Collaborative canvases that merge by math, not by luck.
Draw, plan, and ship with your team in real time. Every edit survives offline, every concurrent change converges deterministically, every device sees the same state.
No credit card required. Works offline. Free for individuals.
Wait, what is this actually for?
Tilo is a real-time collaborative canvas where every edit is preserved, even when collaborators go offline or work in parallel.
Under the canvas is a CRDT engine that merges concurrent edits mathematically, never by "last writer wins." Two people moving the same shape, drawing on the same area, or editing the same diagram all converge to the same deterministic result on every device.
The canvas you see is one product built on that engine. The engine itself can power any application where concurrent state has to merge without conflicts.
The same engine could power
Shared budgets that can't overdraft
Housemates, teams, or partners editing one budget together, offline, in parallel, across devices. The math guarantees the total never goes negative, even when two people spend the same dollar at the same time.
Multiplayer games that survive bad networks
Turn-based strategy, board games, MMO economies, anywhere two players might race for the same resource. Tilo resolves the race deterministically on every device, so no one needs a referee server in the middle.
Inventory & booking with no double-sells
Two clerks. Two phones. One last seat / one last item / one last meeting room. With Tilo, the engine refuses contradictory state, surfaces the conflict, and every replica agrees on the outcome, without a central lock.
Same Rust core, same convergence guarantees, different domain rules plugged into the resolution layer.
Built like collaboration should be.
Most apps merge by keeping the newest edit and lose concurrent changes. Tilo does the opposite, preserve everything, then make it legal.
Merges by math, not by luck
Hand-written CRDTs, Lamport clocks, LWW-Register, OR-Set, with proven commutative, associative, idempotent merges. Property-tested across thousands of orderings.
A semantic resolution layer
Pure CRDTs converge but can converge to illegal states. Tilo deterministically repairs the merged scene so every replica derives the same valid one, no central referee.
Offline by default
Every client holds its own replica. Edit on the subway; queue ops; reconnect; converge. The server is a relay, not an authority.
One engine, every platform
The Rust core compiles to WebAssembly for the web, links directly into Tauri on desktop, and ships to mobile, same proven code, no duplicate implementations.
Built for scale-to-zero
Stateless sync Lambda in a 2 MB distroless container. DynamoDB single-table design with TTL-reaped tombstones and Streams-based real-time fan-out.
Time-travel history
Every operation is logged in causal order. Scrub the canvas timeline, replay any moment, or fork a canvas from a past state, for free, by design.
Four steps. No central truth.
The server relays operations and durably logs them. Convergence comes from the math, legality from the rules, both deterministic, both replica-local.
Edit locally, instantly.
Every device holds a CRDT replica. Edits apply at native speed and never wait on a server round-trip.
Queue offline. Resume online.
Lose the network mid-edit? Tilo keeps writing locally. When you reconnect, ops drain to the relay automatically.
Merge by math.
Every operation is timestamped with a Lamport dot. Cross-replica merges are commutative, associative, idempotent, provably convergent.
Resolve by rules.
After convergence, the resolution layer enforces your domain rules: one author per element, no contradictory state, no double-sold seats. Same answer on every replica.
Convergence isn't a claim. It's a theorem.
Every CRDT operation in Tilo satisfies three algebraic laws , commutative, associative, idempotent. The test suite hammers them with thousands of randomized orderings to make sure they hold under every concurrency pattern your users could throw at us.
- 12 CRDT unit tests
- 8 000 randomized convergence checks
- Semantic resolution tests (one owner, no negative balance)
- WASM round-trip parity test (JS ↔ Rust converge identically)
- End-to-end Lambda handler test
running 12 tests
test clock::tests::tick_is_monotonic ... ok
test clock::tests::observe_jumps_forward ... ok
test lww::tests::merge_is_commutative ... ok
test orset::tests::concurrent_add_wins ... ok
...
test result: ok. 12 passed
test result: ok. 3 passed // 8 000 random orderings
test result: ok. 3 passed // semantic resolution
test result: ok. 1 passed // end-to-end handler
test result: ok. 1 passed // wasm sync round-tripEditors pay. Viewers always free.
The Figma / Miro model: zero friction for adoption, simple paid tiers for the people who make.
Free
Generous on purpose. Built for adoption.
- Up to 3 active canvases
- Real-time collaboration
- Offline editing
- 30-day version history
Pro
For makers and small teams.
- Unlimited canvases
- Full version history
- Larger canvas size
- Private invite-only canvases
- Priority sync relay
Team
For organisations that ship together.
- Everything in Pro
- Shared workspaces
- Roles and permissions
- Audit log
- Unlimited guest viewers
Built like infrastructure should be.
A short, honest summary of how Tilo protects your data.
Encryption in transit and at rest
All traffic is HTTPS. State is stored in AWS DynamoDB with server-side encryption.
OAuth-first authentication
Sign in with Google or GitHub. Tilo never touches your provider password and the same email across providers resolves to one account.
Per-user scoping enforced server-side
Every canvas API call checks ownership against the authenticated user. APIs are rate-limited per IP and protected by an origin allow-list.
Account deletion removes every canvas, every state snapshot, and the email-index row within 30 days. Read the full Privacy Policy.
Frequently asked.
Does Tilo actually work offline?+
Yes. Every device holds a local CRDT replica. Edits apply at native speed and queue locally if you lose the network. When you reconnect, the math of the CRDT merge guarantees no edits are lost and every replica converges to the same state.
How is this different from Figma or Excalidraw?+
Both Figma and Excalidraw use last-writer-wins merge: concurrent edits to the same element drop one of them silently. Tilo merges by Lamport-ordered CRDT operations, so concurrent edits are deterministically resolved and every replica picks the same winner. No edit is lost.
Where is my data stored?+
Locally in your browser (IndexedDB) for offline use, and in AWS DynamoDB for durable cross-device backup. Both encrypt at rest. We never read your canvas contents.
Can I use my own domain?+
On the Team plan you can map a custom domain to your workspace so your shared canvases live at your-company.tiloapp.tech or your-domain.com.
What about my privacy?+
We do not track browsing outside Tilo, do not sell data, and do not use canvas contents for advertising or model training. Diagnostic logs are auto-deleted after 30 days.
Can I export my work?+
Yes. Every canvas exports to PNG, SVG, or a portable .tldr file that you can re-open anywhere. Your work is always portable.
Open a canvas. Share the link. Watch it converge.
Free forever for individuals. No credit card. The engine is open source, read the math yourself.