Privacy Policy

Last updated: October 6, 2026

This page explains, in plain language, what SQLise collects when you use the site, why we collect it, how long we keep it, and who else handles it on our behalf. If anything here is unclear, please reach out using the contact details at the bottom.

What we collect and why

Account info (email, display name, avatar) via Replit Auth

Why: To sign you in, attribute your saved diagrams to you, and contact you about your account.

Retention: Kept while your account exists, including a six-month deletion grace period in which you may restore your account. Removed at final purge.

Diagrams and SQL you save (queries, generated lineage, annotations)

Why: So you can come back to your work, share it with teammates, and resume from drafts.

Retention: Kept until you delete the diagram or your account.

Optional first-party usage (visits, feature use, engaged intervals, network country/region)

Why: Admins use identifiable engagement for signed-in accounts and anonymous aggregate visitor counts to improve the product. Local network estimates are not residence.

Retention: Five years by default (administrator configurable). Opt-out stops new optional collection, not prior records. Final account purge removes activity intervals and anonymizes event identity/coarse geography. Operational server events remain separate.

Operational request logs (method, path, status, response time, IP)

Why: To run the service, debug errors, and protect against abuse.

Retention: Held by our hosting provider on a rolling basis. We don't keep our own long-term archive.

Billing details (handled by Stripe)

Why: To process subscription payments and provide receipts.

Retention: We store only the Stripe customer/subscription IDs. Payment details stay with Stripe.

Query Lens™ inputs/outputs (when you use AI features)

Why: To generate the explanation and cache it briefly so repeat requests are fast.

Retention: Cached results expire on a rolling basis; sent to OpenAI for processing only.

How we use it

We use the data above for two purposes:

  • Operations: running the service, signing you in, saving your work.
  • Analytics: measuring usage of features and pages so we know what to invest in, including spotting slow flows and refining workflows that succeed.

Operations rely on strictly necessary data and always run. Analytics is the only optional category and can be turned off any time from the .

Cookies and similar storage

We use a small number of first-party cookies and browser storage entries:

  • Necessary: session cookies from Replit Auth so you stay signed in.
  • Necessary: a tab-scoped ID kept in sessionStorage to group requests. Analytics visits split after 30 minutes of inactivity or an identity change.
  • Necessary: your cookie-consent choice itself, kept in localStorage so we don't ask again on every page.
  • Analytics: first-party event pings to /api/analytics/track. Disabled until you opt in.
  • Optional account-linked engagement: authenticated admins can see your name/email with current plan, access days, visits and feature counts. Activity intervals estimate engaged time only while the page is visible and you have interacted within 60 seconds. Pings occur at most every 30 seconds; overlapping tabs do not multiply time. Disabling analytics stops this collection immediately.
  • Optional approximate geography: new consented analytics derive country/region locally from the request IP. We do not request GPS, browser location, city or coordinates and do not send IPs to a hosted geolocation API. The network estimate may be wrong for VPNs/proxies; it is not your residence. Historical location and engaged time are not backfilled.
  • Coverage and retention: historical visit duration is only a first-to-last-event estimate; a one-event visit has unknown duration. Engagement telemetry follows the analytics retention window (five years by default, configurable by the administrator). Account deletion schedules a six-month grace period; final deletion removes activity intervals and anonymizes event identity and coarse location. No session replay, fingerprinting or keystroke content is collected.

We do not use third-party advertising cookies. We do not sell personal information.

Third parties we rely on

To run the service we send some data to a small number of processors. Each is used only for the purpose listed below.

  • Replit Auth — handles sign-in and provides your basic profile info.
  • Stripe — processes subscription payments and stores billing details.
  • OpenAI — receives SQL snippets you submit to the Query Lens™ feature so it can return an explanation.
  • Database host (Neon) — stores your account, saved diagrams, analytics events, and related app data.

Your choices

  • Open any time to change which categories are enabled.
  • Delete individual diagrams from inside the app to remove the saved SQL.
  • Email us to request account deletion or a copy of the data tied to your account.

Contact

Questions about this policy or your data? Email privacy@sqlise.ai.

Changes

If we materially change what we collect or how we use it, we'll update this page and re-show the consent banner so you can review your choice. The "last updated" date above always reflects the current version.