting from anywhere else is asked first.
Your account, and the boards and images in it: Performance of a contract You asked us for an account so you could make boards. Holding them is the service.
Your name, email address and picture from Google: Performance of a contract Sign-in is the only way in, and we need to know which account is yours.
The edit history behind live collaboration: Performance of a contract Two people editing one board at once is a feature you used; it cannot work without a record of the edits.
Your personal team, and any team you create or join: Performance of a contract Every account gets a team of one when it is made, without being asked, because a plan, a purchase and the ownership of a board all attach to a team rather than to a person. You cannot have an account without one.
The count of how many exports you took: Performance of a contract A plan comes with a monthly export allowance and the allowance is part of what was bought. Counting is the only way to deliver it, and a per-format breakdown is what lets us answer a question about a month that has passed.
Interviews run on a board, and the notes and scores in them: Performance of a contract An interviewer asked the product to run an interview, and the notes, rubric and scores are the thing they asked for. The candidate is not the person who agreed to that, which is why this row is the one to read twice: the record is the interviewer’s, we hold it for them, and a candidate who writes to us gets an answer and an introduction to them rather than a referral.
The record of which marketing messages we have sent you: Legitimate interests A campaign that is interrupted and resumed would otherwise mail the same person twice, and the only thing that prevents it is a record that outlives the send. The interest is not sending you something you did not ask for a second time.
Messages you send us through support: Legitimate interests You wrote to us and we want to answer, and to recognise a second message about the same problem.
Server access logs: Legitimate interests Keeping the service up and working out what broke when it breaks, and noticing abuse.
Rate-limit counters: Legitimate interests Stopping one visitor from taking the service down for everybody else.
The newsletter, and the record that you asked for it: Consent You opted in and confirmed it. You can withdraw from a link in every message.
Taking it back: Every message we send carries an unsubscribe link, and it works without signing in or writing to anybody.
The early-access waitlist, and the address you left on it: Consent Accounts are not open yet and you asked to be told when they are. We hold your address, the day you asked and the IP address the request came from, and nothing else. It is one message, about one thing, and it is finished when it is sent - it does not put you on the newsletter, and only clicking the link in it would.
Taking it back: This is the one with no button, and saying otherwise would be describing a control that does not exist. Nothing has been sent to you, so there is no message carrying an unsubscribe link and nothing for you to click: the way out is the one the form promises in the same breath as it takes the address - ask us and we delete the row. That is a real mechanism and it is a human one. When the one message does go out it carries a one-click unsubscribe like everything else we send, and from that moment this works exactly the way the newsletter above does.
Product analytics and session replay: Consent You were asked before anything was loaded, and off is what an unanswered question means for everything on this row. Saying no costs you nothing: the editor behaves identically either way, and you are not asked again.
Taking it back: There is a switch, and it is in the product rather than in your browser’s settings: Help › Privacy & analytics in the editor’s menu bar, which opens Settings → Preferences → Privacy. It is two clicks from the board and it is there whether or not you have an account. Turning it off is the withdrawal. The answer is one entry in this site’s storage in your own browser and it is checked again every single time something would be sent, so it takes effect at once rather than at the next reload. Withdrawing also takes the vendor’s own cookies and storage entries off your device and empties the database it kept recordings in, which is removed when you next leave the page - their software holds the connection open, so it cannot be deleted outright while you are still here. Clearing this site’s data removes the record itself, which puts you back to not having agreed, which is off.
Advertising measurement - telling Google Ads that one of our adverts led to a sign-up: Consent It is the same question and the same answer as product analytics: one yes covers both, the tag is not fetched until you give it, and an unanswered question is a no. It has its own entry because the purpose is different - this measures our advertising, not the product - and so is the company that receives it. Saying no costs you nothing; you see the same product either way.
Taking it back: The same switch as product analytics: Help › Privacy & analytics in the editor’s menu bar, or Settings → Preferences → Privacy. Turning it off stops Google’s tag at once, drops anything not yet sent, and removes Google’s cookies and storage entries from this device by their prefixes - _gcl_ and _gac_ - together with the mark in this site’s storage that says your sign-up has been counted. There is no setting that keeps analytics on and this off: they are one answer, and taking it back takes back both.
Records of payments: Legal obligation Tax and accounting law requires a seller to keep them.

Four things rest on your consent: the newsletter, product analytics, the advertising measurement that shares its switch, and the early-access waitlist. All of them are off until you ask for them, all of them say above how to take them back, and all of them are separate from each other and from having an account. Signing in is not agreement to any of them, and leaving your address for early access does not subscribe you to the newsletter - only clicking the link in the one message we send would, and until you do, nothing we send to the newsletter list goes to you. The service works the same whether you say yes or no, which is what makes saying no a real option rather than a polite one. One exception, stated where it belongs: a visitor connecting from India is not asked the analytics question, and the entry above for that case rests on our legitimate interests rather than on their consent - with the same switch as the way to object.

Who else sees it

These companies process data for us. Saying “we use Stripe” discloses nothing, so each one says what actually leaves this system and where they handle it. Nobody is on this list who receives nothing, and nobody is off it who receives anything. We do not sell your data. One advertising company is on it - Google, for the advertising measurement described under “Analytics, and what it never sees” - and it hears from this site only after you have agreed to the analytics question, or, for a connection from India, under the regional rule described there. Nobody else on this list is one.

Google Ireland Limited
Sign-in, and the web fonts that a PNG export needs in order to come out with the right lettering.
What they receive
When you choose to sign in, Google tells us your name, email address and profile picture; we send them nothing to get it. When you export a board as a PNG, your browser fetches the two fonts the picture is drawn with from Google’s font servers, so that request reaches Google carrying your IP address and nothing else - not the board, not its name, and not who you are. It happens only when you press Export and choose PNG, it is not part of loading any page here, and it is not covered by the analytics question: the rest of this site’s fonts are served from our own servers precisely so that reading it contacts nobody. If the fetch is blocked or you are offline the export still succeeds, in the system font.
Where they process it
EU, with transfers to the United States under Google’s own terms
Their own policy
https://policies.google.com/privacy
Google Ireland Limited (Google Ads)
Advertising measurement: telling our Google Ads account that a click on one of our adverts led to an account being created, so we can tell which adverts work. Only if you agree to the analytics question, and only from the moment you do.
What they receive
Nothing until you agree - the tag is not fetched, for the same reason Amplitude’s is not, so Google is not even handed your address by the request for it. After that, Google’s tag is loaded on every page you open here, and each load tells Google the address of the page you are on, the page that sent you to it, your IP address, the user-agent string your browser sends with every request, and whatever is in the cookies Google keeps on this site - including, if you arrived from one of our adverts, the click id Google attached to the link, which those cookies exist to hold. When an account is created - never when you sign in again - one further message goes to Google saying that a sign-up happened, so the account can be matched to the advert. It says nothing about who: no name, no email address, no account id, no board, and it is sent once. Say no, or leave the question unanswered, and none of this happens.
Where they process it
EU, with transfers to the United States under Google’s own terms
Their own policy
https://policies.google.com/privacy
Twilio SendGrid
Sending email: sign-in related mail, invitations, receipts, and the newsletter if you ask for it.
What they receive
The recipient address and the contents of the message being sent.
Where they process it
United States
Their own policy
https://www.twilio.com/legal/privacy
Stripe Payments Europe, Ltd.
Taking payment for a paid plan. Only if you buy one.
What they receive
Your email address and the payment details you type on Stripe’s own page. Card numbers never reach this service.
Where they process it
EU, with transfers to the United States
Their own policy
https://stripe.com/privacy
Amplitude, Inc.
Product analytics and session replay: which features get used, where people get stuck, and where they give up. Only if you agree to it, and only from the moment you do.
What they receive
Nothing at all until you agree - their script is not even fetched, because fetching it would hand them your address before you had said anything. After that: a random device id that is not your account and is not joined to it, the plan you are on, named actions such as "a node was added" carrying counts and labels from a closed list, and the user-agent string your browser sends with every request anyway, which their software offers no way to leave out. Never a board name, a node title, note text, an image or its file name, a board id, a share link, an email address, the tracking parameters on the link that brought you here, or free text of any kind. Session replay also sends a recording of the interface as you use it; we configure the recorder to cut the board canvas out of it and mask the text you typed before it leaves your browser.
Where they process it
EU. The browser is told to send to Amplitude’s EU data region and their servers there are where it is processed. Amplitude, Inc. is a United States company, so the group that runs those servers is subject to US law even though your data sits in Europe.
Their own policy
https://amplitude.com/privacy
Amazon Web Services EMEA SARL
Hosting. The machines this service runs on.
What they receive
Everything the service stores, because it is stored on their infrastructure.
Where they process it
EU
Their own policy
https://aws.amazon.com/privacy/
MongoDB (Atlas)
The database. Everything this service stores is stored in it.
What they receive
Everything the service stores: your account, your boards and the images on them, the edit history, sessions, support messages, subscriber addresses and the billing records. It is where the data lives rather than something we send a copy of.
Where they process it
EU - the cluster is configured in an EU region. MongoDB is a United States company, so the group operating those servers is subject to US law even though the data sits in Europe.
Their own policy
https://www.mongodb.com/legal/privacy-policy

The service runs in the European Union, but Google Ireland Limited, Google Ireland Limited (Google Ads), Twilio SendGrid and Stripe Payments Europe, Ltd. process data in the United States, which means it is handled outside the protection of EU law. That relies on the safeguards in our contract with them, normally the European Commission’s standard contractual clauses, together with the EU-US Data Privacy Framework where the company is certified under it. If you would rather no email about you left the EU, the only way to achieve that is not to have an account, because we cannot send you a sign-in or an invitation without it. If you would rather nothing about your visit reached Google’s advertising side, say no to the analytics question: that is all it takes, and it costs you nothing.

