Legal · updated October 25, 2026

Privacy, in plain words.

The short version: the makers process chart data in your browser. The AI connector processes the specs you send to it. Polar handles subscription payments; we do not see or store your card details.

Who is responsible

Meiku Charts is a product of Hirsch Atelier Online Seller (Dubai, UAE). This policy covers meikucharts.com and its hosted services and the local MCP license checks. For privacy questions or requests, email support@meikucharts.com.

The chart makers and share links

The makers parse, build and render charts on your device. The data you paste or load is never uploaded to us. You do not need an account to use the makers. Optional analytics cookies are used only if you allow analytics. Downloads (PNG, SVG) are produced on your machine. Pro license checks send the license information described below, separately from your chart data.

Share links carry the chart data in the part of the URL after #, which browsers do not send to our server. Anyone you give the full link to can read the data it contains, so share it with care.

Analytics

We use Cloudflare Web Analytics, which is cookie-free and does not profile visitors or track you across sites. It gives us aggregate counts — which pages were visited, roughly from where — and nothing about your chart data.

Optional analytics and TrustedSite badge

If you choose “Accept” in the cookie banner, we load Google Analytics 4 on eligible public pages and TrustedSite on public information pages such as the homepage, pricing and documentation. The TrustedSite code displays a trust badge and uses a tracking cookie to count a unique visit over a 24-hour period. TrustedSite receives the technical data needed for its requests, such as your IP address, browser information and the page you visit. We exclude chart editors, account pages, embedded charts and other private flows from the TrustedSite code. Read TrustedSite’s privacy policy.

Google Analytics

If you choose “Accept” in the cookie banner, we load Google Analytics 4 to measure public page visits, approximate traffic sources and page use. Google receives analytics events and the network information needed to receive them, including your IP address and browser information. Analytics cookies identify a browser; they are set for up to 180 days. We do not enable Google advertising signals or advertising personalization.

We send the public page address without URL parameters or share-link data, the static page title and only the referring website’s origin. We do not send chart data, form contents, email addresses, license keys or account identifiers. Google Analytics is excluded from your account, the private statistics dashboard, authentication and embedded charts. Your optional analytics choice is stored on your device for up to 180 days.

We advertise Meiku Charts in Google Search. If you choose “Accept”, the same Google tag also tells Google Ads when a visit that started from one of our ads leads to copying an embed code, downloading a chart or table, or buying a plan. For that, Google receives the ad click identifier from the address you arrived at, the public page address and, after a purchase, an approximate order value and a one-way code that lets Google count the purchase once. We never send chart data, the checkout ID, email addresses, license keys or account identifiers. Advertising personalization and remarketing stay switched off. Read how Google uses advertising data.

Before you accept, or if you choose “Reject”, we do not load the Google or TrustedSite scripts. You can change your choice through “Analytics preferences” in the footer. Withdrawing consent removes our Google Analytics and Google Ads cookies and reloads the page to stop the loaded scripts. A TrustedSite cookie already set may remain until it expires or you delete it in your browser; after withdrawal we do not load TrustedSite again. Withdrawal cannot delete data already received by either provider. Read Google’s privacy policy.

Cookies and browser storage

Necessary storage supports sign-in, security and the features you request; rejecting optional cookies does not prevent you from using the site. Your theme and motion preferences stay on your device. The optional category contains Google Analytics, Google Ads conversion measurement and TrustedSite; we do not use cookies for personalized ads or remarketing. Accepting analytics does not mean accepting our terms or waiving privacy rights.

We rely on your consent for optional analytics. You can refuse it or withdraw it at any time through “Analytics preferences” in the footer, as easily as accepting it. Withdrawal does not affect processing that took place before it. For privacy requests, including requests concerning analytics data, contact support@meikucharts.com.

Embedded charts on other sites

A page that embeds a chart loads our script from meikucharts.com. When its website has no site pass, an embed with the optional license attribute sends its site key and the hostname of the page to meikucharts.com for a license check, normally once a day, or less often when a cached result is used. Cloudflare receives the request's IP address and User-Agent, as it does for other web requests. We do not receive the chart data, page contents or visitors' cookies through this check.

