Privacy Policy
Effective date: 20 August 2026
Overview
Open Markdown is a desktop application that runs on your device. We operate no servers and receive no data about you or your documents — none, ever. There is no account to create with us, no analytics, and no telemetry.
Apart from fetching web-hosted images that a document itself embeds (see “Your documents” below), the app has one optional feature that uses the network: synchronising a local Markdown file to a Google Doc. It is off until you sign in, and when you do, the app talks directly to Google — never to us. This policy explains exactly what that involves.
What we collect
Nothing. Specifically:
- No personal information is sent to us
- No analytics, telemetry, crash reporting, or usage statistics
- No cookies or tracking technologies
- No user accounts or registration with us
- No advertising networks or data brokers
Your documents
Markdown files are read, rendered, and edited entirely on your device. File contents are never transmitted to us or to any third party — with the single exception of documents you explicitly choose to sync to your own Google account, described below.
With the Google integration unused, the app makes no network requests of its own and works fully offline — with one exception: if a document you open embeds an image hosted on the web, the app fetches that image from its host in order to display it. The host sees an ordinary image request from your device, including your IP address. These requests go straight from your device to the image’s host; we are not involved and never see them. Documents that use only local images render entirely offline.
Google Docs synchronisation (optional)
If you choose to sign in with Google, the app connects to Google’s APIs on your behalf using OAuth 2.0. We never see your Google password — sign-in happens in your browser, on Google’s own pages.
To link a file, you choose the target document in Google’s own file picker, which runs on Google’s pages and not inside the app. Picking a document is what grants the app access to it, one document at a time. The app never sees the rest of your Drive, and cannot browse or search it.
What the app is permitted to do
drive.file— Google’s consent screen words this as “See, edit, create and delete only the specific Google Drive files you use with this app”. Those files are the document you choose in Google’s own file picker, and the images the app uploads for that document. Nothing else in your Drive is reachable. The app uses three of those four permissions: it reads and edits the linked document, and creates image files for it. It never deletes anything from your Drive.email— read your account’s email address, shown in the app so you can see which account is connected.
The app deliberately does not request documents, the broader scope worded “See, edit, create and delete all your Google Docs documents”. The verbs are identical; what differs is the reach. drive.file extends only to files you hand over, one at a time, so the app cannot open a document you have not picked — even if it knows that document’s address.
What is sent, and to whom
When you sync a file, its contents — text, formatting, tables, and images — are sent to Google’s servers only, and written into the Google Doc you linked. The data goes from your device to Google directly. It does not pass through any system of ours, because we do not have one.
Images are made publicly readable — please read this
The Google Docs API can only embed an image that it is able to fetch. To satisfy this, images in a synced document are uploaded to your Google Drive and their sharing setting is set to “anyone with the link can view”.
This means anyone who obtains the image’s Drive link can view that image without signing in. The links are long and unguessable, and the images are not listed publicly or indexed by search engines — but they are not private. Do not sync documents containing images you need to keep confidential.
You can inspect and change these files at any time in your Google Drive, or delete them.
What is stored on your device
- Access and refresh tokens, encrypted at rest using your operating system’s secure storage (the Keychain on macOS), so the app can keep syncing without asking you to sign in repeatedly.
- Your account email address, to display which account is connected.
- A link record and a content baseline for each synced file, so the app can work out what changed and update only that.
All of this stays in the app’s local data folder on your machine.
Withdrawing access and deleting your data
You can disconnect at any time:
- Sign out in the app — this deletes the stored tokens from your device.
- Revoke access entirely at your Google Account permissions page.
- Delete any documents or uploaded images from your Google Drive, which is under your control at all times.
Because we hold no data about you, there is nothing for us to delete and no request you need to send us.
Limited Use
Open Markdown’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Data obtained from Google APIs is used solely to provide the synchronisation feature you asked for. It is never sold, never transferred to third parties, never used for advertising, and never read by humans.
App Store distribution
If you install the app through the Mac App Store or TestFlight, Apple collects diagnostics and usage data under Apple’s own privacy policy and your device settings. If you have opted in to sharing analytics with developers, Apple makes aggregated crash reports available to us. That is the only route by which any data about your use of the app can reach us, and it is controlled entirely by your Apple settings, not by the app.
Other third-party services
Links you click in a document open in your default browser. The app also offers a “view in mermaid.live” action that opens a diagram editor in your browser; the diagram is encoded in the link. These sites are operated by others and have their own privacy policies.
Aside from these, Google when you use synchronisation, and the hosts of web images embedded in your own documents, the app contacts no external service.
Verifying this for yourself
Open Markdown is open source under GPL-3.0. Every network request the app can make is visible in the source code at github.com/ptheofan/open-markdown. You do not have to take our word for any of the above.
Children’s Privacy
The app collects no data and is not directed at children. The Google integration requires a Google account, which has its own age requirements.
Changes to This Policy
If this privacy policy is updated, the new version will be published on this page with a revised effective date.
Contact
If you have questions about this privacy policy, please open an issue on GitHub: