Xcalidraw - Privacy Policy

Last Updated: 4 August 2026
Effective Date: 4 August 2026

Our Commitment to Your Privacy

Xcalidraw is a drawing app. What you draw is yours, and we’ve built the app so that it stays that way. This Privacy Policy explains what data the app handles, what leaves your device, and the choices you have.

The short version: Your canvases are stored on your device, and, if you have Pro and iCloud enabled, in your own personal iCloud account. There are no accounts and no login. We never see the contents of your drawings. We do measure which features get used, through Firebase Analytics, so we know what to build next. We don’t sell data, we don’t run ads, and none of this is used to track you across other apps or websites.

1. Information We Collect

1.1 What You Create

Canvases live in the app’s own storage, not as loose files in the Files app. .excalidraw is an interchange format Xcalidraw imports from and exports to, not the format your library is kept in. Either way, nothing here leaves your device except through iCloud sync or an export you ask for.

We do not receive, store, or have any way to read the contents of your canvases. They are never uploaded to our servers, because we do not operate a canvas server. Drawing, importing, exporting, and Mermaid import all run entirely on your device. The app works fully offline.

1.2 Usage Analytics

Xcalidraw uses Firebase Analytics, a Google service, to understand which features people actually use. For example, whether someone finishes the welcome tour, imports an .excalidraw file, or opens the Mermaid import or export tools. This tells us what to build next and where people get stuck. It does not identify you.

What is collected:

• App usage events: which screens and features are used, and whether common flows (importing a file, exporting a canvas, upgrading to Pro) complete or are abandoned.
• A device-generated analytics identifier, created and managed by Firebase, used only to tell one installation’s activity apart from another’s inside our own dashboards.

What is not collected through analytics:

• Your name, email, or account information. Xcalidraw has no account system.
• The contents of your canvases, files, or drawings. Not the elements, not the text, not the file names.
• Your Apple advertising identifier (IDFA). We do not link analytics to advertising, do not build ad profiles, and do not share this data with ad networks or data brokers.
• Prices or payment details. Analytics records only whether an upgrade attempt succeeded, was cancelled, was deferred (Ask to Buy), or failed. Never a price, currency, or payment method.

Because none of this links your activity to other companies’ apps or websites, it does not meet Apple’s definition of tracking, and iOS does not show you a tracking permission prompt for it.

1.3 Purchases

Pro is a one-time purchase handled by Apple’s App Store, with subscription and entitlement bookkeeping through RevenueCat. RevenueCat receives an anonymous identifier generated by the app (a random UUID, not derived from any Apple ID or device identifier) together with your purchase and entitlement status. It does not receive your name, email, or payment details. Apple handles the payment and never passes those to us.

1.4 Information We Do NOT Collect

• Personal identification (name, email address, phone number)
• Account credentials, because there are no accounts
• The contents of your drawings
• Location data
• Contacts or address book
• Health or fitness data
• Photos, beyond images you explicitly place on a canvas (which stay in that canvas, on your device)
• Browsing history
• Advertising identifiers

2. How We Use Your Information

2.1 To Provide the Service

• Storing your work: canvases are written to your device, and synced to your own iCloud account if you have Pro and iCloud enabled
• Unlocking Pro: verifying your one-time purchase and restoring it on your other devices and for Family Sharing members

2.2 To Improve the App

• Usage analytics: understanding which features are used and where flows break down, so we know what to fix and what to build
• Crash reporting: Apple’s standard crash and performance reports, delivered through App Store Connect

2.3 Legal Basis for Processing (GDPR)

If you are in the European Economic Area (EEA), our legal bases are:

• Contractual Necessity: processing needed to provide the app and your purchase
• Legitimate Interests: understanding and improving how the app is used, and keeping it secure

3. How Your Data Is Stored

3.1 Local-First Architecture

Xcalidraw is local-first:

1. Every canvas is stored on your device, in the app’s own storage, autosaved as you draw
2. The app works fully offline. No feature requires a network connection to draw, import, or export
3. We operate no server that holds your content, so there is nothing of yours for us to lose or hand over

3.2 iCloud Synchronisation (Pro)

If you have Pro and iCloud enabled:

• Your library syncs across your Apple devices and survives deleting and reinstalling the app
• Files are stored in your private iCloud account, controlled by Apple. We cannot access it
• The container is deliberately kept out of the Files app, so your library stays in the app rather than scattered across a file browser. This is a presentation choice and does not affect sync
• Apple’s privacy practices apply. See Apple’s Privacy Policy

Without Pro, or with iCloud disabled, your files stay on that one device only.

3.3 Analytics Data

Firebase Analytics data is processed by Google under its own Firebase data processing terms. It is retained according to Google’s retention settings for our project. We do not sell it and do not use it for anything beyond understanding and improving the app.

