{
  "slug": "whimsical",
  "category": "diagrams",
  "name": "Whimsical",
  "description": "An online workspace for flowcharts, mind maps, wireframes and diagrams on shared boards, with real-time collaboration, AI generation and desktop apps.",
  "website": "https://whimsical.com",
  "license": null,
  "platforms": [
    "web",
    "windows",
    "macos"
  ],
  "jurisdiction": {
    "code": "US",
    "name": "United States",
    "eyes": "Five Eyes",
    "eu": false,
    "gdpr": false,
    "cloud_act": "provider"
  },
  "pick": false,
  "pick_reason": null,
  "disclosure": null,
  "grade": "F",
  "score": 31,
  "coverage": 100,
  "summary": "Whimsical scores 31 out of 100 (grade F) on the diagrams and whiteboards criteria. It meets 2 of 8 criteria: no ads or data sales and TLS configuration. It partly meets independent audit. It does not meet open source, no trackers or telemetry, transparency report, tells users about requests and security headers. It is based in the United States: Five Eyes member; subject to the US CLOUD Act. Automated tests: SSL Labs grade A and Mozilla HTTP Observatory grade C.",
  "url": "https://privacyratings.com/diagrams/whimsical/",
  "markdown": "https://privacyratings.com/diagrams/whimsical/index.md",
  "answers": {
    "open_source": {
      "title": "Open source",
      "weight": 3,
      "answer": "no",
      "evidence": null,
      "note": "Closed source."
    },
    "no_trackers": {
      "title": "No trackers or telemetry",
      "weight": 3,
      "answer": "no",
      "evidence": "https://whimsical.com/terms/cookie-policy",
      "note": "The website uses Plausible, and the cookie policy lists third-party analytics cookies set through Cloudflare Zaraz in some regions."
    },
    "no_ads": {
      "title": "No ads or data sales",
      "weight": 2,
      "answer": "yes",
      "evidence": "https://whimsical.com/terms/privacy",
      "note": "Funded by subscriptions with no ads, and the privacy notice says personal information is not sold or shared for cross-context advertising."
    },
    "independent_audit": {
      "title": "Independent audit",
      "weight": 2,
      "answer": "partial",
      "evidence": "https://whimsical.com/company/security",
      "note": "Has a SOC 2 Type II report and yearly third-party penetration tests, with the report provided through its trust center rather than published."
    },
    "transparency_report": {
      "title": "Transparency report",
      "weight": 2,
      "answer": "no",
      "evidence": null,
      "note": "No transparency report or government request policy is published."
    },
    "user_notice": {
      "title": "Tells users about requests",
      "weight": 1,
      "answer": "no",
      "evidence": null,
      "note": "No published policy on notifying users about data requests."
    },
    "tls": {
      "title": "TLS configuration",
      "weight": 2,
      "answer": "yes",
      "evidence": "https://www.ssllabs.com/ssltest/analyze.html?d=whimsical.com&hideResults=on",
      "note": "Grade A"
    },
    "security_headers": {
      "title": "Security headers",
      "weight": 1,
      "answer": "no",
      "evidence": "https://developer.mozilla.org/en-US/observatory/analyze?host=whimsical.com",
      "note": "Grade C (50/100+)"
    },
    "web_standards": {
      "title": "Modern web standards",
      "weight": 1,
      "answer": "pending",
      "evidence": null,
      "note": "Not tested yet."
    }
  },
  "tests": {
    "ssllabs": "A",
    "observatory": "C",
    "internetnl_web": null,
    "internetnl_mail": null,
    "trackers": [
      {
        "name": "Plausible",
        "host": "plausible.io",
        "effect": "partial"
      }
    ],
    "tested_at": "2026-10-01T07:28:57.752Z"
  },
  "last_modified": "2026-10-01T07:44:20Z"
}