An image you upload is reachable by its address alone. We file images under a fingerprint of their own contents, and anybody who has that address can fetch the image without signing in - which is what lets a board you shared show its pictures to the people you shared it with. The address is long and nobody can guess it, but it works like a key rather than like a permission: deleting the board, removing somebody from it, or rotating its links does not take the image back from anyone who already has the address. Images stop being served ninety days after the last time one was fetched. If a picture matters, that is worth knowing before you put it on a board you share.

A share link is the other way your data reaches somebody. It carries a capability token in the part of the URL after the #, which browsers never send to a server, so the secret stays out of our logs. It also means anyone holding the link can open the board with whatever access the link grants, whether or not you meant to give it to them. Treat one like a key; rotating a board’s links revokes it.

How long we keep it

Every period below was taken from the thing in the code that actually does the deleting, not from what sounded reasonable. 12 of the 17 rows have no period at all, and they say so rather than being rounded up to a comfortable number.

Your account and the boards you make
No automatic deletion
Kept until you ask us to delete them. Your boards are yours and we do not sweep them.
Enforced by
no automatic deletion
Sign-in sessions
30 days
A session extends as you use it but can never live longer than thirty days from the moment it was created.
Enforced by
server/users.ts, a hard ceiling on renewals
The edit history behind live collaboration
90 days
Enforced by
server/db.ts, a TTL index on the ops log
Images you upload
90 days
Ninety days after an image was last fetched, not after it was uploaded, so an image still on a board you use is not swept.
Enforced by
server/images.ts, the sweeper
The log of payment and plan-change events
30 days
This is our own event log - the record that something happened, not the record of what you are paying for. Stripe keeps its own records for as long as tax law requires them to.
Enforced by
server/db.ts, a TTL index on billing events
What plan you are on, what you bought, and any discount code you used
No automatic deletion
Your subscription, the templates your account or team owns (bought, or owned with AI credits), your AI credit balance with the history of what was added and spent, and the record that a discount code was applied to a payment - which account, which code, and what it came to. These are kept: a purchase you can still use is a record we have to keep to honour it, and tax law requires the payment side of it anyway. Closing an account does not currently remove them, because nothing removes anything on that path yet.
Enforced by
nothing - subscriptions, template ownership, AI credit balances and their history, and promo redemptions have no TTL index and no sweeper
Server access logs
No automatic deletion
These record the address a request came from, what was asked for and when. We have not yet set a period for them and should. Say so if you want yours removed.
Enforced by
nothing - the web server keeps them until the disk is rotated
Proof that you asked for the newsletter
No automatic deletion
When you subscribe and when you confirm, we record the IP address you did it from. That record is what lets us show the consent was real. It is not particular to the subscribe form: every address in this table carries the one it was created from, including one left on the early-access waitlist, which has no confirming half to record. Unsubscribing removes you from the list; ask us and we will delete the evidence too.
Enforced by
kept for as long as the subscription, as evidence of consent
The address you left on the early-access waitlist
No automatic deletion
We hold your address, the day you asked and the IP address the request came from. Nothing deletes it on a schedule, and sending the one message you asked for does not remove it either. There is no unsubscribe link to use yet, because nothing has been sent to it: ask us and we delete the row.
Enforced by
nothing - it is a row on the subscriber list and nothing sweeps that list
Product analytics and session replay, if you agree to them
No automatic deletion
We have not decided how long these are kept, so we do not state a period we would not be keeping. Withdrawing your agreement stops anything further being sent, at once, and removes what their script left on your device. What is already on their servers is another matter: nothing we send identifies you, so we cannot pick your recordings and events out of it, and neither can anyone else looking at them - that is the point of sending no account id, and it is also its cost.
Enforced by
nothing here - Amplitude holds them under its own project settings, and nobody has set a period
The advertising measurement, if you agree to it
No automatic deletion
Google decides how long it keeps the record that a sign-up followed one of our adverts, and how long the cookies its tag set on this site live; we have set neither, so we state no period. Withdrawing your agreement stops the tag at once and removes Google’s cookies and storage entries from this device, by their prefix, because its script offers no way to ask it to. What Google already holds is another matter: what we sent says that a sign-up happened and not whose, so there is nothing to look yours up by.
Enforced by
nothing here - Google holds the record that a sign-up followed an advert under its own settings, and the cookies its tag sets carry lifetimes Google chooses; nobody here has set a period for either
How many exports you took, by month and by format
400 days
A paid plan comes with an export allowance, so there is a row per account per month holding how many exports you took that month and how many of each format - PNG, SVG, PDF, DOCX, Markdown, HTML. It holds no board, no file name and nothing about what you exported. Thirteen months, so that a billing question about last March still has an answer.
Enforced by
server/db.ts, a TTL index on the export allowance
Interviews run on a board, and the private notes and scores in them
No automatic deletion
If somebody runs a system-design interview here, we hold the brief, the candidate’s name and email address, and - in a separate collection the candidate can never read - the interviewer’s notes, rubric and scores. It is kept until it is deleted by hand. If you were interviewed through this product and want your copy or want it gone, ask us: the interviewer is the one who decided to write it down, and we will put you in touch with them as well as answering ourselves.
Enforced by
nothing - neither collection has a TTL index and nothing sweeps them
Invitations you send, and the ones you accept
No automatic deletion
An invitation records the address it was sent to, who sent it and when. If it is never answered it deletes itself after a fortnight. If it is accepted or withdrawn it stays, holding the address the invitation was accepted from and the account that accepted it, because that is the record of how somebody came to be on a team. The membership it creates lasts as long as the team does.
Enforced by
server/db.ts - a TTL index deletes an invitation nobody answered after fourteen days; an accepted or withdrawn one is kept
Which marketing messages we have sent to your address
No automatic deletion
One row per campaign per address, recording that we sent it, when, and whether it failed. It exists so that a send which is interrupted and restarted cannot mail you the same thing twice, which only works if the record outlives the send. Ask us and we will delete yours along with the subscription.
Enforced by
nothing - the send ledger has no TTL index and nothing deletes from it
Which in-app notices you have marked as read
No automatic deletion
Your account id against the id of a notice, and the moment you read it. It is what stops the same announcement reappearing. It says nothing about what you did with the notice.
Enforced by
nothing - the read marks have no TTL index; they are deleted when the notice they belong to is
Messages you send us through support
No automatic deletion
We should give these a retention period and have not yet. Until we do, ask us and we will delete yours.
Enforced by
nothing - there is no automatic deletion

The support one is the one to read twice. Nothing deletes a support message on a schedule, so a ticket outlives the account that sent it: delete your account and the messages you wrote to support are still here. We think that is wrong and have not fixed it. Until we do, email support@tierslate.com and we will delete yours by hand. Newsletter unsubscribe records are kept on purpose, so a later import cannot re-subscribe somebody who asked to be left alone.

There is no button that deletes an account, and this page is not going to imply there is. Erasure here is a person going into the database and removing rows, across every place your data sits: the account, sessions, boards, memberships, the invitations you sent and accepted, support messages, subscriber rows, marketing send records, interview notes and the export counts. Ask us and we do it. What we will not do is pretend it is automatic, because the parts that are automatic are the retention rows above and nothing else. Payment and purchase records are the exception that stays: tax law requires them, and a template you bought is one you keep.

Your rights

These are yours under the GDPR, and each one says how it works here today, because a right you cannot exercise is not a right. Most are handled by a person reading mail at support@tierslate.com rather than by a button in the app, and pretending otherwise would waste your time looking for the button. We answer within one month.

Access
Handled by a person
Ask what we hold about you and get a copy of it.
Rectification
Handled by a person
Correct anything about you that is wrong.
Erasure
Handled by a person
Ask us to delete your account and what is in it. There is no self-service deletion and no button anywhere in the product: somebody removes the rows by hand, across every place your data sits. Payment and purchase records stay, because tax law requires them.
Restriction
Handled by a person
Ask us to stop processing while a question is resolved.
Portability
You can do this yourself
Get your boards in a machine-readable form. You can already export a board from inside the editor.
Objection
Handled by a person
Object to processing we do on the basis of legitimate interests.
Withdrawing consent
You can do this yourself
Four things here rest on your agreement and all four can be taken back, though not by the same means - one of them has no button, and it is the waitlist. Unsubscribe from the newsletter at any time, from a link in every one we send. Withdraw the one you gave for product analytics - which is also the one for the advertising measurement, since they share a switch - and nothing further is sent or loaded, from that moment rather than from the next reload. For the early-access waitlist, nothing has been sent to you yet, so no unsubscribe link for it exists and the way out is to ask us - we delete the row. How, for each, in the section above. Withdrawing does not undo what was already lawfully done before you did it.
Complaining
Not through us
Complain to a data protection supervisory authority.

If you sign in with Google you can also change your name and picture in your Google account, which is where ours come from. Either way, you can see and end your active sessions from inside the app.

Complaining does not go through us. You may complain to a data protection supervisory authority where you live, where you work, or where the thing you are complaining about happened, without asking us first. The authority responsible for us is Berliner Beauftragte für Datenschutz und Informationsfreiheit.

Analytics, and what it never sees

We measure how the product is used, through Amplitude, on their EU servers. It is off until you agree to it: nothing is loaded, nothing is stored on your device and nothing reaches them while you have not answered, because an unanswered question is a no. We ask once - with one regional exception, below, in a bar at the foot of the window that does not block the page, and we do not ask again after you answer. Declining costs you nothing - there is no reduced version of the editor and no second prompt. One honest detail: while the question is still on screen, actions are held in the page’s memory - not stored, not sent - so that saying yes does not lose the last minute. Say no, or close the tab, and they are thrown away without ever leaving your browser.

