Security & privacy
Written plainly, so an engineer or an IT department can judge it in five minutes. Last reviewed 5 August 2026.
The short version. Your cycle diagrams never leave your computer. They are stored by your own browser and are never uploaded, so there is no copy of your machine designs on any server — not ours, not anyone's. The only thing our server keeps is an e-mail address and a password hash, so that you can sign in.
What data exists, and where
| Data | Where it lives | Who can read it |
|---|---|---|
| Your projects, library, preferences | Your browser on your computer (IndexedDB / localStorage) | Only you. Never transmitted. |
| Your e-mail address | Cloudflare D1 database (EU/global edge) | The operator, to identify accounts and send account e-mail. |
| Your password | Same database, as a PBKDF2-SHA-256 hash with a random salt | Nobody — the plain password is never stored or logged. |
| Sign-in session | A signed token in your browser | Only your browser. No server-side session store. |
| Abuse counters | Same database, as one-way hashes | Nobody — the underlying address/e-mail cannot be read back. |
| Your licence file | Your browser | Checked offline. Licence checks never contact a server. |
There is no advertising, no tracking pixel, no third-party font, no session recording. Two exceptions, both from Cloudflare, which hosts the site: the sign-up form embeds Cloudflare Turnstile (from challenges.cloudflare.com) to tell humans from bots — it runs only on that form, and it is the cookie-free alternative to a CAPTCHA — and every page loads Cloudflare Web Analytics (from static.cloudflareinsights.com), which counts page views, referrers, countries and load times. It sets no cookie, stores nothing in your browser and carries no identifier, so nothing follows you from one visit to the next; it tells us how many people read a page, not who. Everything else loads from cyclogram.app only. You can verify all of this in your browser's network tab.
Cookies
This site sets no cookies — not for analytics, not for advertising, not even for sign-in (the session token lives in your browser's local storage, which is never sent to other sites). The page-view analytics is cookie-free as well: it keeps no state in your browser at all. Because there is nothing to consent to, there is no cookie banner: EU ePrivacy rules require consent for non-essential cookies and similar storage, and we simply have none. The storage the app does use — your projects, preferences and sign-in token in IndexedDB/localStorage — is strictly necessary for the service you asked for and stays on your device.
Measures in place
- HTTPS only, on a
.appdomain, which browsers refuse to load over plain HTTP. HSTS is set with a two-year lifetime. - A strict Content-Security-Policy: scripts may load only from this origin, inline scripts and
evalare forbidden entirely, and the app cannot be framed by another site. - Passwords hashed with PBKDF2-SHA-256 (100 000 iterations) and a per-account random salt.
- Sign-in attempts, sign-ups and password resets are rate-limited; counters are stored as one-way hashes.
- Password reset links are single-use, expire after one hour, and the response never reveals whether an address has an account.
- Secrets (signing key, admin key, mail token) live in Cloudflare's encrypted secret store, never in the code or the repository. The licence signing key has never left the operator's machine.
- Least data: we cannot lose your designs in a breach, because we never had them.
- Reviewed code: the codebase is regularly audited for security and correctness, most recently in August 2026, with findings fixed and covered by automated tests.
Reporting a vulnerability
If you find a security problem, please e-mail [email protected] with enough detail to reproduce it. You will get a reply from a human. Please test only against your own account, and avoid automated scanning or anything that would degrade the service for others. There is no bug bounty, but genuine reports are credited if you would like that. Machine-readable contact details: /.well-known/security.txt.
Data protection (GDPR)
The operator is the data controller for the account data listed above; Cloudflare, Inc. acts as a processor for hosting, the database and the e-mail delivery. The lawful basis for holding your e-mail address and password hash is performance of a contract — running the account you asked for. Account data is kept while the account exists.
You can ask for a copy of your account data or for its deletion at any time by e-mailing [email protected]; deletion is normally completed within 30 days and removes the account row entirely. Because your projects are stored only on your own device, they are not part of such a request — deleting your browser data removes them, and File → 💾 Save is how you keep your own copies.
The app sets no cookies and performs no tracking of individuals — the only measurement is cookie-free page-view counting — so no consent banner is required.
Certifications — an honest statement
Cyclogram holds no SOC 2 report and no ISO 27001 certificate, and you will not find badges for them on this site. What you get instead is the description above, which you can verify yourself, and an architecture where the most sensitive thing — your machine designs — is never uploaded in the first place.
The underlying infrastructure (Cloudflare) does hold SOC 2 Type II and ISO 27001 certification for the platform it operates; that covers the hosting, not this application.