Privacy

Privacy notice

What Irakasi processes about you, why, who else receives it, and what it stores in your browser. Boards you make in the free editor stay on your device.

Last updated: 14 November 2026

Who is responsible

Creative Land SL runs Irakasi and is responsible for the personal data described here. It is based in Bilbao, Spain, has the tax ID (NIF) B95911863 and is entered in the Registro Mercantil de Bizkaia, Tomo 5752, Folio 196, Sección 8, Hoja BI-71151.

For any question about your data, or to use the rights described below, write to [email protected].

Your boards stay on your device

The free editor saves boards, imported files and preferences in this browser. They are not uploaded or synced to an Irakasi account, and we cannot recover them from our servers. They depend on your browser’s storage controls, so export anything you want to keep.

Technical connections

Every visit sends technical information to the services that run the site: your IP address, your browser and device type, the address you request and the time of the request. Vercel hosts the website, Cloudflare delivers media, documentation and public boards, Clerk checks whether you are signed in, and some editor fonts load from Google Fonts. We need these connections to deliver the site and keep it secure, which is our legitimate interest (GDPR article 6(1)(f)).

External links, embedded media and tools you choose to connect also communicate with their own providers. Their privacy notices apply to their services.

Error reports

When something fails, the app sends an error report to Sentry. It contains the type of error, where in the code it happened, the app version and a few diagnostic counts. Reports leave out board content, account details, messages you typed and attachments, and we do not record sessions. Sentry also receives your IP address with the request. We use the reports to find and fix faults, which is our legitimate interest.

Analytics

Irakasi uses PostHog in the EU to count visits to its public information pages, documentation and editor. For a website visit we send the published page path. For an editor visit we send the same route label for every board. We also count the editor commands you use and the shapes added to a board, by type and by whether you or an AI app added them. Each event also carries the site’s own address (its host name, such as www.irakasi.com), your browser and operating system, the device type, the screen and window size, the browser language and the time zone, and PostHog receives your IP address with the request.

When an AI app works on a board, we also count which board tools it uses, whether each call worked or what kind of error it hit, how long the call took, how the app connected, and the app’s name and version. These counts never include what the app wrote or anything on your boards. When you connect an AI app, we also count each setup step you reach and how long after opening the AI dialog you reached it, never anything you typed.

When you accept, PostHog sets a cookie and stores an identifier in your browser so it can recognize your visits over time. Once accounts are available and you are signed in, we link that identifier to your Irakasi account ID. We never send your email address or your name. The legal basis is your consent (GDPR article 6(1)(a) and article 22.2 of the Spanish LSSI).

If you turn analytics off, Irakasi removes PostHog’s cookie and its copies from your browser. The next time you load the site, Irakasi counts website visits and editor events without cookies and without storing an identifier in your browser. These counts rely on our legitimate interest in knowing how the site and editor are used. If your browser sends Global Privacy Control or Do Not Track, Irakasi sends nothing to PostHog and does not ask.

To understand where visits come from, we send the referring website’s domain and campaign labels from utm_source, utm_medium and utm_campaign when they contain only letters, numbers, dots, underscores or hyphens. We leave out full referring addresses, other query parameters, fragments, advertising click IDs, search terms, private board links, file names and anything you type or draw. We do not record sessions or capture clicks automatically.

In the EU and the EEA, the United Kingdom, Switzerland and Brazil, Irakasi asks on your first visit to a measured page and waits for your choice. Everywhere else analytics are on by default, and you can turn them off at any time.

Performance measurements

When analytics are on, we also measure how quickly pages load, how promptly they respond to interactions and how much their layout shifts. These Web Vitals measurements contain numeric values and the same safe page labels used for visit counts. They exclude page contents and are sent only when you have accepted analytics.

A share of editor sessions with analytics on also sends performance measurements to PostHog. Each one says what you were doing (for example dragging, zooming or playing an animation), how long it took, how smoothly the editor drew its frames, how many shapes the board holds and of which types, the zoom level and how much memory the editor uses. Once per visit it also sends your device class: processor cores, device memory, screen pixel ratio and window size. Measurements never include shape contents, text, names or addresses. They are sent only when you have accepted analytics, never in the cookieless counting described above.

Accounts

Accounts are not open yet. Once they are, Clerk will handle sign-in and keep your email address, and your name if you give one. Irakasi will keep your account ID and the boards, files and settings you save to your account. We need this data to provide the service you signed up for (GDPR article 6(1)(b)). Account boards and files are stored with Cloudflare, and our account database runs with Neon in the EU.

Providers

These providers process data for us.

