Privacy Policy
Last updated: 28 September 2026
Markdown Reader is a Markdown viewer and editor. Document processing runs entirely on your device — in your browser for the web version, or as a desktop application. Markdown Reader has no account system or advertising. The desktop application has no analytics or telemetry. The public web version uses Umami for website visit statistics; it does not receive your documents or document content.
This policy explains what little data is involved and why. It covers both the web version at markdown-reader-editor.netlify.app and the desktop application.
Short version
- Markdown Reader does not collect, store, transmit, sell, or share your documents or their contents.
- The public web version uses Umami to count website visits and page views. Document text and file contents are not included in analytics.
- Markdown Reader itself has no back end. It never uploads, copies, indexes, or phones home with your documents.
- Files you open from your own computer stay on your computer.
- If you connect the desktop app to a remote server (SFTP, FTP/FTPS, WebDAV or SMB), Markdown Reader exchanges your files and login details directly with that server, over the network, at your instruction. Nothing routes through us. See Remote connections below.
- The app stores your preferences (theme, colour, font size, recent session) and any saved server connections locally in your browser or app-data folder. This never leaves your device.
- The web version is hosted by Netlify, which — like any web host — processes basic technical request data (such as your IP address) to deliver the site and keep it secure. Markdown Reader does not receive or use that data.
- The desktop app can check for application updates; doing so contacts GitHub (where the installers are hosted) and sends only your IP address and the app version.
What the app stores on your device
Markdown Reader uses your browser’s local storage (web) or a file in the application-data folder (desktop) to remember:
| Data | Purpose |
|---|---|
| Interface preferences | Theme, primary colour, text size, reading width, font, and similar settings |
| Session | The names and scroll positions of documents you had open, so they can reopen |
| Custom stylesheet | Optional CSS you provide to restyle the reading view |
| Server connections | Desktop only. Connection details for remote servers you add (see below) |
This information stays on your device. It is never transmitted to us or anyone else. You can erase it at any time by clearing your browser’s site data for markdown-reader-editor.netlify.app, or by deleting Markdown Reader’s application-data folder on the desktop.
Your documents
Files you open from your own computer are read directly from your device:
- On the web, through your browser’s file picker or File System Access API. The file’s contents are held in the page’s memory while it is open and are written back only when you choose to save. Nothing is uploaded.
- On the desktop, through the operating system’s file APIs.
Markdown Reader does not copy, upload, index, or transmit these documents anywhere. The one exception is a remote connection that you set up, described next.
Remote connections (desktop only)
The desktop app can open and save Markdown files on a remote server that you choose, using SFTP, FTP, FTPS, WebDAV, or SMB. This feature is off until you add a connection, and the web version does not have it at all.
When you use a remote connection:
- Your files travel between your computer and that server. To open a remote document Markdown Reader downloads it from the server; to save, it uploads it back. Browsing a remote folder lists that folder on the server. This traffic goes directly from the app to the server you configured — it never passes through Markdown Reader’s developer or any other intermediary.
- Your login details are sent to that server to authenticate, as the protocol requires. Plain FTP and non-TLS WebDAV transmit credentials and file contents without encryption; SFTP, FTPS, and HTTPS WebDAV are encrypted in transit, and TLS certificates are verified. Choose an encrypted protocol whenever the server offers one.
- Saved passwords are encrypted at rest using your operating system’s secure
credential store (Keychain on macOS, DPAPI on Windows, libsecret on Linux) via
Electron’s
safeStorage. Only the encrypted form is written to disk, in a file readable only by your user account. Passwords are held in the app’s background process and are never exposed to the document view. - The server operator can see your IP address, the account you log in as, and the files you read or write, under their privacy practices, not Markdown Reader’s.
You can delete a saved connection (and its stored password) at any time from the connection dialog, or by removing Markdown Reader’s application-data folder.
Local API (desktop only)
Markdown Reader can run a small HTTP API on your own machine for automation tools
(for example the md-reader-mcp bridge, or your own scripts). It is off by
default and you turn it on in Preferences ▸ Local API.
- It binds to
127.0.0.1only — it is not reachable from your network or the internet. - Every request must carry a bearer token shown in Preferences. You can regenerate the token at any time.
- While it is on, any program on your computer that has the token can read and write your notes on the servers you have configured, and can add or remove server connections. Treat the token like a password.
- Local folders are never exposed by default. The API reaches only your saved server connections plus any local folder you explicitly tick Share this folder with the Local API / AI for in the Files sidebar. Sharing is per folder, read-only unless you also allow editing, limited to Markdown files inside that folder (no parent paths or symlinks out of it), and clients see a folder id and relative paths, never your file-system paths. Un-ticking it removes access immediately.
- Nothing is sent anywhere by enabling it — it just accepts local requests. What those requests then do (read a note, write a note) is the same file traffic described above, between your machine and your servers.
- The token is stored in Markdown Reader’s application-data folder, readable only by your user account. Turning the API off stops the server immediately.
Remote content
- Remote images referenced by a document (
https://…) are blocked by default. If you choose to load them, your browser will request them directly from the third party hosting them, which may reveal your IP address to that party. This is a per-document choice you control. - Links you click open in your browser as normal.
Third parties
| Service | Role | What they receive | Their policy |
|---|---|---|---|
| Netlify (web hosting) | Serves the static web version | Standard web-server request data (IP address, user agent, requested URL, timestamps) in access logs, for delivery and security | netlify.com/privacy |
| GitHub (release hosting) | Hosts the desktop installers and update metadata the app downloads | The desktop app’s update check and installer downloads send your IP address, user agent, and the file requested | GitHub Privacy Statement |
| Umami (web analytics) | Provides website visit statistics for the public web version | Page URL and browser request data; no document content is intentionally sent | Analytics endpoint: static.vasylautomation.org |
The desktop app’s update check asks GitHub whether a newer version exists and, if so, downloads the installer from there. Markdown Reader itself sends nothing to these services beyond what your operating system does automatically to fetch a file, and receives nothing back except the files it requested.
Servers you connect to over SFTP/FTP/WebDAV/SMB are not Markdown Reader third parties — they are systems you choose and control, and the app talks to them directly. See Remote connections.
The public web version loads an Umami analytics script from static.vasylautomation.org/app.js and sends website visit data to that domain. No filenames, Markdown text, file contents, local file paths, editor input, or document metadata are intentionally sent. Other application assets are served from the site’s own origin.
Legal bases and your rights (EU / UK GDPR)
Markdown Reader’s developer does not receive your documents or document content. Umami provides website visit statistics through the analytics domain above.
- The local storage described above is strictly necessary for the app to function as you expect (remembering your settings). Under the ePrivacy Directive this does not require a consent banner, and under the GDPR the basis would be legitimate interests (Article 6(1)(f)).
- Aggregate website measurement is used to understand traffic and improve the public website. The legal basis is legitimate interests (Article 6(1)(f) GDPR).
- Netlify and the Umami analytics endpoint process technical request data as described above.
- You have the right to lodge a complaint with your local data protection authority.
United States
Markdown Reader does not sell or share personal information for cross-context behavioral advertising. The website analytics described above are used for site measurement, not advertising profiles.
Children
Markdown Reader is not directed to children and does not knowingly collect information from anyone, regardless of age.
Changes to this policy
If this policy changes, the updated version will be published here with a new date. Material changes will be noted in the project’s changelog.
Contact
Questions about this policy or Markdown Reader’s privacy practices:
- Vasyl Madei — https://www.linkedin.com/in/vasyl-madei — vasylmadei@gmail.com