Embedded charts ask lic.meikucharts.com whether their website has Meiku Charts Pro. The request carries the website's name and, like any web request, the visitor's IP address; it sends no cookies and no page address.

The visitor's browser stores the signed license-check response in localStorage for up to 7 days. Embeds do not set cookies or track viewers across sites. The surrounding site's privacy practices are its own.

License records and Pro in the makers

Our license record contains the Polar key ID and customer ID, plan, registered domains, your own credit line, linked Google account IDs and relevant dates. We do not store your Pro key or the buyer email and payment details held by Polar. The email from Google sign-in is handled separately, as described below.

You enter your Pro key once in your account, after signing in with Google, to enable Pro. The key is sent for verification. It is not saved on our servers or in your browser. The browser keeps a site key for embed code and a signed license-check response for Pro exports. It sends the signed response once a day to renew access. You can remove Pro from that browser through your account.

Local MCP license checks

The local MCP server reads your Pro key from MEIKU_LICENSE_KEY in your MCP client’s settings. It checks your subscription on the first use after each start, then once a day. To renew a valid signed license-check response, it sends that response and a random machine ID to meikucharts.com. These checks never send your data or charts.

The server sends your Pro key and machine ID at the first unlock and whenever this computer has no valid signed response. This includes after “Release all”, after a week offline or after a subscription lapse. After a lapse, it retries at most once an hour. A valid signed response allows up to 7 days of offline use.

The configuration folder stores machine-id, the signed response in verdict, and opened, a one-way, 16-character hexadecimal fingerprint of the key that last unlocked this computer. After a lapse, lapsed stores a time and that fingerprint. Your Pro key stays in your MCP client’s settings; the local MCP never copies it to this folder.

The folder is %APPDATA%\MeikuCharts on Windows, ~/Library/Application Support/MeikuCharts on macOS, or $XDG_CONFIG_HOME/meiku-charts on Linux (default: ~/.config/meiku-charts). Set MEIKU_CONFIG_DIR to use another folder.

Your website account and avatar

When you sign in to this website with Google, we receive your email address, profile name and profile photo URL. We use the name or email initial and optional photo to help you recognize your account. Your name and photo URL are carried in the signed, HttpOnly session cookie for up to 7 days. Ordinary account sign-in does not write these profile details to our account database; signing in from the blog also stores a comments profile as described below. The photo itself is loaded directly from Google with no referring page URL sent.

Your account always shows your Google profile picture, or your initial if the picture is unavailable. Our account database stores your email address and sign-in dates until you delete your account. A separate cookie, mc_signed_in, contains only a sign-in hint, no personal information; it lets the header check your session. The header caches your email, initial, plan and optional photo URL in this tab’s session storage for up to 10 minutes to avoid repeated requests. The hint cookie lasts up to 7 days after sign-in or an account visit and is cleared when you sign out, delete the account, or the header detects an expired session.

Account notices show relevant service status, such as your remaining monthly AI allowance. They do not send email. Signing in through the AI connector continues to request only identity and email access, without the website profile scope.

Comments

When you sign in from a blog article, we store your Google account ID, profile name and photo URL in Cloudflare D1. We use this profile to identify your comments and apply moderation decisions. We store comment text, posting times, likes, reactions, reports and moderation status. Published comments show your name, optional photo, text, time and engagement counts. Pending comments are visible to you and the moderators; held or rejected comments are available to moderators.

To limit spam and repeated submissions, we keep activity timestamps and text hashes linked to your comments profile. These records remain until you delete your account, including when you delete an individual comment. Reports identify the reporting account to the service and are not shown publicly.

You can delete your own comments from the article or delete your account on your account page. Deleting a comment removes its text, author details and any attached chart; an anonymous “Comment deleted” placeholder remains visible when needed to preserve replies. Account deletion removes your comments profile, comments, likes, reactions, reports and anti-abuse records. If other people have replied to one of your comments, its anonymous placeholder remains with their replies. Their comments are not deleted.

Cloudflare Turnstile checks comment submissions for human activity and abuse. We send the Turnstile token and your IP address to Cloudflare for verification. The IP address is not stored in the comments database.