  • Provider
    Vercel
    What it receives
    Connection data from website visits
    Where
    Worldwide network; company based in the United States
  • Provider
    Cloudflare
    What it receives
    Connection data when it delivers media, documentation and public boards; account boards and files once accounts exist
    Where
    Worldwide network; company based in the United States
  • Provider
    Clerk
    What it receives
    Connection data when it checks sign-in; account details once accounts exist
    Where
    United States
  • Provider
    Sentry
    What it receives
    Error reports and the connection data sent with them
    Where
    United States
  • Provider
    PostHog
    What it receives
    Analytics events and performance measurements, as described above
    Where
    European Union
  • Provider
    Google Fonts
    What it receives
    Connection data when the editor loads some of its fonts
    Where
    Worldwide network; company based in the United States
  • Provider
    Neon
    What it receives
    Account data once accounts exist
    Where
    European Union (Frankfurt)

Transfers outside the EU

Some of these providers are based in the United States or answer requests from servers around the world, so your data can leave the European Economic Area. When it does, the transfer relies on a safeguard the GDPR allows, such as the EU-US Data Privacy Framework or the European Commission’s standard contractual clauses. Write to [email protected] to ask which one applies to a provider.

How long we keep data

Boards and preferences in your browser stay until you delete them or clear this site’s data. Your cookie choice stays until you change it or clear this site’s data.

We keep error reports and analytics events while we need them to fix faults and understand how Irakasi is used, within each provider’s retention period. Once accounts exist, we keep account data while your account is open and delete it when you ask us to, unless the law requires us to keep part of it.

Your rights

You can ask us for a copy of your personal data, to correct it, to delete it, to restrict or object to how we use it, and to receive it in a format you can reuse. Where we rely on your consent, you can withdraw it at any time; that does not affect what we did before. Write to [email protected].

If you are not satisfied with our answer, you can complain to the Spanish Data Protection Agency (AEPD) at aepd.es. We cannot see or recover boards stored only in your browser, so you manage those yourself.

Cookies and browser storage

Irakasi stores the items below in your browser. Essential items make the site and the editor work and need no consent. Analytics items are stored only after you accept analytics.

  • Name
    irakasi_cookie_consent
    Set by
    Irakasi
    Purpose
    Remembers your cookie choice (local storage)
    How long
    Until you change it or clear site data
    Type
    Essential
  • Name
    irakasi_public_locale
    Set by
    Irakasi
    Purpose
    Remembers the language you picked (cookie)
    How long
    1 year
    Type
    Essential
  • Name
    TLDRAW_DOCUMENT_v2…, TLDRAW_DB_NAME_INDEX_v2, IRAKASI_BOARDS_ORDER, IRAKASI_DEFAULT_BOARD_ID_V1
    Set by
    Irakasi
    Purpose
    Your boards, their files and the board list (IndexedDB and local storage)
    How long
    Until you delete the board or clear site data
    Type
    Essential
  • Name
    irakasi-browser-settings, TLDRAW_USER_DATA_v3, irakasi-app-prefs, irakasi-creator-prefs, irakasi-semantic-selection-model-cache
    Set by
    Irakasi
    Purpose
    Editor preferences, custom brushes, panel layout and downloaded editing models (local storage and IndexedDB)
    How long
    Until you clear site data
    Type
    Essential
  • Name
    sidebar:state
    Set by
    Irakasi
    Purpose
    Remembers whether the dashboard sidebar is open (cookie)
    How long
    7 days
    Type
    Essential
  • Name
    Session storage
    Set by
    Irakasi
    Purpose
    Short-lived state for one tab, such as the site menu and the AI connection
    How long
    Until you close the tab
    Type
    Essential
  • Name
    __session
    Set by
    Clerk
    Purpose
    Proves you are signed in (cookie)
    How long
    60 seconds
    Type
    Essential
  • Name
    __client_uat
    Set by
    Clerk
    Purpose
    Tells the site when your sign-in last changed (cookie)
    How long
    Set by Clerk
    Type
    Essential
  • Name
    __client (on clerk.irakasi.com)
    Set by
    Clerk
    Purpose
    Keeps your sign-in session (cookie)
    How long
    As long as your browser allows
    Type
    Essential
  • Name
    ph_<project key>_posthog
    Set by
    PostHog
    Purpose
    Recognizes your browser across visits (cookie, with a copy in local storage)
    How long
    1 year; the local storage copy until you turn analytics off or clear site data
    Type
    Analytics
  • Name
    ph_<project key>_window_id, ph_<project key>_primary_window_exists, ph_<project key>_posthog
    Set by
    PostHog
    Purpose
    Tells the visits and tabs of one browser apart (session storage)
    How long
    Until you close the tab or turn analytics off
    Type
    Analytics
  • Name
    __ph_opt_in_out_<project key>
    Set by
    PostHog
    Purpose
    Remembers for PostHog whether you accepted analytics, so a refusal stays without cookies (local storage)
    How long
    Until you change your choice or clear site data
    Type
    Essential

Changing your cookie choice

Choose Cookies in the footer of any page, or Manage cookies in your dashboard or in the editor menu, and switch analytics on or off. To remove analytics data already stored, clear this site’s data in your browser settings.

If your browser sends Global Privacy Control or Do Not Track, Irakasi treats it as a refusal: it shows no cookie banner and sends nothing to PostHog.