Privacy Policy

Privacy Policy

Last updated: September 2026

1. Information We Collect

MD HD is designed with privacy in mind. We collect minimal information necessary to provide our service:

  • Account Information: Email address for account creation and authentication
  • OAuth Tokens: Encrypted tokens to access connected cloud storage accounts (Dropbox in the 1.0 release)
  • Document Metadata and Cache: File names, paths, sizes, modification dates, and document content cached for up to one hour when needed to render a cloud document
  • Contact and Beta Information: Name, email address, optional company and message, inquiry type, source page, and optional marketing consent when you submit a public form
  • Usage Data: Product events such as sign-up, document rendering, storage connection, and subscription state; events may be associated with your account when you are signed in
  • Technical Data: IP address and browser user agent associated with public submissions and product events for security and operations

2. What We Don't Collect

We do not modify or sell your cloud files. Your source files remain in your cloud storage. To provide reading, MD HD may cache document content and metadata; disconnecting an account removes its associated connection and documents from our service.

Markdown pasted into the public Markdown Health Check is analyzed in your browser and is not submitted to MD HD.

3. Cloud Storage Access

When you connect a cloud storage provider, we request only the permissions necessary to:

  • List and read markdown (.md) files
  • Access file metadata (name, size, modification date)

We cannot modify, delete, or share your files.

4. Data Security

OAuth tokens are encrypted at rest using Fernet authenticated encryption (AES-128-CBC with HMAC-SHA256). Data in transit is protected with TLS.

5. Third-Party Services

We use the following third-party services:

  • RevenueCat: For iOS in-app purchase management (Premium and Super Premium subscriptions)
  • GlitchTip: For error tracking and crash reporting
  • Google Analytics: Optional website measurement, loaded only after you choose Allow analytics. Google receives technical browser/device information and public page visits and uses analytics cookies. Advertising and Google Signals are disabled. We do not send app account identifiers or document contents to Google Analytics.
  • Cloud Storage Providers: To access your markdown files

Website analytics is separate from app product events. It is not loaded on our admin, authentication, email-confirmation, or document-tool pages, or URLs containing query parameters or fragments. Choose No thanks to decline, or use Analytics preferences at the bottom of a public page to withdraw. We remember your choice in this browser for up to 180 days; declining does not prevent you from using MD HD.

6. Your Rights

You can:

  • Disconnect cloud storage accounts at any time
  • Delete your account and all associated data
  • Contact us with privacy questions or data requests

7. Contact Us

For privacy-related questions, contact us at [email protected]