If you are connecting from India, you are not asked, and it is on. When the page opens, your browser asks our own server which country the connection is from. The answer comes from a table on that server - your address is sent to nobody, no cookie is set, and nothing from the lookup is kept beyond the line every request leaves in the access log. If the answer is India, the switch is set to on without a question: Amplitude and the Google Ads tag described below run exactly as they would after a yes, and the record in your browser says it was set because of where you are rather than because you said so. The switch is where it is for everyone else - Help › Privacy & analytics in the editor’s menu bar, or Settings → Preferences → Privacy - and it shows that it was set for that reason. Turning it off is a refusal and is honoured like any other, at once, and you are not asked again. We rely on our own legitimate interest for this rather than on your agreement, because none was asked for; the entry under “Why we may” names it, and objecting is the switch. Everyone connecting from anywhere else is asked first, as above.

The same yes also loads a Google Ads tag, and that is a different thing from analytics. We advertise on Google, and the one thing we want to know from it is whether a click on one of our adverts led to an account. So once you have agreed - and not one page before - Google’s tag is loaded on every page you open here. Each load tells Google the address of the page you are on, the page that sent you to it, your IP address and your browser’s user-agent string, and reads and writes Google’s own cookies on this site, which hold the click id Google put on the link if you arrived from one of our adverts. When an account is created - not when you sign in again - one message goes to Google saying that a sign-up happened, so that it can be matched to the advert. It says nothing about who: no name, no email address, no account id, no board, and it is sent once. The cookies are Google’s and not ours; they are named with the prefixes _gcl_ and _gac_ - _gcl_au and _gcl_aw are the usual two - and withdrawing removes them by that prefix, together with the mark in this site’s storage that says your sign-up has been counted. Say no, or leave the question unanswered, and the tag is never fetched and none of them is ever set. There is no setting that keeps analytics on and this off: it is one answer, and taking it back takes back both.

What is measured is actions, never content. We record that somebody added an image; we never record which image, what it was called, or what board it was on. These are all of the actions, as the code lists them today:

app_opened, board_created, board_opened, board_shared, checkout_started, export_used, flow_recorded, image_added, lens_switched, limit_hit, node_added, notes_edited, plan_changed, recording_started, signed_in, support_ticket_sent, upgrade_viewed

Each one may carry counts and labels from a fixed list - which lens you switched to, which format you exported, which limit you hit - and the plan you are on. That is the only thing about you that is ever attached: no name, no email address, no user id, no account id. Amplitude gets a random device id of its own and nothing that joins it back to a row in our database, which also means we cannot ask it what any particular customer did.

Nothing on this list is ever sent, under any name:

board names, node titles, region labels, note text, prose blocks
email addresses, display names, team names, invite codes
support ticket subjects or message bodies
image bytes, image file names, image hashes
board ids, document ids, share links, edit tokens
free text of any kind, from any field, ever

The last line is the one that makes the rest enforceable rather than promised. A value is only allowed out if it is a number, a true/false, or a word from that property’s own fixed list; a string nobody put on a list cannot get through, so a future measurement cannot leak a board name by accident, it can only fail to send something and say so in a test. For the same reason we switched off the vendor’s automatic click tracking, which would attach the text of whatever you clicked - in this product, your own node titles - and we switched off the analytics script’s remote configuration, so what we measure cannot be changed from somebody else’s dashboard without a release, and we switched off its automatic capture category by category - including the one that reads the tracking parameters off the link that brought you here, the utm_ tags and the advertising click ids. What their script does send that we cannot switch off is the user-agent string your browser announces itself with on every request it makes, which says what browser, operating system and device type you are on. The options that would have added your language and your platform as measurements of their own are off.

Two limits on that, stated because they are true rather than because they help. The option that stops your IP address being stored as data and resolved into a city is on, but no option can stop their servers seeing the address your browser connects from - that is how a connection works, and the only real protection is the one above: nothing connects until you agree. And the session-replay part of their software fetches its own settings from them each time it starts, which we cannot switch off. Our rules about what to leave out are sent with it, but how often a session is recorded and how much of the rest of the interface is masked can be changed at their end, so what we can tell you is what we configure rather than a guarantee about their side of it.

Session replay is a recording of the interface, and it is masked. Once you have agreed, every session is recorded - the sampling rate we set is one in one, not a sample - so we can watch where people get stuck. We configure the recorder to cut the board canvas out of the recording entirely and to mask the places that carry text you typed, before anything leaves your browser, so what it is set up to capture is layout, navigation and interaction: where you moved, what you clicked, where you gave up. That is not a nicety. What is on your canvas is usually not yours to give away - it is your employer’s or your client’s system architecture, their service names, their schema - and you cannot consent on their behalf.

Changing your mind takes effect immediately, not at the next reload. Your answer is kept in this site’s storage in your own browser, under tierslate.analytics.consent, and it is read again every single time something would be sent. Withdrawing does more than stop the sending: the recorder is removed, anything waiting to be sent is dropped unsent, and what their script left on your device is deleted - its cookies, its storage entries and the database it kept recordings in. It is deleted by us, key by key, because their software offers no way to ask for it. Clearing this site’s data removes the answer itself, which puts you back to not having agreed - and not having agreed means off.

