stable Floorgen · Data Security

Free Floor Plan Software and Privacy: What 5 Apps Collect While You Draw

Data graphic: a cream editorial cover headed "Who watches while you draw?" with a huge green 24, the number of third-party domains on RoomSketcher's home page at first visit, the most in the test. Smaller figures give the home-page domain counts for Planner 5D 17 , Sweet Home 3D 9 and Floorplanner 5 .
EV

Data security correspondent · Published Oct 16, 2026, 9:00 AM EDT

We loaded Planner 5D, RoomSketcher, Sweet Home 3D, Floorplanner and FloorGen in a clean browser, counted third-party domains and read each privacy policy.

The free floor plan tools that keep your plans away from the vendor are the ones that don't need an account: Sweet Home 3D's desktop app saves plans as files on your own computer, and FloorGen keeps a guest's plans in the browser. Planner 5D and RoomSketcher reach furthest: both want an account before you draw, and on a first visit in our test Planner 5D's home page loaded tags from four advertising companies and RoomSketcher's from six. None of the five websites we tested is silent, FloorGen's included.

We checked five tools people search for when they want to draw a home without paying: Planner 5D, RoomSketcher, Sweet Home 3D, Floorplanner and FloorGen. For each we asked four questions. Do you need an account to draw? Where does the plan live? What does the privacy policy say is collected and shared? And what actually loads in your browser before you've clicked anything?

How we measured it

On 10 October 2026 we loaded each tool's home page and its drawing page in Playwright 1.63.0 with headless Chromium 153. Every page got a fresh browser profile with no cookies. We clicked nothing, so no cookie banner was accepted or rejected, and we recorded every network request for 15 seconds after the page finished loading. Then we counted the distinct third-party domains, meaning any registrable domain that isn't the vendor's own. We ran the whole set three times and got the same counts every time.

Two caveats. The test ran from a connection in India, so Google's regional google.co.in domain showed up; we counted it as google.com. And cookie banners behave differently by country, so a visitor in the EU may see fewer requests before consenting. We kept the scripts and the raw request logs.

ToolAccount to draw?Where plans liveThird-party domains, home pageThird-party domains, drawing pageAd tags seen
RoomSketcherYesVendor cloud2414 (sign-in page)6
Planner 5DYes (web)Vendor cloud1718 (sign-up page)4
Sweet Home 3DNo (desktop)Your files; online version on its server912 (online editor)2
FloorplannerTo saveVendor cloud55 (demo editor)0
FloorGenNoYour browser; cloud if signed in11 (editor)0

"Ad tags" counts the advertising companies whose tracking tags loaded on any page we tested: Google Ads, Meta, Microsoft Advertising, Pinterest, LinkedIn, Reddit and TikTok.

Data graphic: horizontal bar chart headed "None of the five websites we tested is silent", showing distinct third-party domains loaded on each tool's home page at first visit: RoomSketcher 24 highlighted , Planner 5D 17, Sweet Home 3D 9, Floorplanner 5 and FloorGen 1, from a 10 October 2026 test run from India in a fresh headless Chromium.

Distinct third-party domains on each home page in a fresh browser with no cookie banner answered. Playwright, headless Chromium, run from India, three identical runs, 10 October 2026. Counts may differ by region and consent choices.

Planner 5D: sign up first

Opening planner5d.com/editor in a fresh browser didn't open an editor. It redirected to a page reading "Sign up below to unlock the full potential of Planner 5D," with Google, Apple and email buttons and no option to skip. That sign-up page alone pulled in 18 third-party domains, including tags from Google Ads, Meta, Microsoft Advertising and Pinterest, plus Intercom's chat widget and Customer.io.

The privacy policy, last modified 14 November 2024, is upfront about the ads: "we may permit advertisers and their agents to use cookies or related technologies within the websites and Services to store information on or read information from your browser or device, so that they can optimize their advertising campaigns." It also covers your designs: "Following anonymization of any Personal Data in the User Contributions, we may use such content to improve our Services, including to train our AI algorithms."

Keeping a copy is possible on the free plan. Planner 5D's help center says "Export to PDF is available to Free, Premium, and PRO users." Export to CAD is listed under the Professional plan.

RoomSketcher: the most third parties

RoomSketcher's home page loaded 24 third-party domains, the most in our test. Ad tags came from Google Ads, Meta, Microsoft Advertising, LinkedIn, Reddit and TikTok, plus scripts from the analytics services Microsoft Clarity and Crazy Egg. The policy, revised 26 November 2025, says: "RoomSketcher use third-party advertising companies to serve ads when you visit and use the RoomSketcher Services." It classes your IP address and browsing data as "non-personal information" that "is not personally identifiable."

Drawing happens in RoomSketcher's app for Windows, Mac, iPad and Android tablets, and its help center says "All projects begin in RoomSketcher's Web Portal in your browser," starting with signing in. Plans sync to the vendor: "All your projects are saved in the cloud." The free plan allows "Up to two projects," and getting your drawing out costs extra: "generating 2D and 3D Floor Plans requires an in-app purchase before you can print or download them." RoomSketcher's paid tiers are laid out on FloorGen's page about how it fares compared with RoomSketcher.

