Privacy Policy
Updated August 26, 2026
1. Scope and local-first files
The operator provides the website, waitlist, macOS app, checkout handoff, licensing and refund function. Contact: help@themarkdowneditor.app. Notes, selected text, images, filenames, paths and drafts remain on your Mac unless you deliberately use GitHub Sync or feedback. The app does not use AI models or your documents for training.
2. Waitlist and email
Supabase stores a waitlist email, signup status, source and delivery timestamps needed for release or Founder messages. Resend processes recipient, message and delivery events. You may unsubscribe from marketing; legally necessary purchase and licence emails may still be sent.
3. Checkout, licensing and devices
We process selected plan, policy versions, acceptance timestamp and any personal Founder claim. Polar, as merchant of record, collects email, billing/payment and tax details, IP address and order data. We do not store full card details. We receive order, price, currency, status and licence-benefit events needed to fulfil the contract.
Initial activation processes the full licence key once, together with an app installation identifier and connection metadata. The full key is used transiently and is not intentionally logged or stored in the database. After activation, the app stores only an activation identifier, a masked key and a signed offline lease in macOS Keychain. Entitlement status, provider references, activation records, timestamps and security events enforce the 3-device limit.
4. Refund and support requests
The refund function collects purchaser name, purchase email, Polar order reference, request category, optional explanation, workflow status and timestamp to verify the contract, respond, send durable confirmation and process a refund, withdrawal or cancellation. Do not include card data. Support correspondence may be retained up to 24 months after closure unless law requires longer.
5. Analytics
Vercel provides cookieless website analytics for aggregate page, referrer, device and coarse-location metrics. Transaction pages are noindex. Claim tokens, checkout/order references, licence keys and form contents are not intentionally sent as analytics properties.
You can disable optional Aptabase app analytics in Settings. Allowed events cover the app and build, OS, language, device class, broad session activity and feature use. They do not contain documents, filenames, paths, keys, email, raw errors or screenshots. We do not use them for advertising or cross-app tracking.
6. Providers, purposes and retention
Polar: https://polar.sh/legal/privacy, Supabase: https://supabase.com/privacy, Resend: https://resend.com/legal/privacy-policy, Vercel: https://vercel.com/legal/privacy-policy, Aptabase: https://aptabase.com/legal/privacy, GitHub: https://docs.github.com/en/site-policy/privacy-policies/github-general-privacy-statement, Apple: https://www.apple.com/legal/privacy/
We use the data to perform contracts, deliver requested messages, process rights and refunds, secure the services, comply with tax and accounting law, and measure reliability. We keep waitlist data until you unsubscribe or ask for deletion, or for a reasonable period after launch. We keep purchase records for the required accounting period. We keep entitlement and activation data while they are active and as needed for fraud or disputes. Each provider may use a different retention period.
7. Legal bases, transfers and security
EEA/UK bases include contract, legal obligation, legitimate interests balanced through minimisation, and consent where required. Providers may process in the EEA, US or elsewhere using adequacy decisions, Standard Contractual Clauses or other safeguards. HTTPS, server-side secrets, private backend tables, role limits and macOS Keychain are used, but no system is perfectly secure.
8. Rights, children and changes
Depending on law, request access, correction, deletion, restriction, portability, objection or consent withdrawal at help@themarkdowneditor.app; replies are normally within 30 days. EEA users may complain to their authority, including https://www.ip-rs.si/. We do not sell or share personal data for behavioural advertising. California rights to know, correct and delete apply where relevant. Services are not directed to children under 13. Material changes receive a new date and appropriate notice.