Acceptable use policy
DiagramDock runs entirely on your device, so there is very little we can police even if we wanted to. This policy exists to set expectations and to explain how imported content is handled.
Prohibited uses
Do not use DiagramDock to plan or facilitate activity that is clearly illegal where you are. We have no visibility into your diagrams and no ability to enforce this — it is a statement of what the tool is for, not a claim of monitoring.
Imported content
Files you import — project files, Mermaid text, CSV, SQL — are treated as untrusted. Every import is validated before anything loads. Imported content can never execute code: there is no eval, no dynamic function construction, and script content, event handler attributes and unsafe URL schemes are rejected rather than sanitised into something that might still run.
SQL is parsed, never executed
The schema visualiser reads CREATE TABLE statements as text and turns them into shapes. There is no database connection anywhere in DiagramDock, and no SQL is ever executed. Pasting a destructive statement does nothing, because a DROP statement is simply not a CREATE TABLE and is ignored.
Links in diagrams
Links attached to diagram elements are restricted to http, https and mailto. Other schemes, including javascript:, are rejected on import.
Reporting a problem
If you find a way to make imported content behave unsafely, please tell us. Security reports are welcome and taken seriously — see the contact page.