Security & privacy

Written plainly, so an engineer or an IT department can judge it in five minutes. Last reviewed 6 October 2026.

The short version. Your cycle diagrams never leave your computer. They are stored by your own browser and are never uploaded, so there is no copy of your machine designs on any server — not ours, not anyone's. What our server keeps is your account: the e-mail address and password hash you sign in with, the profile you typed at sign-up (name, company, industry, country, role), and the licence requests or orders you make. Nothing about your machines is in it.

What data exists, and where

Data	Where it lives	Who can read it
Your projects, library, preferences	Your browser on your computer (IndexedDB / localStorage)	Only you. Never transmitted.
Your e-mail address	Cloudflare D1 database (EU/global edge)	The operator, to identify accounts and send account e-mail.
Your password	Same database, as a PBKDF2-SHA-256 hash with a random salt	Nobody — the plain password is never stored or logged.
An e-mail address typed at the sign-in's first step that did not become an account	Same database, for 30 days at most	The operator, to send one reminder the next day with a link back to the form. Deleted when the account is made, or after 30 days.
Your sign-up profile: salutation, first and last name, company, industry, country, role, where you heard of Cyclogram, and whether you ticked the newsletter box	Same database	The operator, to issue licences in your name — the one-month Full licence every account receives at sign-up (also e-mailed to you as a file), and any you order later.
Two timestamps and a count: when you last signed in with your password, when the app last checked in (once per start), and how many times it has started (starts less than half an hour apart count once)	Same database	The operator, to see whether an account is in use. Nothing finer than that is recorded — no pages, no clicks, no projects.
A licence request, if you make one: the profile above plus any message you type	Same database, with the licence id and expiry once one is issued	The operator, to issue the licence.
A licence order, if you place one: billing company, address, city, country, VAT id, and the price you were quoted	Same database	The operator, to invoice you.
Sign-in session	A signed token in your browser	Only your browser. No server-side session store.
Password-reset link	Same database, as a one-way hash, for one hour	Nobody — the link itself exists only in the e-mail sent to you.
Abuse counters	Same database, as one-way hashes	Nobody — the underlying address/e-mail cannot be read back.
Your licence file	Your browser	Checked offline. Licence checks never contact a server.
Newsletter address (only if you subscribe on the front page or tick the box at sign-up)	Kit (kit.com), the newsletter service	The operator, to send the newsletter. Every issue carries an unsubscribe link.

There is no advertising, no tracking pixel, no third-party font, no session recording. Two exceptions, both from Cloudflare, which hosts the site: the sign-up form embeds Cloudflare Turnstile (from challenges.cloudflare.com) to tell humans from bots — it runs only on that form, and it is the cookie-free alternative to a CAPTCHA — and every page loads Cloudflare Web Analytics (from static.cloudflareinsights.com), which counts page views, referrers, countries and load times. It sets no cookie, stores nothing in your browser and carries no identifier, so nothing follows you from one visit to the next; it tells us how many people read a page, not who. Everything else loads from cyclogram.app only. You can verify all of this in your browser's network tab.

Cookies

This site sets no cookies — not for analytics, not for advertising, not even for sign-in (the session token lives in your browser's local storage, which is never sent to other sites). The page-view analytics is cookie-free as well: it keeps no state in your browser at all. Because there is nothing to consent to, there is no cookie banner: EU ePrivacy rules require consent for non-essential cookies and similar storage, and we simply have none. The storage the app does use — your projects, preferences and sign-in token in IndexedDB/localStorage — is strictly necessary for the service you asked for and stays on your device.

Measures in place

HTTPS only, on a .app domain, which browsers refuse to load over plain HTTP. HSTS is set with a two-year lifetime.
A strict Content-Security-Policy: scripts may load only from this origin, inline scripts and eval are forbidden entirely, and the app cannot be framed by another site.
Passwords hashed with PBKDF2-SHA-256 (100 000 iterations) and a per-account random salt.
Sign-in attempts, sign-ups and password resets are rate-limited; counters are stored as one-way hashes.
Password reset links are single-use, expire after one hour, and the response never reveals whether an address has an account.
The sign-in's first step says whether an address has an account — that is how it knows which card to show. It sits behind the human check and a per-connection limit, so it cannot be used to sweep a list of addresses.
Unfinished sign-ups get one reminder, ever; the link in it only opens the form with the address filled in, it signs nobody in.
Secrets (session key, admin key, mail token, and the key that signs the one-month welcome licence) live in Cloudflare's encrypted secret store, never in the code or the repository. The key that signs paid licences has never left the operator's machine; the welcome licence is signed by a separate key, which the app accepts for nothing but a one-month trial bound to an account.
Least data: we cannot lose your designs in a breach, because we never had them.
Reviewed code: the codebase is regularly audited for security and correctness, most recently in August 2026, with findings fixed and covered by automated tests.

Reporting a vulnerability

If you find a security problem, please e-mail [email protected] with enough detail to reproduce it. You will get a reply from a human. Please test only against your own account, and avoid automated scanning or anything that would degrade the service for others. There is no bug bounty, but genuine reports are credited if you would like that. Machine-readable contact details: /.well-known/security.txt.

Data protection (GDPR)

The operator is the data controller for the account data listed above. Cloudflare, Inc. acts as a processor for hosting, the database and the e-mail delivery; Kit (Kit.com, formerly ConvertKit) acts as a processor for the newsletter, and receives only the address of someone who subscribed. The lawful basis for holding your account, profile, requests and orders is performance of a contract — running the account you asked for and issuing the licence you asked for; for the newsletter it is your consent, which the unsubscribe link withdraws. Account data is kept while the account exists.

You can ask for a copy of your account data or for its deletion at any time by e-mailing [email protected]; deletion is normally completed within 30 days and removes the account row entirely. Because your projects are stored only on your own device, they are not part of such a request — deleting your browser data removes them, and File → 💾 Save is how you keep your own copies.

The app sets no cookies and performs no behavioural tracking: the server records when an account last signed in and last opened the app, and nothing finer; the only other measurement is cookie-free page-view counting. No consent banner is required.

Certifications — an honest statement

Cyclogram holds no SOC 2 report and no ISO 27001 certificate, and you will not find badges for them on this site. What you get instead is the description above, which you can verify yourself, and an architecture where the most sensitive thing — your machine designs — is never uploaded in the first place.

The underlying infrastructure (Cloudflare) does hold SOC 2 Type II and ISO 27001 certification for the platform it operates; that covers the hosting, not this application.