Privacy

Privacy policy

Last updated 24 September 2026

1. 01What we store when you have an account

   • Account: your email address and a password. The password is handled by our sign-in provider, Supabase Auth, and stored only as a one-way hash; we never see it.
   • Profile: your name, an optional profile photo, and your onboarding answers (whether you learn alone or with a team, and why).
   • Your work: the diagrams you save (titles, descriptions and contents) and your lesson progress, including your answers and one previous attempt you can restore.
   • Passkeys, if you add one: a public key and its name and dates. Your fingerprint, face or device PIN never leaves your device.

   We do not use analytics, advertising or tracking of any kind, and we do not sell or rent your information.

2. 02Using HLD Lab without an account

   As a guest, your draft diagram and lesson progress are kept only in your browser's storage on that device. They are not sent to us. Clearing your browser's site data removes them.

3. 03The AI assistant

   The assistant is optional and uses your own API key from a provider you choose (such as OpenAI, Anthropic, OpenRouter, Google Gemini, or a server you run). The key is saved only in your browser.

   When you use it, your request and the diagram currently on screen are sent directly from your browser to that provider. We do not receive or store your key, your requests or the replies. What the provider does with them, and what it charges you, is governed by its own terms and privacy policy.

4. 04How we use it

   • To save your diagrams and progress and show them to you on any device you sign in on.
   • To sign you in and keep your account secure.
   • To send the emails an account needs: confirming your address and resetting your password.

5. 05Where it is stored, and who helps us run the service

   • Supabase stores your account and data (database and sign-in), in its Mumbai, India region.
   • Vercel hosts the website and may process request details such as your IP address to deliver pages.
   • An email delivery provider sends account emails on our behalf.

   These providers process data only to run the service for us, under their own security and privacy commitments. Some of them may handle data outside your country.

6. 06Storage in your browser

   HLD Lab keeps a few things in your browser's local storage: your signed-in session, preferences such as theme and editor settings, guest work, and your AI connection if you set one up. These are needed for the app to work. We do not use third-party or advertising cookies.

7. 07Security

   Connections are encrypted (HTTPS). The database only returns each account its own rows, enforced by the database itself rather than by the website. No system is perfectly secure, so keep your own copies of work that matters (see below).

8. 08Your choices

   • See and export: export every diagram from your profile, and download any lesson's checkpoint from the lesson.
   • Correct: change your name, photo and password in your profile.
   • Delete: delete your account from your profile. This removes your profile, diagrams, lesson progress and passkeys from our database straight away. Copies may remain for a short time in our providers' logs or backups, under their retention schedules.
   • For anything else, including questions about your rights where you live, write to hldlab.contact@gmail.com.

9. 09How long we keep it

   For as long as your account exists. When you delete your account, its data is deleted as described above.

10. 10Children

    HLD Lab is not meant for children under 13, and we do not knowingly hold their information. If you believe a child has an account, write to us and we will delete it.

11. 11Changes to this policy

    When this policy changes we update the date above. For significant changes affecting account holders, we will also say so in the app.

Questions? Write to hldlab.contact@gmail.com.