Cookies and automated decisions

German law, the TTDSG, treats anything stored on or read from your device the same way whether it is a cookie or not, so local storage counts and both are listed here. It is a short list because there is very little.

tierslate_sid: The session cookie, which is what keeps you signed in. HttpOnly, so page scripts cannot read it; SameSite=Lax; Secure in production; cleared when you sign out. Strictly necessary, so it does not ask for consent.
tierslate_oauth: Set only while you are signing in and cleared the moment you land back. It ties the Google sign-in you started to the browser that finishes it, which is what stops somebody handing you a link that signs you into their account. Short-lived and strictly necessary.
tierslate_landed: Set when you sign in and removed on the first page that sees it, at most five minutes later. It holds no identifier - only the fact that a sign-in just happened, so that page shows a loader instead of the home page while your board loads. Strictly necessary.
tierslate/theme: Local storage. Whether you chose light or dark. It stays on your device, is never sent to us or to anyone else, and clearing your browser data removes it.
tierslate/doc: Local storage. The autosave of the board you are editing, so a crashed tab does not cost you your work. It stays on your device, is never sent to us or to anyone else, and clearing your browser data removes it.
tierslate/team: Local storage. Which team you were last working in. It stays on your device, is never sent to us or to anyone else, and clearing your browser data removes it.
tierslate/seen: Local storage. That you have been here before, so the first-visit pitch is not shown twice. It stays on your device, is never sent to us or to anyone else, and clearing your browser data removes it.
tierslate/player-mode: Local storage. Whether the walkthrough player plays every step on its own or waits for you after each one. It stays on your device, is never sent to us or to anyone else, and clearing your browser data removes it.
tierslate/tour: Local storage. That this browser has already been shown this version of the guided tour, so it does not start itself again every time you open the editor. It is the version number and nothing else - not what you did in the tour, and not how far you got. You can always ask for it again by adding ?tour=1 to the address. It stays on your device, is never sent to us or to anyone else, and clearing your browser data removes it.
tierslate/tour-progress: Local storage. Where you got to in a guided tour you have not finished - which tour, which step, and which steps you have already done - so that after a reload it can offer to carry on from there instead of starting again. It holds no part of your board. It is deleted as soon as you finish or close the tour, and one older than seven days is ignored and deleted the next time you open the editor. It stays on your device, is never sent to us or to anyone else, and clearing your browser data removes it.
tierslate/previewWidth: Local storage. How wide you dragged the walkthrough preview dock, so it opens that width next time. It stays on your device, is never sent to us or to anyone else, and clearing your browser data removes it.
tierslate/capacity-calc: Local storage. The numbers you typed into the capacity calculator \u2014 daily users, writes per user, bytes per write and the rest \u2014 so the panel opens with your sizing rather than an empty form. Only this browser ever reads it. It stays on your device, is never sent to us or to anyone else, and clearing your browser data removes it.
tierslate/mockup-groups: Local storage. Which groups of the UI mockup component palette you opened or folded, and whether you filtered it to web, iOS or Android components, so it looks the same next time. Nothing from your boards. Only this browser ever reads it. It stays on your device, is never sent to us or to anyone else, and clearing your browser data removes it.
tierslate/sql-preview-width: Local storage. How wide you dragged the SQL preview panel. Only this browser ever reads it. It stays on your device, is never sent to us or to anyone else, and clearing your browser data removes it.
tierslate/comments-view: Local storage. Whether you chose to show comment pins on boards, and whether resolved comments are shown too, so the view stays the way you left it. It holds no comments and nothing from your boards. Only this browser ever reads it. It stays on your device, is never sent to us or to anyone else, and clearing your browser data removes it.
tierslate/sql-preview: Local storage. Whether you left the SQL preview panel open, which SQL dialect it shows and whether it previews your selection or every table, so it looks the same next time. Nothing from your boards. Only this browser ever reads it. It stays on your device, is never sent to us or to anyone else, and clearing your browser data removes it.
tierslate/cart: Local storage. What you have put in your basket but not yet bought: which templates, when you last changed it, and - once you are signed in - which account it belongs to, so that a basket you build on one visit is still there on the next. It holds no prices, which are worked out fresh every time it is shown, and no payment details of any kind. It stops being used after fourteen days and is deleted the next time you open the page after that, and emptying the basket deletes it at once. It stays on your device, is never sent to us or to anyone else, and clearing your browser data removes it.
tierslate/billing-before-checkout: Session storage, this tab only. What your plan was just before you went to Stripe, so the app can tell when the change has landed. It is dropped half an hour after it is written, and when the tab closes. It stays on your device, is never sent to us or to anyone else, and clearing your browser data removes it. Closing the tab removes it too.
tierslate/template-intent-pending: Session storage, this tab only. That a template purchase was started in this tab, so that if it is interrupted we can ask the payment provider what happened rather than charging you twice. It holds a reference to that one payment, which team it was for and which templates - never card details, which this site never receives. It is dropped half an hour after it is written, when the purchase finishes, and when the tab closes. It stays on your device, is never sent to us or to anyone else, and clearing your browser data removes it. Closing the tab removes it too.
tierslate.returnHash: Session storage, this tab only. The part of the address after the # - which board you were looking at - held for as long as it takes Google to send you back, so you land where you left. It is deleted the moment it is used, and it is kept out of the address we send to our own server on purpose, because for a shared board that fragment is the key to it. It stays on your device, is never sent to us or to anyone else, and clearing your browser data removes it. Closing the tab removes it too.
tierslate.inviteSignInTried: Session storage, this tab only. That this tab has already sent you to sign in to accept an invitation, so that if you cancel we do not send you there again. It holds the value 1 and nothing else - not the invitation and not your address - and it is removed when the invitation is accepted, or when the tab closes. It stays on your device, is never sent to us or to anyone else, and clearing your browser data removes it. Closing the tab removes it too.
tierslate.folderInvite: Session storage, this tab only. An invitation to a shared folder you opened from its link. The invitation's code is moved here and taken out of the address bar, so it is not left in your history, a bookmark or a copied address, and so a reload - or a trip to Google to sign in - comes back to the same invitation. It is deleted when the invitation is accepted, is replaced by the next folder invitation you open in that tab, and goes when the tab closes. It stays on your device, is never sent to us or to anyone else, and clearing your browser data removes it. Closing the tab removes it too.