Sweet Home 3D: the private option is the old-fashioned one

Sweet Home 3D is open source under the GNU GPL and runs offline on Windows, macOS and Linux. Its user guide tells you to save "by clicking on the Save home button," and the result is a file you own. No account is involved. The policy notes that its iOS and macOS versions include Firebase Analytics for "anonymous app usage statistics and crash reports."

The website is a different story. The policy says the company "doesn't collect private data on sweethome3d.com web site, except for users registered in the forum," and "doesn't show any advertising." Its online editor's cookie banner, though, says "selected third parties (11)" use cookies, "with your consent," for purposes including "marketing (personalized ads)." Before we answered that banner, the page had loaded Google Analytics, Firebase and advertising tags from Google and Microsoft, and asked api.ipify.org for our IP address. The online version saves only for registered users. Open its blank "Empty home" without registering and it warns: "Keep in mind that your design won't be saved!"

Floorplanner: few trackers, watermarked exports

Floorplanner's demo editor opened without an account and loaded five third-party domains. They were Amazon Web Services, Google's font servers, the jsDelivr CDN and Bugsnag error reporting, with no ad tags. Its privacy policy is short: "We do not sell your personal data to third parties or use it for third-party commercial messages."

Saving is a different matter. The pricing page says you can make "up to 5 free projects and keep them at no cost in your account," and free projects "can only export SD-quality images with a watermark," which it defines as 960 by 540 pixels.

FloorGen: one third-party domain, but not silent

FloorGen's editor opened with no sign-up, which makes FloorGen the only free Planner 5D alternative in this test that lets you draw and keep a plan in the browser without an account. FloorGen runs two analytics tools, and its policy says neither sets cookies. The one third-party domain on both pages was the second of them, Cloudflare's Web Analytics beacon. The main one, a self-hosted copy of Rybbit, loads through floorgen.app itself, so a domain count doesn't catch it. The policy says: "We do not use advertising trackers, social-media pixels, or third-party fonts."

Guests still report in, and the policy says so. When the app opens, and again when the tab returns after 15 minutes, the browser sends a random guest ID, the device type, the browser's language and, for each project, its name, dates, counts of floors, rooms, walls and items, and its floor area. The plan itself isn't sent. The server keeps a one-way hash of your network address alongside, and guest records are kept "until you ask us to delete them."

As of 10 October 2026, FloorGen's live analytics configuration had session replay switched on, which its privacy policy doesn't describe. On each of our FloorGen visits that day, the analytics script fetched a session-replay module and posted recordings of the page, about 350 KB in the first 20 seconds in the editor. Those recordings contained the page's text, including the open project's name and its floor area. They went to FloorGen's own analytics server, not to a third party. FloorGen's privacy policy says its analytics "never receives your projects or their names," and its design notes say session replay is off.

If you use FloorGen as a browser room planner without signing in, the plans themselves stay in your browser's IndexedDB. Clearing site data deletes them, so export a .floorgen.json backup. All exports are free: PNG, PDF, SVG, DXF, glTF and CSV among them.

Where FloorGen falls short

  • Session replay. As of 10 October 2026, FloorGen's analytics recorded sessions that included project names and floor areas, though its privacy policy says the analytics never receives project names.
  • No offline file by default. Sweet Home 3D gives you a file you own from the first save. FloorGen keeps plans in browser storage, and folder sync, which writes them to disk, works only in Chrome and Edge.
  • Google-only sign-in. Syncing across devices means a Google account, and the sign-in button loads from Google.
  • No self-serve account deletion. The policy says you ask through the contact page.
  • Hosted and closed. It isn't open source and can't be self-hosted. It has no DWG or IFC export.

What to do if you care

Draw in the tool that matches your threat model. If you don't want any vendor to hold your plan, Sweet Home 3D's desktop app saves it to your own disk, though its policy says the iOS and macOS versions send anonymous usage statistics to Firebase. If you use a web tool, keep your street address out of project names, since a web tool that stores your plans sees them, and FloorGen's guest ping reports them even without an account. Export a copy in an open format before you rely on any of them.

Disclosure: FloorGen is built by ThreatFrontier's publisher. FloorGen details were checked against its code and live site in October 2026.

Sources

Keep reading

All latest →
  1. stableResearchFloorGen Review: A Free Floor Plan Maker With No Sign-Up and an MCP Server7 min
  2. criticalExploitsBeyondTrust Remote Support Zero-Day CVE-2026-102764 Exploited Since August6 min
  3. highResearchPEERSTITCH: A Memory-Only FortiGate Implant Built on the 2024 FortiManager Breach8 min
  4. highExploitsFortinet FortiSIEM 7.5.0 Path Traversal (CVE-2026-106173) Allows Unauthenticated Code Execution4 min
  5. highExploitsJuniper's October Junos Bulletin Has 15 CVSS 9.8 Flaws, Including Four Unauthenticated J-Web Bugs6 min
  6. highExploitsFortiSandbox auth bypass CVE-2026-107656: Fortinet rates it 9.6, patch 5.0 and 4.44 min