Privacy Policy

The operator provides the website, waitlist, macOS app, checkout handoff, licensing and refund function. Contact: help@themarkdowneditor.app. Notes, selected text, images, filenames, paths and drafts remain on your Mac unless you deliberately use GitHub Sync or feedback. The app does not use AI models or your documents for training.

Supabase stores a waitlist email, signup status, source and delivery timestamps needed for release or Founder messages. Resend processes recipient, message and delivery events. You may unsubscribe from marketing; legally necessary purchase and licence emails may still be sent.

We process selected plan, policy versions, acceptance timestamp and any personal Founder claim. Polar, as merchant of record, collects email, billing/payment and tax details, IP address and order data. We do not store full card details. We receive order, price, currency, status and licence-benefit events needed to fulfil the contract.

Initial activation processes the full licence key once, together with an app installation identifier and connection metadata. The full key is used transiently and is not intentionally logged or stored in the database. After activation, the app stores only an activation identifier, a masked key and a signed offline lease in macOS Keychain. Entitlement status, provider references, activation records, timestamps and security events enforce the 3-device limit.

The refund function collects purchaser name, purchase email, Polar order reference, request category, optional explanation, workflow status and timestamp to verify the contract, respond, send durable confirmation and process a refund, withdrawal or cancellation. Do not include card data. Support correspondence may be retained up to 24 months after closure unless law requires longer.

We also use Vercel Web Analytics alongside PostHog to compare aggregate page, referrer, device and coarse-location metrics in the existing hosting project. Vercel Web Analytics does not use analytics cookies. Its normal retention applies to previous and new data.

We use PostHog EU Cloud for website audience and conversion measurement in cookieless mode. Events include page views, referring domains, broad browser/OS/device categories, visible sections, scroll milestones, active time, allowlisted button/link clicks, download and checkout clicks, signup outcomes and payment status verified when you return from checkout. URLs are limited to known public paths; query strings, URL fragments, form contents, email addresses, names, claim tokens, checkout/order references and licence keys are excluded. A click or return-page visit alone does not prove a completed purchase.

Website analytics do not store visitor identifiers in cookies, local storage or session storage, create person profiles, record sessions or identify you as an app user. PostHog receives ordinary connection metadata and uses a server-side hash with a daily rotating salt for approximate same-day audience/session counts, then strips the IP before event transformations. This cannot reliably recognise the same visitor across days or devices, and shared networks can affect counts. We skip website analytics when the browser sends Do Not Track or Global Privacy Control. Blocking the analytics endpoint also stops collection. Contact us to object to measurement. Cookieless operation does not remove applicable data-protection obligations.

You can disable optional Aptabase app analytics in Settings. Allowed events cover the app and build, OS, language, device class, broad session activity and feature use. They do not contain documents, filenames, paths, keys, email, raw errors or screenshots. We do not use them for advertising or cross-app tracking.

Polar: https://polar.sh/legal/privacy, Supabase: https://supabase.com/privacy, Resend: https://resend.com/legal/privacy-policy, Vercel (website hosting and cookieless web analytics): https://vercel.com/legal/privacy-policy, PostHog (EU website analytics): https://posthog.com/privacy, Aptabase: https://aptabase.com/legal/privacy, GitHub: https://docs.github.com/en/site-policy/privacy-policies/github-general-privacy-statement, Apple: https://www.apple.com/legal/privacy/

We use the data to perform contracts, deliver requested messages, process rights and refunds, secure the services, comply with tax and accounting law, and measure reliability. We keep waitlist data until you unsubscribe or ask for deletion, or for a reasonable period after launch. We keep purchase records for the required accounting period. We keep entitlement and activation data while they are active and as needed for fraud or disputes. Each provider may use a different retention period.

EEA/UK bases include contract, legal obligation, legitimate interests balanced through minimisation, and consent where required. Providers may process in the EEA, US or elsewhere using adequacy decisions, Standard Contractual Clauses or other safeguards. HTTPS, server-side secrets, private backend tables, role limits and macOS Keychain are used, but no system is perfectly secure.

Depending on law, request access, correction, deletion, restriction, portability, objection or consent withdrawal at help@themarkdowneditor.app; replies are normally within 30 days. EEA users may complain to their authority, including https://www.ip-rs.si/. We do not sell or share personal data for behavioural advertising. California rights to know, correct and delete apply where relevant. Services are not directed to children under 13. Material changes receive a new date and appropriate notice.