Legal

Privacy Policy

Last updated: November 5, 2026

1. Overview

Schemity is a desktop application for database ERD (Entity Relationship Diagram) design, visualization and migration generation, operated by an independent developer. This policy covers the Schemity desktop application and this website (schemity.com). Schemity Lite, the browser version at lite.schemity.com, has its own Privacy Policy.

Your diagram files, your database data and your database credentials never leave your machine. Credentials go only to the database they belong to. The application has no cloud storage and no user accounts. It does send a small amount of information, all of it listed in Section 3: license and update checks, which always run, and anonymous usage statistics and crash reports, which you can turn off at any time.

2. What Stays on Your Machine

The Schemity desktop application never uploads:

  • Your ERD files, layouts, notes or descriptions.
  • Your database schemas, other than the cases described in Section 3.3.
  • Any data stored in your databases.
  • Your database credentials, connection strings, SSH keys or Snowflake private keys.

The built-in MCP server, which lets AI agents on your computer read and propose changes to your diagrams, listens only on your own machine (127.0.0.1). It is not reachable from the network and sends nothing to us.

Schemity connects to your own databases directly from your machine. For a Cloudflare D1 database you connect, it sends your Cloudflare API token and read-only schema requests to Cloudflare's API (api.cloudflare.com), the same way it sends a password to your own database server.

3. What the Application Sends

3.1 License and update checks (always on)

To verify your license and offer updates, Schemity contacts our license server, hosted on Cloudflare. It sends:

  • A device ID generated from your machine. It does not contain your name or any account information.
  • Your license key, when you activate a license.
  • The application version, operating system and processor type (for example "aarch64-macos").

The server records the country your request came from, derived from your IP address by Cloudflare. We do not store the IP address itself. These checks cannot be turned off, because they are how Schemity is licensed.

3.2 Anonymous usage statistics (optional, on by default)

Schemity reports which features are used, so we know what to improve. The events are: the application was opened, a diagram was created (with the database type, such as PostgreSQL, and the connection method), a diagram was edited, and an export was used (with the export format). Each event carries the application version, your operating system and a random identifier stored on your machine. Page addresses are removed before sending, so no workspace, connection, database, schema, table or column names are included, and so are screen size, time zone, language and the full browser identification string. These statistics are processed by PostHog in the United States. PostHog receives your IP address as part of the connection, but does not look up a location from it and does not store it.

3.3 Crash reports (optional, on by default)

When something breaks, Schemity sends the error message, a stack trace, the application version and your operating system to Sentry, so we can fix the bug. Before sending, your home folder path and the workspace, connection and database names in page addresses are removed, and no cookies, request contents or user details are attached. When a migration fails, the report carries the kind of each statement (such as add column or add foreign key), the built-in column type it uses, the database's error code and which statement failed, never the SQL, the database's message or any table, column, custom type or value name.

Two cases can still carry part of your work: an error message can quote what was being processed (for example a database error that names a table), and when the application itself crashes, the report includes a snapshot of its memory at that moment, which may hold parts of the schema that was open. If that matters for your work, turn crash reports off.

3.4 Turning the optional parts off

Open Schemity, click the gear icon in the bottom right corner of the home screen, and switch off "Send anonymous usage statistics", "Send crash reports" or both. Your choice is saved in ~/schemity/settings.json and takes effect immediately. If you turn crash reports back on, they fully resume the next time Schemity starts.

3.5 Feedback (only when you send it)

When you send a message with the Feedback button, Schemity sends the message, the email address if you choose to give one, the application version, your operating system (without its version), whether it came from the desktop application or Schemity Lite, and the application language. From the desktop application it also sends the license type and status (for example "Perpetual, active") and the device ID described in Section 3.1, so we can look into a license or update problem without asking you for them. Nothing else is attached: no license key, diagram contents or file names. Schemity Lite sends no license status or device ID. The email is used only to reply to that message. Feedback is stored in our own database on Cloudflare, and a copy is emailed to our inbox through Loops so we can read it. Your IP address is used only to limit how many messages can be sent in a minute and is not stored.

4. Payment and Licensing

When you purchase a Schemity license, the transaction is processed by LemonSqueezy, which acts as the merchant of record. LemonSqueezy collects your payment details; we never see or store your card information.

LemonSqueezy shares your email address, your name and the details of your license with us, and we keep them in our license database so we can deliver your license, answer support requests and manage activations. LemonSqueezy's handling of your information is governed by their own Privacy Policy.

If you bought a Team license, you can manage its seats at license.schemity.com/seats. To sign you in, we email a one-time link to the address you bought with, sent through Loops. The link works once and expires after 15 minutes; we store only a fingerprint of it, never the link itself. Signing in sets one cookie, used only to keep you signed in for a day.

5. Service Providers

We use the following providers, each only for the purpose described in this policy:

  • LemonSqueezy: payments, invoices and license keys.
  • Cloudflare: hosting of the license server and this website.
  • Loops: sign-in emails for Team license seat management, and delivering feedback messages to our inbox.
  • PostHog: anonymous usage statistics, if enabled.
  • Sentry: crash reports, if enabled.
  • Google: website analytics, see Section 6.

We do not sell your personal information, and the desktop application does not share it for advertising.

6. Website Analytics

This website (schemity.com) uses Google Tag Manager for analytics and advertising measurement. Google may collect browsing data on the website in accordance with Google's Privacy Policy. This applies only to the website, not to the desktop application.

7. Local Data Storage

All your work in Schemity is stored as plain JSON files in the ~/schemity/ directory on your machine. You have full ownership and control over these files. You can back them up, version-control them with Git, or delete them at any time.

Database passwords, Snowflake key passphrases, Cloudflare API tokens and access tokens are kept in your operating system's keychain. Connection details are stored locally on your device and are never transmitted to any remote server.

8. Cookies

The Schemity desktop application does not use cookies. The Schemity website may use cookies for Google Tag Manager and basic site functionality, as described in Section 6.

9. Data Retention

License records, including your email address and name, are kept for as long as your license exists. Usage statistics and crash reports are kept only as long as they are useful for improving Schemity and fixing bugs. Feedback messages are kept for as long as they are useful for improving Schemity, and are deleted on request.

10. Your Choices and Rights

You can turn off usage statistics and crash reports at any time, as described in Section 3.4. You can also ask us what we hold about you, or ask us to correct or delete it, by writing to support@schemity.com. Include your license key so we can find the records tied to your device. We will coordinate with LemonSqueezy for any information they hold.

11. Children's Privacy

Schemity is not directed at children under 13. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us so we can take appropriate action.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated date. Your continued use of Schemity after any changes constitutes acceptance of the updated policy.

13. Contact

If you have any questions about this Privacy Policy or how your data is handled, please contact us at support@schemity.com.