TryMermaid

Privacy policy

Last updated: September 18, 2026

This policy explains what information Try Mermaid LLC ("we", "us") collects when you use TryMermaid at trymermaid.app, how we use it, and the choices you have. If you have a question, email [email protected].

The short version

  • You can use the editor without an account. Unsaved diagrams stay in your browser.
  • If you create an account, we store your email address, an optional name, a securely hashed password and the diagrams you choose to save.
  • If you connect an AI assistant such as Claude, we receive only the requests it makes to TryMermaid, such as the diagram it wants to save, not your conversation with it.
  • Payments are handled by Lemon Squeezy. We never see your full card number.
  • We use Google Analytics to understand how the site is used.
  • We don't sell your personal information or use it for advertising.
  • You can ask us to access, correct or delete your data at any time.

Information we collect

Diagrams you don't save

While you work without saving, your diagram, editor settings and recent history are kept in your browser's local storage and in the page URL. The part of the URL that holds the diagram (after the # sign) is not sent to our servers. Anyone you give a share link to can open the diagram it contains.

Account information

When you create an account we collect your email address, the name you enter (optional) and your password. We store the password only as a one-way bcrypt hash, never in plain text. After you log in, a sign-in token is kept in your browser's local storage.

Diagrams you save

When you save a diagram to your account we store its title, its content (code, settings and canvas layout), whether you made it public, and when it was created and last updated. If you make a diagram public, anyone with its link can view it.

Signing in with Google

If you sign in with Google, Google shares your name, email address and a Google account identifier with us, and we use them to create or sign in to your account. We only request basic profile access. We do not receive your Google password and cannot access your Gmail, Drive or other Google data.

Payments

Pro subscriptions are sold by Lemon Squeezy, which acts as the merchant of record and processes your payment under its own privacy policy. We never receive your full card number. Lemon Squeezy sends us your subscription status, renewal and end dates, a customer identifier, a link to your billing portal, and your card brand and last four digits, which we store so we can show them on your dashboard.

API keys and AI assistant connections

Pro accounts can connect AI assistants such as Claude, Cursor or VS Code to TryMermaid through our MCP (Model Context Protocol) server, using either an API key or a sign-in approval (OAuth). For API keys we store a one-way SHA-256 hash of the key, never the key itself, plus the name you give it, its first and last few characters so you can recognise it, and when it was created, last used, expires or was revoked. For connected apps we store the app's registered name and redirect addresses, and hashed access and refresh tokens.

When an assistant uses the connection, we receive the requests it makes: for example the code and title of a diagram to check or save, or the ID of a diagram to read. We process these only to carry out the request. We do not receive or store your conversation with the assistant beyond what it sends in those requests. What the assistant does with our responses is governed by its provider's own privacy policy.

Analytics

We use Google Analytics to see how people find and use TryMermaid, such as which pages are visited and how long visits last. Google Analytics sets cookies and receives information such as your IP address, browser and device type, pages visited and the site that referred you, under Google's own privacy policy. We don't send it your email address, diagram content or API keys, and we don't load it on embedded diagrams shown on other websites. You can opt out with Google's Google Analytics opt-out browser add-on.

Diagram image links

Some features create a link to an image of your diagram, for example when an AI assistant asks for a preview. These links are served by mermaid.ink, a third-party rendering service, and the diagram's content is encoded in the link. When the link is opened, mermaid.ink receives that content in order to draw the image.

Images you upload

When you upload an image to use in a diagram, we store the image file, its type and size, and which account uploaded it. Uploaded images are available at their link to anyone who has it, so that diagrams using them can be shared, embedded and exported.

Technical information

Like most websites, our servers and our hosting and content delivery providers (including Cloudflare) process technical data such as your IP address, browser type and the pages you request. This is used to deliver the site, prevent abuse and keep the service secure.

How we use information

  • To provide the service: saving, loading, sharing and embedding your diagrams.
  • To carry out requests made by AI assistants you have connected to your account.
  • To process your subscription and show its status.
  • To create and secure your account and keep you signed in.
  • To respond to support requests you send us.
  • To detect, prevent and fix abuse, security problems and bugs.
  • To tell you about important changes to the service or these terms.

Cookies and local storage

TryMermaid uses your browser's local storage for your diagrams, editor preferences, history and sign-in token. Google Analytics sets analytics cookies (such as _ga, which lasts up to two years) to count visits. We don't use advertising cookies. Our content delivery provider may set strictly necessary cookies for security, such as bot protection. You can block or delete cookies in your browser settings.

When we share information

We don't sell or rent your personal information. We share it only:

  • With service providers that run parts of TryMermaid for us, under obligations to protect it: Cloudflare (content delivery and security), Google Analytics (usage statistics), Lemon Squeezy (payments), Google (sign-in, if you use it) and mermaid.ink (diagram image links, when opened).
  • With AI assistants you connect, which receive the results of the requests they make, such as your saved diagrams' titles and code.
  • When you choose to, for example by sharing a link or making a diagram public.
  • When required by law, or to protect the rights, safety and security of our users, the public or Try Mermaid LLC.
  • As part of a merger, acquisition or sale of assets, subject to this policy.

How long we keep information

We keep your account information and saved diagrams for as long as your account exists. When you delete a saved diagram it is removed from our database. If you ask us to delete your account, we delete your account and saved diagrams, except where we must keep information to meet legal obligations. Server logs record request details such as time, path, response status and IP address, not diagram content, and are kept only as long as needed for security and troubleshooting.

API keys stay active until you revoke them or they expire. OAuth access tokens expire after one hour and refresh tokens after 30 days. Hashed records of revoked and expired keys and tokens are kept for security auditing until your account is deleted. Subscription records are kept while your account exists; Lemon Squeezy keeps its own payment records as its policy and the law require.

Your choices and rights

You can delete saved diagrams, revoke API keys and disconnect AI assistants from your dashboard at any time, and you can clear unsaved diagrams by clearing your browser's site data. To access, correct, export or delete your personal information, or to delete your account, email [email protected] from the address on your account. Depending on where you live, you may have additional rights under laws such as the GDPR or CCPA, and we will honor them.

Security

We use HTTPS for all traffic, hash passwords with bcrypt, store API keys and tokens only as hashes, and limit access to our systems. No method of transmission or storage is completely secure, so we can't guarantee absolute security, but we work to protect your information.

Children

TryMermaid is not directed to children under 13, and we don't knowingly collect personal information from them. If you believe a child has given us personal information, contact us and we will delete it.

International users

We and our service providers may process information in the United States and other countries whose data protection laws may differ from those where you live.

Changes to this policy

We may update this policy from time to time. We will change the date at the top of this page and, for significant changes, let account holders know by email or in the app.

Contact

Try Mermaid LLC · [email protected]. See also our terms of service.