Open a design tool and press export. That is where you find out who owns what you just made. Usually the answer is a watermark, a font that quietly reverts, or a box offering the full-size file for 12 dollars a month.

The toll booth was never the editor. The editor is the demo, and demos are generous. The booth is the export button, the file format and the licence.

HyCanvas removes all 3, then lets you keep it on hardware you own. It is free, open source under the AGPL, with the AI inside the canvas. And what comes out is a deck you can still edit by hand.

Where this is written from

HyCanvas does not run in my lab. It is an outside assessment, labelled read the code, not run. I read the repo, the licence, the notes for v0.3.17, the install docs, the vendor site, its terms page, and the Go file that makes the AI calls. Nothing here is a measurement of mine. Where I quote a command, it is the project’s instruction, not my evening.

What it actually is

One Go binary with the frontend baked in. Postgres is the only hard dependency, S3 storage is optional, ffmpeg is needed for video export. It runs itself as a service, so you need neither Node nor a container.

The repo is hyscaler/HyCanvas. Created 2026-06-21, it sat at 234 stars with 1 open issue the day I read it. Release v0.3.17 landed on 2026-10-15, about 36 MB per platform, with a SHA256SUMS.txt beside it. So it is 4 months old and not a launch-week shell: decks with a slide master, video with a timeline, whiteboards, docs, sheets.

The file is the part that matters. Any document downloads as a .hyc, readable JSON by design, and imports on any instance. That is the gap between a tool you use and a tool you are kept by.

The licence moved in the right direction

The licence decides the rest. From v0.3.17 the code is AGPL-3.0-only. v0.3.16 and every release before it shipped under the Elastic Licence 2.0.

Read that in the direction it went. The usual story is a project starting open and closing when the money arrives. This one started source-available with restrictions and moved to full copyleft, 5 days before I sat down to write this.

The AGPL closes the hosting loophole. Host a modified copy for other people and you owe them the source. That duty points at the vendor too. Whatever HyScaler does with the hosted product next, the code stays put.

Caveats, then. Contributions need a contributor agreement, and a paid licence lifts the AGPL terms, so the company can still sell what you get for free. The name and logo are trademarked, so a fork needs a new one. None of that undoes the move. It means the move was a decision, not a conversion.

The install, as the project writes it

Prebuilt, it is 2 lines:

tar -xzf hycanvas_v0.3.17_linux_amd64.tar.gz
./hycanvas service start

That start asks a question: browser wizard or terminal? Either collects Postgres, storage and optional SMTP, writes .env, makes the JWT_SECRET, runs migrations and comes up. Behind a proxy the wizard sets PORT, BIND_HOST and APP_URL. One trap: nginx’s 1 MB default rejects uploads with a 413, so raise client_max_body_size to 16 MB for the 8 MiB chunks.

The container route is docker compose up -d, once JWT_SECRET and APP_PORT are set and DATABASE_URL points at one that answers.

Where the AI actually points

Here is the part the marketing compresses and the source explains.

The AI is bring-your-own-key: 13 presets including OpenAI, Anthropic, Azure, Bedrock and DeepSeek, plus a custom entry. Keys are encrypted, and scoped to a workspace. One env var matters: AI_SECRET encrypts those keys and uses JWT_SECRET if it is unset, so a weak secret is also the lock on your model keys.

Then there is a Go function called isSafeBaseURL, the best stretch of code in the repo. A custom provider URL must be https. It is refused if the host is loopback, link-local, a private range, or a .local name. Plain http is allowed only for localhost, and only with a dev flag on.

So the neat story about pointing the AI at the model box in your basement does not survive the source. Point it anywhere, as long as the thing answers on a public name with a certificate. The guard stops the server being talked into reaching its own network, which is right for something a team shares. Your own endpoint has to be proxied, not on the LAN.

Every instance also answers MCP at /mcp, with scoped keys and a 90-day audit. An agent can post a prompt to /api/v1/generate/presentation and get a real document, not a picture of one. You open it and move the boxes. That sequence, machine-made, hand-fixed, audited, is what Canva’s AI cannot give you and Genspark has no reason to.

What the money is actually for

The site’s line is “No credit card. No trial that expires. Every feature included from day one.” The terms say paid plans “price hosting capacity and support only, never features”. If the service is ever shut down, 90 days’ notice and an export path.

The terms are readable, which is not the same as generous. Hosted prices appear at purchase rather than in public, so you cannot compare them. And the service is defined as hycanvas.art while the site selling it is hycanvas.com, which tells you the company side is young.

The liability cap is the greater of what you paid in 12 months or INR 5,000, under Indian law. Read it before client brand work goes near a paid one.

What none of that changes: self-hosting costs nothing and always will, because it is code you keep, not a tier that can be withdrawn.

The case against

The project keeps its own list of what it cannot do, in docs/FEATURES.md, more honest than most vendor roadmaps. Read it before promising a replacement.

Print is the browser’s print dialog at print resolution. I found no CMYK path and no bleed handling, so this is not what you send to a press.

Fonts upload and the mechanics work. The licence does not travel with them. On your own instance you are the one who has to be right about what you embedded.

Co-editing is real: Yjs CRDT, presence, locks, offline edits that merge on reconnect. Pending is the work at scale, per-page subdocuments and branches inside the CRDT. And one binary plus Postgres holds until a second instance, when Redis arrives. Growth changes the diagram.

PPTX round-trips, with charts and SmartArt landing as placeholders and animations flattened. It opens my deck, and it opens it exactly, are different claims.

Mobile is the honest gap. It is web-only, there is no app, and a canvas with a properties panel is not a phone experience. Judgement, not measurement.

What actually changes

The canvas was the last holdout in my working life. Notes, mail, photos, code and the language model all have a self-hostable equivalent. The lock-in here was never the editor. It was the file, the fonts and the export button, in that order. HyCanvas moves all 3, then hands you the server.

Making a deck from a prompt is turning into a commodity. Within a year or 2 every editor will do it, so the difference stops being the model and becomes who holds the file and the licence. A company that relicences to AGPL 5 days before its release notes is out has worked that out.

So the question about any design tool is not how good its AI is. It is what you would still have if the company closed on Friday. With a rented canvas you have a login page and a support address. With this you have a binary, a database dump and a folder of JSON that any instance can open.

The source, the licence and the release notes are at https://github.com/hyscaler/HyCanvas.