tierslate.interviewInvite: Session storage, this tab only. An interview invitation you opened from its email - the invitation's code and whether you clicked Accept or Decline. The code is moved here and taken out of the address bar, so it is not left in your history, a bookmark or a copied address, and so a reload - or a trip to Google to sign in - comes back to the same invitation. Nothing is answered for you: you still press the button. It is replaced by the next interview invitation you open in that tab, and goes when the tab closes. It stays on your device, is never sent to us or to anyone else, and clearing your browser data removes it. Closing the tab removes it too.
tierslate.landTeam: Session storage, this tab only. Which team to open when an invitation accepted through an emailed sign-in link brings you to My boards. It holds the team's id and nothing else, and it is deleted the moment it is used. It stays on your device, is never sent to us or to anyone else, and clearing your browser data removes it. Closing the tab removes it too.
tierslate.landTeamFolder: Session storage, this tab only. Which of that team's folders to open, when the invitation named one. It holds the folder's id and nothing else, and it is deleted the moment it is used. It stays on your device, is never sent to us or to anyone else, and clearing your browser data removes it. Closing the tab removes it too.
tierslate/version-auto-reload: Session storage, this tab only. That this tab already reloaded itself to pick up a new version of Tierslate, and when - so that if the reload does not fix things it does not keep reloading. It holds a version label and a time, nothing about you, and goes when the tab closes. It stays on your device, is never sent to us or to anyone else, and clearing your browser data removes it. Closing the tab removes it too.
tierslate/version-embed-reload: Session storage, this tab only. For a board embedded in another site: which new version of Tierslate the embed has already reloaded for, so it reloads at most once per version. It holds a version label and nothing else, and goes when the tab closes. It stays on your device, is never sent to us or to anyone else, and clearing your browser data removes it. Closing the tab removes it too.
ts-embed-busy-retried:<board>: Session storage, this tab only. For a board embedded in another site that was too busy to show: that the embed has already retried once, so it does not keep retrying. It holds the board's id and the value 1 - never the link's key - and goes when the tab closes. It stays on your device, is never sent to us or to anyone else, and clearing your browser data removes it. Closing the tab removes it too.
tierslate.clipboard.v1: Local storage. The last shapes, regions and lines you copied or cut on a board, so you can paste them into another board or another tab. It holds only what you copied (and, for a picture, up to 2 MB of it) and is replaced by your next copy. Clearing your browser's site data removes it. It stays on your device, is never sent to us or to anyone else, and clearing your browser data removes it.
tierslate.boardsTab: Session storage, this tab only. Which tab of My boards - My boards or Shared with me - you last had open, so a reload brings you back to it. It holds the word mine or shared and nothing else, and goes when the tab closes. It stays on your device, is never sent to us or to anyone else, and clearing your browser data removes it. Closing the tab removes it too.
tierslate.sharedSeenAt: Local storage. When you last looked at the Shared with me tab of My boards, as a time and nothing else, so the "new" marker there counts only boards shared with you since. Clearing your browser's site data removes it. It stays on your device, is never sent to us or to anyone else, and clearing your browser data removes it.
tierslate.openSharedFolder: Session storage, this tab only. Which shared folder to open when an accepted invitation brings you to My boards. It holds the folder's id and nothing else, and it is deleted the moment it is used. It stays on your device, is never sent to us or to anyone else, and clearing your browser data removes it. Closing the tab removes it too.
tierslate.setPasswordPrompt: Session storage, this tab only. That you have just signed in with an emailed link - by accepting an invitation, with a sign-in link, or with a password-reset link - so the app should offer once to let you set a password. It holds one word saying which (1, magic or reset) and nothing else - not your address and not the password - and it is deleted the moment the app reads it, or when the tab closes. It stays on your device, is never sent to us or to anyone else, and clearing your browser data removes it. Closing the tab removes it too.
tierslate.signInDoor: Local storage. That you have signed in with, or set, a password in this browser, so the sign-in form opens on email and password instead of sending you an email. It holds the word password and nothing else - not your address and not the password. Clearing your browser's site data removes it. It stays on your device, is never sent to us or to anyone else, and clearing your browser data removes it.
tierslate.teamOnboarding: Session storage, this tab only. That you have just created an account from an emailed sign-in link at a work address, so the app should offer to set up a team for your company when it opens. It holds the value 1 and nothing else - not your address or your company - and it is deleted the moment the app reads it, or when the tab closes. It stays on your device, is never sent to us or to anyone else, and clearing your browser data removes it. Closing the tab removes it too.
tierslate.teamNudgeDismissed: Local storage. That you closed the card on My boards suggesting you ask to join your company’s team, so it is not shown again on this device. It holds the account ids of the people who closed it here - nothing about the team or your address. It stays on your device, is never sent to us or to anyone else, and clearing your browser data removes it.
tierslate.recentColors: Local storage. The last few custom colours you picked in the colour picker (at most eight, as colour codes like #3b8df0), so they are one click away next time. Nothing about the board or the shape they were used on is kept. It stays on your device, is never sent to us or to anyone else, and clearing your browser data removes it.
tierslate/recording-audio: Local storage. Whether you chose to include your microphone and your system audio the last time you recorded a walkthrough. The choice is stored; no audio is. It stays on your device, is never sent to us or to anyone else, and clearing your browser data removes it.
tierslate-images: A database in your browser. A copy of the images on the boards you open, filed by the same fingerprint we file them under, so a board you come back to draws immediately instead of downloading every picture again. It is the largest thing we put on your device and it is the only one that holds anything you made. It came from us in the first place, so it tells us nothing we did not already have, and clearing this site’s data empties it. It is read only by this site, on this device.
tierslate.analytics.consent: Local storage. Your answer to the analytics question - yes or no - with the date you gave it. It is here whichever way you answered, because it is what stops you being asked again, and it is read before anything would be sent. If you were not asked because your connection came from India, it holds that instead: that the switch was set on because of where you are, and the two-letter code of the country it was set for, so that the day the rule stops covering that country you are asked like everyone else. Turning the switch off replaces it with a no. Removing it does not turn anything on: it puts you back to not having agreed, which is off - or, from India, back to the rule. It stays on your device, is never sent to us or to anyone else, and clearing your browser data removes it.
tierslate.ads.signup.reported: Local storage. A mark that says the advertising measurement for this account has already been counted, so signing in again does not count you twice. It is written ONLY if you agreed to analytics and only on the one visit where the account was created. If you say no, or withdraw, it is never written and any existing one is deleted with everything else. It stays on your device, is never sent to us or to anyone else, and clearing your browser data removes it.