The AI connector (MCP)

Users connect an AI assistant to meikucharts.com/mcp by signing in with Google. From that sign-in we receive and store your email address. It identifies your access and lets us apply fair-use limits. We never see your Google password; Google only confirms who you are. Chart specs sent to the connector are processed to render your chart and are not stored.

A dedicated demo account for integration reviewers can use an email and password instead. This restricted sign-in does not create accounts or provide access to other users' data. We keep a salted password verifier in protected server configuration, not the password. A necessary, HttpOnly cookie named mc_reviewer_nonce binds the sign-in to the browser for up to 5 minutes. Pending authorization requests expire after 5 minutes. Security counters use a daily keyed hash of the request's IP address, rather than the raw address. Counters expire within 15 minutes and are removed by automatic cleanup. Demo account records contain the dedicated email and sign-in dates; contact support to request their deletion. Passwords are processed only by the sign-in form and are not sent to AI tools or stored in usage statistics.

We keep a visualization counter for each account and calendar month. Usage statistics contain a hashed account identifier, plan, tool and number of units, rather than your email or chart data. These records help us apply allowances and understand service use.

We also keep aggregate counts of AI connector activity, allowance refusals, tool errors and service requests, grouped by hour and tool or plan. For Pro license checks, we count the website hostname only, without the page path or query string. These aggregates help us understand adoption, maintain reliability and improve our plans, and are kept for the current calendar month and the previous 12 months. They do not contain chart contents, request bodies, email addresses or account identifiers. Free embeds do not send usage reports. Sampled operational logs contain route categories and error references and are retained by Cloudflare for up to 3 days.

Payments

Polar is our reseller and Merchant of Record. It processes subscription payments with Stripe, calculates tax and issues receipts. We do not see or store your full card number or security code. Payment information is handled under Polar’s privacy policy and Stripe’s privacy policy.

Why, and on what basis

We process your sign-in details, license records, usage counters and chart specs to provide the service you asked for (performance of the service you signed up to), and technical request data to keep the service secure and fair (our legitimate interest in running it). We do not use your data for advertising.

How long we keep it

We keep the primary license record while the license exists, with deletion scheduled 90 days after it ends or is revoked; related lookup records may remain longer if cleanup is interrupted. Monthly visualization counters are retained for 13 months unless you delete your account sooner. When account deletion completes, past months’ counters are erased. The current month’s count is kept to enforce the free allowance, then erased by a cleanup scheduled during the first 27 days of the following month. If a service fails during deletion, we show an incomplete-deletion message so you can retry the remaining steps. Pseudonymous usage statistics, identified by a hashed account ID, expire within 3 months and cannot be deleted one by one. A cached browser license-check response lasts up to 7 days.

Your sign-in email is kept until you delete your account (the button on your account page) or ask us to delete it. Chart specs sent to the connector are not stored; maker data never reaches us at all. Our host (Cloudflare) processes technical request data, such as IP addresses, transiently to deliver and protect the service.

Providers and data sharing

We do not sell your personal data and do not share it for advertising. It goes to no third parties beyond the infrastructure that provides the service: Cloudflare (hosting) and Google (sign-in and, only with consent, analytics), TrustedSite (only with consent, trust badge and visit count), plus Polar and Stripe for payments. These providers operate globally and rely on their standard contractual safeguards where data crosses borders.

Your rights

You can request deletion of your account and stored email with the “Delete my account” button on your account page; if deletion is incomplete, the page asks you to retry the remaining steps. The counter and statistics retention exceptions above still apply. You can also ask to access or delete your license records or stored email, or ask about usage records, by writing to support@meikucharts.com, ideally from that address. Where your local law provides more — correction, a portable copy, restriction, objection, or a complaint to a data-protection authority — those rights stand. California residents: we do not sell or share personal information in the CCPA's sense, and you will never be penalized for exercising a privacy right.

Adults only

Meiku Charts is intended for adults aged 18 or over. If you believe a minor has provided a sign-in email, contact support@meikucharts.com so we can investigate and delete the account data where applicable.

Changes

Changes appear on this page with a new date at the top; a material change gets a notice on the homepage before it takes effect.

Privacy · Terms · Acceptable use · Contact