Privacy Policy
Last updated: 13 November 2026
- onViz is a desktop app. Your files, databases, charts and reports stay on your computer. We run no server that receives them.
- When you use AI chat, onViz sends what the AI needs (your question, table and column names, a few sample values and the results of the queries it runs) directly to the AI provider you chose. Secret columns are always masked.
- The app has no account, no usage analytics, no telemetry and no crash reporting. The only request it makes to us is the update check.
- This website sets no cookies of its own and runs no analytics.
1. Who we are
onViz (“onViz”, “we”, “us”) is developed and operated in Vietnam. This policy explains what personal data is processed when you use the onViz desktop app and this website. Contact: [email protected].
2. The onViz app
2.1 What stays on your computer
Everything you create or load in onViz is stored in the app’s data folder on your computer: imported Excel / CSV files (as DuckDB databases), connection settings, charts, dashboards, conversations with the AI, notes you write for the AI, settings and backups. We cannot see or access this data.
Passwords, Grafana tokens and AI API keys are encrypted (AES-256-GCM). The encryption key is kept in your operating system’s secure storage (macOS Keychain, Windows Credential Manager) or in a file only your user account can read.
2.2 What is sent to the AI provider you choose
AI features are optional. When you use them, onViz sends the following directly from your computer to the AI provider configured in Settings › AI:
- your question and recent messages of the conversation (the number is configurable, and can be set to none);
- names of tables and columns, data source descriptions and notes you wrote for the AI;
- a few sample values and the results of queries the AI runs to answer you (limited in rows);
- the chart or dashboard you are editing, when you chat to edit it.
Columns that look like secrets (password, token, API key, OTP, PIN, card number, CVV…) are always masked before anything is sent. You can mask more columns (for example email or phone) and block tables in Settings › AI. Charts shown to you still use the real values.
The provider is your choice and is used with your account: Anthropic (Claude), OpenAI (ChatGPT) or any OpenAI-compatible service, or Claude Code / Codex running on your computer with the plan you signed in to. Their terms and privacy policies apply to what they receive. onViz does not proxy, store or see this traffic.
2.3 Data sources you connect
When you connect Grafana, PostgreSQL, MySQL / MariaDB, SQL Server or MongoDB, onViz talks to them directly from your computer with the credentials you provide, in read-only mode. We never receive those credentials or the data.
2.4 Update checks
The desktop app checks for new versions by downloading a small file (latest.json) from our update server hosted on Cloudflare R2. The request carries your current version
number. Like any web request it reveals your IP address and user agent to Cloudflare. It contains no identifier, and we do not combine it with any other data. Installers are downloaded
from the same server.
2.5 Optional Grafana install
If you ask onViz to install Grafana locally, the app downloads it from grafana.com. The installed Grafana runs only on your computer, with its usage reporting, update checks and news feed turned off.
2.6 Sharing reports on your network
Remote viewing is off by default. When you turn it on, colleagues on your network can open your reports in a browser with the password you set. They connect to your computer, not to us.
2.7 What the app does not do
The app has no sign-in or account, shows no ads, and sends no usage analytics, telemetry or crash reports.
3. This website
This website is a static site served by Cloudflare. To deliver and protect it, Cloudflare processes technical data such as your IP address, browser, the page requested and the time. We do not use analytics or advertising tools and do not set cookies. Your language and light / dark choice are saved in your browser’s local storage. See the Cookie Policy.
4. When you contact us
If you email us, we receive your email address and what you write, and use them only to answer you. Do not send us your company data or credentials.
5. Legal basis
We process the limited data above to provide the software and website (performance of a contract), to keep them secure and working (legitimate interest), and to answer your messages (your request or consent). This policy is written to meet Vietnam’s Decree 13/2023/ND-CP on personal data protection and, where it applies, the EU / UK GDPR.
6. Who receives data
| Recipient | Purpose | When |
|---|---|---|
| Cloudflare | Hosting this website, installers and update checks | When you visit the site, download or the app checks for updates |
| The AI provider you choose | Answering your AI chat requests | Only when you use AI features |
| Grafana Labs | Downloading Grafana | Only if you install Grafana from the app |
| Your data sources | Running read-only queries | When you connect and query them |
We do not sell personal data and do not share it for advertising.
7. International transfers
Cloudflare and AI providers may process data outside Vietnam, including in the United States and the EU. They rely on their own safeguards, such as standard contractual clauses. You choose the AI provider, and can use one that runs on your own network.
8. How long data is kept
- Data in the app: on your computer until you delete it. Uninstalling does not remove the data folder, so delete it yourself if you no longer need it.
- Website and update-check logs: kept by Cloudflare under its own retention rules. We do not keep separate copies.
- Emails to us: up to 24 months after the conversation ends, unless the law requires longer.
9. Your rights
You can ask to access, correct or delete personal data we hold about you, restrict or object to its processing, and withdraw consent. Since we hold almost nothing, most of this is in your hands in the app: delete conversations, remove datasets or delete the data folder. Write to [email protected] and we will reply within 30 days. You can also complain to the data protection authority in your country; in Vietnam, this is the Department of Cybersecurity and High-Tech Crime Prevention (A05), Ministry of Public Security.
10. Children
onViz is a work tool and is not directed at children under 16. If you believe a child has sent us personal data, contact us and we will delete it.
11. Security
How onViz protects your data, and how to report a vulnerability, is described on the Security page.
12. Changes
We may update this policy. The date at the top shows the latest version. For significant changes, we will also mention them in the app’s release notes.
13. Contact
Questions about privacy: [email protected].