StepFlow
Open the canvasCanvas

Legal

Privacy policy

Last updated 1 October 2026

The short version: your diagrams stay in your browser. StepFlow sets no cookies and runs no advertising trackers; it counts visits with Cloudflare Web Analytics, which identifies no one. If you make an account, we hold your email address and what you have bought, and the companies below help us run the service.

Who we are

StepFlow is made by Figure8 Labs, a business based in Victoria, Australia. We are responsible for the personal information described here. Contact us at support@getstepflow.com.

Your diagrams

  • They are not uploaded. The canvas saves your diagram in your own browser's storage, on your device. We do not receive it.
  • Share links carry the diagram in the link itself, in the part after the #, which browsers never send to any server, ours included. Anyone you give the link to can open the diagram.
  • Exported SVG files carry a copy of the diagram inside them, so that the file can be opened again in StepFlow. Anyone with the file can do the same.
  • The AI assistant is the exception. When you send it a request, the request and the diagram on your canvas are sent to Anthropic, which provides the AI model, to produce the answer. See below.

What we collect

  • Without an account: nothing about you, beyond the technical records below.
  • With an account: your email address, which is how you sign in (we email you a code; there is no password), and an account identifier.
  • If you buy Pro: which features your account holds, and the details of your subscription that Stripe tells us: its status, when it renews or ends, and Stripe's identifiers for you and your subscription. If a payment is refunded, a record of the refund, kept with your email address so the refund policy's once-per-person rule can be applied. We never see or store your card number.
  • If you use the AI assistant: a record of each request's size, model and cost, so we can count it against your monthly allowance. We do not keep the request or the diagram.
  • Visits: counted by Cloudflare Web Analytics, without cookies and without identifying you. See Counting visits below.
  • Technical records: like most websites, our hosting and database providers record things such as your IP address, browser and the time of each request, to run the service and keep it secure.
  • If you email us: your email and what you write, to answer you.

What stays in your browser

StepFlow uses your browser's local storage, not cookies, for things you would expect it to remember: your diagram, your sign-in session, your AI chat, and preferences such as the theme and which panel is open. It stays on your device, and clearing your browser's site data removes it. None of it is used to track you.

Counting visits

To know how many people use StepFlow and how they find it, we use Cloudflare Web Analytics. When a page loads, a small script from Cloudflare reports the page's address (without anything after a ? or a #, so never a share link's diagram), the site that linked to it, your browser, device type and country, and how long the page took to load.

It sets no cookies, stores nothing on your device, builds no profile of you and does not follow you to other websites. Your browser's connection to Cloudflare carries your IP address, as any connection does, but what we see is only totals, such as visits to a page or from a country: never who visited. It never sees your diagrams or your account. Cloudflare handles this under its own privacy policy.

If you would rather not be counted, a content blocker such as uBlock Origin stops the script, and StepFlow works just the same without it.

Who else handles your data

We use these companies to run StepFlow. Each handles only what its job needs:

  • Vercel hosts the website.
  • Cloudflare counts visits to it (Web Analytics), without cookies.
  • Supabase holds accounts and what they have bought.
  • Resend sends the sign-in code emails.
  • Stripe takes payments and manages subscriptions. Its checkout service, Link, sells Pro on our behalf, handles the tax on it and sends your receipts, under Stripe's own privacy policy.
  • Anthropic provides the AI model behind the assistant. Under its commercial terms, it does not use requests sent through its API to train its models.

These companies are based mainly in the United States, so your information may be stored and processed outside Australia. We do not sell your personal information, and we do not share it for advertising.

How long we keep it

We keep your account for as long as you have it. Ask us to delete it and we will, along with what it holds, except where we must keep records by law, such as payment records for tax. Stripe keeps its own records of payments as the law requires of it.

Your choices and rights

You can ask to see the personal information we hold about you, to correct it, or to delete your account, by emailing support@getstepflow.com. If you are in the European Union or the United Kingdom, you also have the rights their data protection laws give you, including to object and to complain to your local data protection authority. In Australia, you can complain to the Office of the Australian Information Commissioner, though we would ask you to contact us first so we can put it right.

Children

StepFlow is not directed at children under 16, and we do not knowingly collect their information.

Changes

If we change how StepFlow handles personal information, we will update this page and the date at the top, and for a significant change we will tell account holders by email before it takes effect.