Security & privacy
Short version: your call flows never leave your computer. The editor runs entirely in your browser. We
never receive, store or see your flows, prompts, phone numbers or anything else you type into a diagram.
What stays on your computer
- Everything you put in a call flow: names, numbers, extensions, prompts, schedules, notes.
- Flow files you save. They're written directly to the location you choose.
- PDF and PNG exports. They're generated in your browser, not on a server.
- Optional autosave. The open flow is kept in your browser's local storage on your device so a closed tab doesn't lose work. You can turn it off and clear it at any time from the account menu.
What we store
| Data | Why | Where |
|---|---|---|
| Email address | Your account and sign-in links | Our database (Cloudflare) |
| Sign-in sessions (hashed) | Keeping you signed in; limiting each account to two devices | Our database (Cloudflare) |
| Subscription status and plan | Knowing whether your account is active | Our database (Cloudflare) |
| Payment details | Billing | Stripe only. We never see or store card numbers. |
There is no database table, file store or API endpoint for call flow content.
How it's enforced
- No upload path. The only server calls the editor makes are “am I signed in and subscribed?”, sign-out, and opening Stripe's billing pages.
- Strict Content Security Policy. The browser is instructed to block the page from connecting to any server other than ours, and from loading any outside scripts.
- No third-party scripts. No analytics, ad trackers, chat widgets or session recording.
- No request logging on our API, and sign-in links and sessions are stored only as one-way hashes.
- Encrypted in transit (HTTPS with HSTS).
Verify it yourself
Open your browser's developer tools (F12), go to the Network tab, and build or export a flow. You'll see no requests carrying your diagram. Your IT or security team is welcome to review this.
Questions
Email support@callsketch.com.