Privacy policy
Mermaid SVG Diagrams for Confluence
Last updated 30 August 2026
Every claim on this page is meant to be checkable against the app's manifest and its behaviour, not taken on trust. Where the app cannot prove something, it says so.
The short version. This app draws a diagram. It does that inside your browser, from text that is already on your Confluence page. It has no back end, asks for no permissions, stores nothing, and sends nothing anywhere.
What the app reads
The text of the diagram you wrote, which Confluence hands to the macro as its configuration. Nothing else.
The app requests no Atlassian scopes at all — permissions.scopes in its manifest
is an empty list. There is no Confluence API it could read even if it tried: not page content, not user
profiles, not spaces, not attachments. It holds no write scope either, so it cannot change anything in your
site.
Where the work happens
In the reader's browser. The Mermaid library is shipped as a static resource of the app and runs on the page; the SVG is produced there and placed into the macro. This app has no resolver and no server-side function, and no server of ours exists anywhere.
What the app stores
Nothing. Not in Forge storage, not in your browser, not anywhere.
The diagram text is saved by Confluence, as part of your page, exactly like the rest of your content. It is your data, in your Atlassian site, under your own data residency and retention settings — the app never holds a second copy of it, and keeps nothing between one page view and the next.
Where it is stored
Wherever your Confluence content is. Because the app stores nothing of its own, there is no second location to ask about: data residency for the diagram text is simply the data residency of the page it lives on. This needs nothing from us and nothing from you. It follows from having no storage and no server.
What the app sends anywhere else
Nothing. The manifest declares no external permissions, so the Forge platform blocks any outbound request — the app could not phone home even if a future bug tried to. There is no vendor server, no analytics, no error-reporting service, no telemetry, and no fonts or scripts loaded from a third-party host.
The app is deployed as eligible for Atlassian's Runs on Atlassian programme, which is the platform's own verification of exactly this.
Personal data
The app is not designed to process personal data, and in normal use it does not: a flowchart is text an author typed. If you choose to write someone's name inside a diagram, that text stays exactly where the rest of your page content is — in Confluence. It never reaches us, because nothing reaches us.
For the same reason Softyways is neither a data controller nor a data processor for this app: we do not receive, store, or process any data from your site.
How to delete it
There is nothing of ours to delete, and nothing of yours that we hold. Uninstalling the app removes it from your site; your pages, including the diagram text, remain your content and are managed by Confluence exactly as before.
Changes to this policy
If the app's behaviour changes, this page changes with it and the date above moves. The claims here are tied to the manifest: if a future version asked for a scope or an external permission, that would be visible on the app's Marketplace listing before it was visible here.
Contact
Questions about this policy, or a request about data: support@softyways.com. Security reports: security@softyways.com.