Mermaid Viewer privacy policy

1. Who we are and what this policy covers

Mermaid Viewer: Preview and Export Diagrams (Mermaid Viewer for short) is a browser extension for Google Chrome, published by an independent developer. This policy explains what the extension does with your data, what our website at haranalyzer.app does, and what rights you have. It applies to the extension itself and to the pages of haranalyzer.app that belong to it: the extension's page, the welcome page, the uninstall page and this page. The online HAR Analyzer tool on the same website has its own policy at haranalyzer.app/privacy.

The short version: the extension works inside your browser, makes no network requests and does not send your data anywhere.

2. What data the extension handles

The extension does not send personal data to us or to anyone else, and we do not sell it. The data described below is handled only on your device.

• Code you paste, type or open. Mermaid code you enter on the extension's own page, and files you open there (.mmd, .mermaid, Markdown or plain text), are read and drawn inside that page. Files are not uploaded anywhere.
• Page content, only when you click. When you click the extension icon, or choose Find Mermaid diagrams on this page in the right-click menu, the extension runs a one-time script on the current tab. The script reads the text of the code blocks on that page, keeps only the ones that look like Mermaid diagrams and hands them to the extension's page, together with the site name (for example docs.example.com) to show where they came from. When you choose View selection as Mermaid diagram, the script reads only the text you selected. Nothing on the page is changed, and the extension has no content scripts and no standing access to any website. Chrome does not let it read its own settings pages, the Chrome Web Store or, unless you allow it, local files.
• Where that content is kept. Code found on a page or in a selection is passed through the browser's built-in chrome.storage.session area, which Chrome clears when it closes, and is removed from there as soon as the extension's page picks it up. It is never written anywhere else unless you save the diagram.
• Your diagrams and settings. Diagrams you save (name and code), the current unsaved draft, and display settings (page and diagram theme, PNG size, transparent background) are saved with the browser's built-in chrome.storage.local API. This data stays in your browser profile and never leaves your device.
• Images you export. PNG and SVG files are built inside the extension's page and saved by your browser like any other download. Copying an image or code uses your system clipboard only when you press a Copy button.
• No accounts. The extension has no sign-up, no login and no user profiles.
• No tracking inside the extension. The extension contains no analytics, no advertising code and no remote code. The diagram library (the open source Mermaid package) is bundled inside the extension.

3. Cookies and analytics on our website

The pages of haranalyzer.app use Google Analytics 4 to count visits and to understand which pages are useful. This happens only on the website, not inside the extension. The uninstall page has no analytics. The welcome page, which opens once after installation, also reports whether the extension's icon is pinned to your toolbar. We never send Google Analytics the code, diagrams or addresses you work with. Advertising features are off for everyone.

If you are in the European Economic Area, the United Kingdom or Switzerland, analytics cookies are off by default. Google works out your country from your IP address. Without your consent, Google Analytics sets no cookies and stores no identifier on your device. The Google script still loads and can send Google a basic signal without a cookie: the page you opened, the time, your browser and device type, and your approximate location.

Everywhere else, analytics cookies are on by default. Google Analytics sets cookies named _ga and _ga_ followed by the property code, which can last up to two years, and processes the same technical data.

Your browser connects to Google to load the script, so Google sees your IP address. Google says Google Analytics 4 uses it to estimate location and does not store it. Statistics are kept for 14 months (see section 8).

Your choice. If your browser's time zone is in Europe, tool and article pages ask "Allow analytics cookies?" Yes and No take one click each. We save your answer in your browser's local storage and apply it to the whole website, including pages that do not ask. The "Cookie settings" button at the bottom of those pages lets anyone, in any country, change the answer at any time. Choosing No stops analytics cookies and deletes the ones already set.

You can also block cookies in your browser settings, use a content-blocking extension or install Google's opt-out add-on. The website keeps working without them. Google's own privacy policy describes how Google processes this data.

Server logs. Like any web server, ours keeps a technical log of requests to these pages: IP address, the address requested, the time, the browser type and, if your browser reports it, the page you came from. The site is served through Cloudflare, which also sees this traffic and protects the site from abuse. We use the log to keep the site running and safe, and it is deleted automatically after a short time. The extension sends nothing to this log; only opening one of these pages does.

4. How we use data

The only data we receive is the aggregated website statistics and server logs described above and, if you choose to send them, your answer on the uninstall page and any email you write to us. We use the statistics to see how many people reach the welcome page, the logs to keep the site running and safe, and your answers and emails to reply to you and to improve the extension. We do not build individual profiles and we do not combine this data with any other source.

When you remove the extension, Chrome opens a short page on our website that asks why. Answering is optional. Only if you press Send, the reason you picked and the text you typed (up to 500 characters) go to our server, which passes them to us as a message in Telegram with the name of the extension and does not store them. To stop spam, the server counts answers per day by a one-way hash of your IP address with a key that changes every day; the hash is kept for 2 days and is never part of the message. The uninstall page has no analytics and sets no cookies. Please do not put personal details in your answer.

The use of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements.

5. Who we share data with

We do not sell or rent data, and we share it only with the services named here. They process data for us: Google Analytics, as a service provider for the website statistics in section 3; Telegram, which delivers answers from the uninstall page to us (it receives the extension name, the reason and the text you send, but not your IP address or any install ID); Cloudflare and our hosting and email providers, which carry the website traffic, store the server logs and the emails you send us. Please do not put personal details in your answer on the uninstall page. We have no server that receives data from the extension.

6. Your rights, including under the GDPR

If you are in the European Economic Area, the United Kingdom or Switzerland, you have the right to access, correct or delete personal data about you, to restrict or object to its processing, and to lodge a complaint with your local data protection authority. Because the extension keeps everything on your device, you can exercise these rights yourself at any time (see section 8). For website analytics, you can opt out as described in section 3. For anything else, write to [email protected] and we will answer within 30 days.

The legal basis for analytics cookies in those places is your consent, which you can withdraw as described in section 3. The legal basis for the basic signal without cookies, for website analytics elsewhere and for server logs is our legitimate interest in understanding how the website is used and keeping it safe. The legal basis for emails and uninstall page answers you send us, and for counting those answers by the IP hash, is our legitimate interest in replying to you, improving the extension and preventing spam. The legal basis for reading a page and storing your diagrams and settings is that you asked the extension to do it.

7. Children

The extension and the website are not directed at children under 13 (or under the age set by your country's law). We do not knowingly collect data from children. The extension sends nothing to us, so we hold no such data from it.

8. Data retention and deletion

Code found on a page lives in session memory only until the extension's page picks it up, and Chrome clears that memory when it closes. Saved diagrams, the draft and settings live in your browser only: delete a diagram in My diagrams, or remove the extension from Chrome to delete all of them. Website analytics data is kept by Google Analytics for the retention period set in our account (14 months) and then deleted automatically. Server logs are deleted automatically after a short time. We keep emails only as long as we need them to reply or to improve the extension, and you can ask us to delete them. Answers from the uninstall page stay in our private Telegram chat until we delete them; our server keeps only the daily counts and the IP hash described in section 4, for 2 days.

9. Changes to this policy

If we change this policy, we will update the text on this page and the date at the top. Please check this page from time to time if you want to stay informed.

10. Contact

Questions about this policy or about your data: [email protected].