Canva

Is Canva safe?

For most people, yes. Canva is a design tool rather than a social network, so the risks that dominate apps like TikTok or Discord, strangers and harmful posts, barely apply. We score it 58/100, one point above Spotify (57) and well ahead of LinkedIn (48).

Two things hold it back. Canva lost data on 137 million accounts in 2019, one of the larger breaches of a consumer app. And its business now runs on advertising data and AI: the app tracks you for ads, and the privacy policy lets Canva train its AI on what you make, within limits you set in your privacy settings.

The 2019 breach of 137 million accounts

On 24 May 2019 an attacker got into Canva's systems and took data on 137,272,116 accounts, according to the breach record kept by Have I Been Pwned. The data included email addresses, usernames, names and cities of residence.

Passwords were in the haul too, but stored as bcrypt hashes, a method designed to be slow to crack. People who logged in with Google or Facebook had no Canva password to lose. That limits the damage, but anyone who used a weak password, or used the same one elsewhere, should treat it as exposed.

Canva has since added proper login protection. You can require a six-digit code from an authenticator app at every login, with backup codes in case you lose your phone, and Canva runs a public bug bounty on Bugcrowd that pays outside researchers to report flaws. We found no further breach of Canva accounts since 2019.

Does Canva train AI on your designs?

It can, and the setting that controls it is worth checking. The privacy policy, last updated in August 2026, says Canva may analyse "your activity, content, media uploads and related data" to train "our algorithms, models and AI products and services". Canva also stores some of this as Memories, which personalise its AI features.

You get two controls: a privacy controls page where you manage the use of your data for AI training, and AI personalisation settings where you can view and manage Memories. We could not confirm from Canva's own pages whether the training switch starts on or off for Free and Pro accounts, and outside reports disagree, so check it yourself. Canva Education is treated differently: the policy says Canva will not use Education users' content for AI training.

For a freelancer working on client logos or a company's unreleased campaign, that setting matters more than anything else on this page.

What Canva shares with advertisers

Apple's privacy label for Canva has a "Data Used to Track You" section listing identifiers. For third-party advertising it lists your name, email address, search history, coarse location, user and device IDs and how you use the app.

The privacy policy explains how. Canva works with ad companies including Facebook, Google, LiveRamp, Outbrain, Taboola and AppsFlyer, and may share your email address, location, cookie data and usage with them so they can match you against their own records and show you Canva ads elsewhere, even on Samsung TVs. It shares data with Facebook and TikTok to find "lookalike" people who resemble existing users. It can also buy information about you from data providers, such as your job title, employer and seniority.

Canva says it does not sell or rent your data to these partners for their own marketing. The Education product carries none of this: no ads are served to students.

Sharing and children

Most mistakes on Canva are self-inflicted. A design set to "Anyone with the link" can be opened by anyone who has the URL, without a Canva account, and they can see the names and avatars of the people working on it. In a team, the owner can see what you share and reassign your designs. Keep anything confidential, such as payslips, ID scans or client drafts, on "Only you can access" or a named list of people.

Canva's main service is not for children, and they may not sign up on their own. Schools can invite pupils to Canva Education, where the school gives consent for the data, and Canva lists the service providers that handle it. A child using a parent's account gets the adult product, with its ad tracking and AI training settings.

How to use Canva safely

1. Open your privacy settings and decide on the AI training options before you upload client work.
2. Turn on login codes from an authenticator app and store the backup codes.
3. If you had an account in 2019, change any other password that matched your old Canva one.
4. Opt out of LiveRamp email matching and of outside data about your job if you do not want ad targeting.
5. Check the sharing setting on anything sensitive; avoid "Anyone with the link".

How we scored it

Regulatory record (88) is Canva's strongest factor: we found no privacy fine or order. Scams and harmful content (75) reflects a tool with little stranger contact and a separate, ad-free product for schools. Privacy (40) is the weakest, because the app tracks users across other companies' apps and shares contact details with ad partners for matching, and security (56) reflects the 137 million-account breach, softened by bcrypt hashing and today's authenticator-app login.