4. Third-Party Services

4.1 Apple iCloud

• Purpose: syncing your library across your devices (Pro)
• Data shared: your canvas files, stored in YOUR iCloud account
• Privacy Policy: apple.com/privacy

4.2 Google Firebase Analytics

• Purpose: measuring feature usage and where flows are abandoned
• Data shared: app usage events and a device-generated analytics identifier. No IDFA, no canvas contents, no personal identifiers
• Privacy Policy: policies.google.com/privacy

4.3 RevenueCat

• Purpose: managing the one-time Pro purchase, restores, and Family Sharing
• Data shared: an anonymous app-generated identifier, purchase and entitlement status
• Privacy Policy: revenuecat.com/privacy

4.4 Apple App Store

• Purpose: app distribution, payment, standard analytics and crash reports
• Data shared: standard App Store analytics (downloads, crashes, usage statistics)
• Privacy Policy: apple.com/privacy

There are no other third-party SDKs in the app that collect data.

5. Data Retention

5.1 Your Canvases

Your files remain on your device, and in your iCloud account if sync is on, until you delete them. We do not control or have visibility into that retention, and we cannot delete your files for you.

5.2 Analytics

Analytics events are retained by Google under our Firebase project’s retention configuration. They contain no personal identifiers and no canvas content.

5.3 Purchases

RevenueCat and Apple retain purchase records as required for billing, restores, and legal purposes.

6. Your Rights and Choices

6.1 Take Your Data With You, Free

Settings → Export All Data gives you a zip of every canvas as an ordinary .excalidraw file. It is available on the free tier, it always will be, and it does not require Pro. Those files open in Excalidraw and anything else that reads the format.

6.2 Delete Your Data

• In-app: delete individual canvases from the library
• iCloud: turn off iCloud sync for Xcalidraw in iOS Settings → [Your Name] → iCloud, or delete the app’s iCloud data there
• Uninstall: deleting the app removes all local data

6.3 Purchases

Pro is a one-time purchase, so there is nothing to cancel. Purchase history and refunds are managed in your Apple ID account settings.

6.4 Rights for EEA Residents (GDPR)

If you are in the European Economic Area, you have the right to access, rectification, erasure, portability, objection, restriction of processing, and to withdraw consent where processing is based on consent.

Because your canvases never reach us, most of these rights you can exercise directly and immediately in the app. Export All Data covers portability, and deleting a file or the app covers erasure. For anything concerning analytics or purchase records, contact us at [email protected].

6.5 Rights for California Residents (CCPA)

If you are a California resident, you have the right to know what personal information is collected and how it is used, to delete it, and to not be discriminated against for exercising those rights.

We do not sell personal information. We do not share personal information for cross-context behavioural advertising.

To exercise these rights, contact us at [email protected].

7. Data Security

7.1 Security Measures

• Encryption in transit: all network traffic (analytics, purchase verification, iCloud) uses HTTPS/TLS
• Minimal transmission: the app sends no canvas content anywhere, so there is very little to protect in the first place
• No content servers: we operate no service that stores your drawings

7.2 Device Security

Your local data is only as safe as your device:

• Use a strong device passcode
• Enable Face ID or Touch ID
• Keep iOS and iPadOS updated
• Enable two-factor authentication on your Apple Account

7.3 Limitations

No system is completely secure. We cannot guarantee absolute security of data transmitted over the internet.

8. Children’s Privacy

Xcalidraw is intended for users 13 years of age and older. We do not knowingly collect personal information from children under 13. Since there are no accounts and no personal identifiers, the risk is minimal, but if you are a parent or guardian with a concern, please contact us.

9. International Data Transfers

Analytics and purchase data may be processed by servers in the United States or other countries where Google, RevenueCat, and Apple operate. For transfers from the EEA, UK, or Switzerland we rely on standard contractual clauses, adequacy decisions where applicable, and our providers’ own compliance programmes.

iCloud data is handled by Apple according to your account settings and their policies.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes we will update the “Last Updated” date, and may notify you in the app. Continued use after changes take effect constitutes acceptance.

11. Contact Us

Questions, concerns, or requests about this policy or our data practices:

Email: [email protected]

You can also reach this address from Settings → About and Feedback in the app. We aim to respond within 30 days.

12. Summary of Data Practices

13. App Store Privacy Labels

In accordance with Apple’s App Store requirements:

Data Not Linked to You

• Identifiers: a device-generated analytics identifier
• Usage Data: product interaction events

Data Not Collected

• Contact Info
• Health & Fitness
• Financial Info
• Location
• Contacts
• User Content. Your canvases stay on your device and in your own iCloud, and we never receive them
• Browsing History
• Search History
• Sensitive Info

Data Used to Track You

• None. No IDFA is collected, no ad personalisation is enabled, and no data is linked across other companies’ apps or websites.

Your drawings are yours. If you have any questions, please don’t hesitate to reach out.