Privacy Policy

1. Who we are

Gage Willette (“we”, “us”) operates https://diomedes.app and the Diomedes service. Our registered address is 805 W Madison St, Tallahasse, FL 32304. For anything in this policy, write to [email protected].

2. What this website collects

Only standard server logs from our hosting provider — IP address, user agent, requested path, timestamp — generated automatically when any browser loads any website. We use them to keep the site up and to spot abuse.

This site has no forms, sets no cookies and runs no analytics, no advertising pixels, and no third-party trackers. That is why you were not asked to accept anything when you arrived. If we ever add analytics, this page changes first and we will use a tool that does not profile you across sites.

3. What the service collects

When you have a Diomedes account, we process:

• Account data — your username, display name and password hash (we never store the password itself), your plan, and your roles in each workspace. If you subscribe to Pro, the email address you give Stripe at checkout.
• Your content — the pages, comments, diagrams, attachments and page history you create, plus the derived blocks and search embeddings we generate from them to make search work.
• Operational data — session records, storage totals per workspace, and error logs.
• Billing data — handled by Stripe, our payment processor. We hold your Stripe customer and subscription identifiers and the subscription status; we never receive your full card number.

We do not use your content to train machine-learning models, we do not sell it, and we do not share it with advertisers. Support staff access a workspace’s content only when you ask us to look at something, or where strictly necessary to restore a broken service.

4. Why we are allowed to process it

• Contract — running the service you signed up for, and billing you for Pro if you chose it.
• Legitimate interests — keeping the service available and secure, enforcing plan limits, and preventing abuse.

5. Who else touches your data

We use a small number of processors to run the service: a cloud hosting provider for the application, its database and stored files, and Stripe for payments. Each is bound by a data-processing agreement and may use your data only to provide their service to us. A current list is available on request from [email protected].

We disclose data to anyone else only where the law requires it. If we receive a request for your data, we will tell you unless we are legally prohibited from doing so.

6. How long we keep it

• Account and content: for as long as your account and its workspaces exist. When you delete a workspace it is removed at once; when you ask us to close your account we delete it within 30 days.
• Workspaces over their storage limit: after thirty days over the limit we may remove data as described in the Terms, largest files first. You can download everything before that.
• Backups: rolling, and overwritten within the retention window.
• Server logs: 90 days, unless one is part of a live security investigation.
• Billing records: as long as tax and accounting law requires.

7. Your rights

Depending on where you live, you can ask us for a copy of your data, ask us to correct or delete it, object to processing, or ask us to hand it to another provider. Email [email protected] and we will respond within 30 days. You never have to ask us for an export, though — every page exports as Markdown and every workspace as a ZIP, from inside the product, at any time.

We do not sell personal information and do not share it for cross-context behavioural advertising, as those terms are used in US state privacy laws. If you are in the EEA or UK and think we have mishandled your data, you may complain to your local supervisory authority.

8. Security

Passwords are hashed with bcrypt. Traffic is encrypted in transit with TLS, and stored data is encrypted at rest. Access to production is limited to the people who need it and requires multi-factor authentication. No system is perfect; if we ever suffer a breach affecting your data, we will tell affected customers without undue delay.

9. International transfers

Our infrastructure runs in FL, USA. If we transfer personal data outside your region, we rely on Standard Contractual Clauses or an equivalent safeguard.

10. Children

Diomedes is a workplace tool and is not directed at children under 16. We do not knowingly collect their data; if we learn we have, we delete it.

11. Changes

We will update this page when what we do changes, and move the “last updated” date at the top. For changes that materially affect customers, we will tell you before they take effect.

12. Contact

Gage Willette, 805 W Madison St, Tallahasse, FL 32304. Privacy questions: [email protected].