Privacy Policy

Effective date: October 25, 2026

This policy explains what information is handled when you visit the kroki.io website or use the free public Kroki service at https://kroki.io. Both are operated by Yuzu tech. Kroki has no user accounts: we never ask for your name, email address or any other personal details to use the service.

What information do we use

  • Diagram sources. To render a diagram, the service needs its source. With a GET request, the source is encoded in the URL (deflate + base64, which is not encryption: anyone holding the URL can decode it). With a POST request, the source is sent in the request body. The live editor on the home page also sends what you type to the service in order to display a preview.
  • Technical request data. Like most web services, our servers and network providers receive your IP address, the requested URL, the date and time of the request, your user agent and the referring page.
  • Browser storage. The website stores a single preference in your browser's local storage (whether the live editor auto-refreshes). It never leaves your browser and is not used to identify you. The website itself does not set cookies; however, our third-party providers (see below) may set their own, for instance Cloudflare for security purposes or Carbon Ads when displaying an advertisement.

How do we use the information

  • Diagram sources are processed in memory to produce the image, which is returned in the response. We do not store the sources or the generated diagrams, and we do not look at their content.
  • Access logs (which include the full URL of GET requests, and therefore the encoded diagram source) are kept for less than 30 days, only to operate the service, troubleshoot errors and fight abuse. The body of POST requests is not logged.
  • We do not sell your information and we do not use it to build profiles.

What information do we share

We rely on a few third-party providers who process technical request data on our behalf:

  • Cloudflare sits in front of kroki.io and handles all requests (network delivery and protection against attacks).
  • Exoscale hosts the servers that render diagrams.
  • Netlify hosts this website.
  • Carbon Ads displays an advertisement on the home page of this website, which helps fund the service. When the ad loads, your browser connects to Carbon Ads, which receives your IP address and user agent. Carbon Ads is not part of the Kroki service itself and never receives your diagram sources.

We may also disclose information if we are required to do so by law.

Sensitive diagrams

If your diagrams contain confidential information, we recommend that you run your own Kroki instance. Kroki is open source and can be self-hosted, in which case no data is sent to us. Tools that use kroki.io by default (editor plugins, browser extensions, documentation generators) usually let you configure the server URL.

Your rights

Since Kroki has no accounts, we generally cannot link a request to a person. Under the GDPR, you can nonetheless ask us to access or delete data relating to you, and you have the right to lodge a complaint with the French data protection authority (CNIL).

Changes to this policy

We may update this policy from time to time. The effective date at the top of this page tells you when it was last revised.

Contact us

If you have questions or concerns about how your information is handled, please contact us: [email protected]