Privacy policy

Last updated October 28, 2026

VSM Studio (vsmstudio.app) is a tool for drawing and improving value stream maps. This page explains what we collect, why, and what you can do about it.

Without an account

You can use VSM Studio without signing in. Your maps, settings and course progress are then stored only in your own browser (local storage). We do not receive them.

With an account

If you create an account or sign in, we store:

• Your email address, and if you sign in with Google, the name and profile picture Google shares with us. We use them only to identify your account and send you sign-in emails.
• Your maps and course progress, so they are available on any device where you sign in. Each user's maps are private: the database only returns them to the account that owns them, and to the members of your team if you choose to share a map with your team.
• Your plan and usage: your plan, trial dates, purchases, and counts such as simulations run and AI answers used this month, so we can apply your plan's limits.

We do not sell your data, use it for advertising, or share it with anyone except the services below that run VSM Studio.

Emails we send

Account emails (sign-in links, confirmations, password resets, receipts) go to the address on your account. If you have an account we may also send a few product emails, such as tips during your trial or a note when your trial ends. Every one of those has a one-click unsubscribe link; account emails continue after you unsubscribe.

Google sign-in

When you choose “Continue with Google”, we request only your basic profile (name, email address and profile picture) to create and sign in to your account. We do not request access to your Gmail, Drive, contacts or any other Google data. Our use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.

Services we use

• Supabase: account sign-in and the database that stores signed-in users' maps (United States).
• Vercel: hosting of the website.
• Resend: delivery of sign-in and account emails.
• Stripe: payments. Card details go straight to Stripe; we never see or store them.
• Cloudflare Turnstile: a privacy-friendly security check on sign-in and the contact form, to keep bots out.
• Anthropic: the built-in AI answers in the Assistant (see below).

AI features

When you ask the Assistant a question while signed in, the question, the recent conversation and a summary of the open map are sent to Anthropic through our server to generate the answer. Anthropic does not use this data to train its models. If you add your own Anthropic API key in Settings, the Assistant sends the text you type and a summary of the open map directly from your browser to Anthropic to answer you. Your key is encrypted with a passphrase you choose and stays in your browser; we never receive it.

Analytics and cookies

We use Vercel Web Analytics and Speed Insights to count page views, measure page speed and see which features are used (for example how many simulations are run). They do not use cookies and do not identify you personally. We do not use advertising or tracking cookies. Sign-in uses your browser's storage to keep you signed in.

Contact form, feedback and error reports

Messages you send through the contact form (your name, email and message) are stored so we can reply. When you rate a suggestion or answer with 👍 or 👎, we store the rating and any comment you add, linked to your account if you are signed in. If the app hits a script error, your browser sends us the error message, the page and your browser type, with no personal data, so we can fix it.

Your choices

You can export or delete any map at any time from Save & share. To delete your account and everything stored with it, contact us from the address on your account and we will remove it within 30 days.

Contact

Questions about privacy: use our contact form.