That is the complete list of what we put on your device, and it is checked against the code rather than written from memory. Nothing in it is an advertising cookie or a cross-site tracking cookie. The advertising cookies that can exist on this site are Google’s, they are set only after you agree, and they are named two paragraphs down.

Agreeing to analytics adds one more set, and they are not ours. Once you say yes, Amplitude’s script is loaded and it keeps its own record on your device: the random device id it uses instead of your name, whatever it has measured but not yet uploaded, and a small database holding a recording it has not uploaded yet. They are entries in this site’s storage rather than cookies, because we told their software to keep them there - left to itself it would have put the device id in a cookie. Every one of them is named with the prefix AMP_, which is how we find them again. Say no, or say nothing, and none of them is ever created, because the script is never fetched. Withdraw after having agreed and we delete them for you, one at a time, because their software offers no way to ask it to.

Agreeing also lets Google’s tag set cookies here, and those are advertising cookies. They are set under this site’s own name, so only Google’s tag on this site reads them and no other site can; their job is to carry the click id from the advert you arrived through to the moment an account is created, so the two can be matched. They are named with the prefixes _gcl_ and _gac_ - _gcl_au always, _gcl_aw when you came from an advert, and their siblings - and Google’s script may keep the same names in this site’s storage as well as in cookies. How long each lives is set by Google’s script and not by us, so we do not state it. Say no, or say nothing, and none of them is created, because the tag is never fetched. Withdraw and we delete every cookie and storage entry carrying those prefixes, as we do Amplitude’s, along with tierslate.ads.signup.reported from the table above.

Nothing here decides anything about you. We make no automated decisions with a legal or similarly significant effect and we do not profile you. Nothing scores you or ranks you. Two things are automatic and neither is a decision about you as a person: the rate limit that stops one account overwhelming the service, which applies to requests, and the export allowance, which compares a count against the plan you bought and can refuse the next export until the month turns over.

Contact

Questions about this policy, or a request about your data: support@tierslate.com.

We will update this page as the product changes and the date at the top changes with it. If a change matters to you, a new processor or a new purpose, we will tell you in the app or by email rather than quietly editing the page. See also our Terms and Conditions.

Back to Tierslate