# tldraw privacy rating

A collaborative infinite-canvas whiteboard for sketching and diagramming in the browser, with optional accounts for saving and sharing files. It is built on the tldraw SDK, which developers can embed in their own apps.

## Summary

tldraw scores 29 out of 100 (grade F) on the diagrams and whiteboards criteria. It meets 1 of 7 criteria: open source. It partly meets no ads or data sales. It does not meet no trackers or telemetry, independent audit, transparency report, tells users about requests and security headers. It is based in the United States: Five Eyes member; subject to the US CLOUD Act. Automated tests: Mozilla HTTP Observatory grade C+.

- Website: https://www.tldraw.com
- Source code: https://github.com/tldraw/tldraw
- Jurisdiction: United States. Five Eyes member. Subject to the US CLOUD Act.
- Platforms: Web
- Home page trackers: none found
- Category: [Diagrams and whiteboards](https://privacyratings.com/diagrams/)
- Grade: F (29/100)

## Criteria

| Criterion | Answer | Note | Evidence |
| --- | --- | --- | --- |
| Open source | Yes | All code is public, including the tldraw.com app, under the source-available tldraw license, which is not OSI-approved and requires a paid license key for production use. | https://github.com/tldraw/tldraw/blob/main/LICENSE.md |
| No trackers or telemetry | No | tldraw.com loads Google Analytics and PostHog after cookie consent, runs PostHog in cookieless mode when consent is declined, and sends error reports to Sentry. | https://github.com/tldraw/tldraw/blob/main/apps/dotcom/client/src/utils/analytics.tsx |
| No ads or data sales | Partial | No ads in the app, but the privacy policy says data may be shared with advertising partners for interest-based advertising. | https://www.tldraw.com/privacy.html |
| Independent audit | No | No independent audit is published. |  |
| Transparency report | No | No transparency report or government request policy is published. |  |
| Tells users about requests | No | No published policy on notifying users about data requests. |  |
| TLS configuration | Not tested yet | Not tested yet. |  |
| Security headers | No | Grade C+ (60/100+) | https://developer.mozilla.org/en-US/observatory/analyze?host=www.tldraw.com |
| Modern web standards | Not tested yet | Not tested yet. |  |

Source: https://privacyratings.com/diagrams/tldraw/
Edit: https://github.com/privacyratings/privacyratings.com/edit/main/ratings/diagrams/tldraw.md