Privacy Policy

Last updated: October 14, 2026

markdown.host ("we", "us") is a Markdown editor that can store your documents in an online account, publish them as web pages, and let AI agents work with them. This policy explains what data we handle and why. Questions: [email protected].

The short version

• The editor works without an account; documents you write without signing in stay in your browser.
• If you sign in, we store your Google profile basics and the documents, images, and videos you save.
• We don't sell your data, show ads, use tracking or advertising cookies, or use your content to train AI models.
• You can download everything or delete your account at any time from your account page.

What we collect

When you sign in with Google

Your Google account identifier, email address, name, and profile picture. We only request the basic openid, email, and profile permissions; we can't see your Google Drive, Gmail, or anything else.

What you store

Documents you sync or publish (text, titles, and publishing settings), images and videos you upload while signed in, your chosen username, and API tokens you create. API tokens are stored only as one-way hashes, so we can't read them.

Technical data

To run the service securely we process IP addresses and request details (such as the time, page, and result of a request). IP addresses are used for rate limiting and abuse prevention and are kept in our database for no more than 24 hours; short-lived server logs may contain request details for troubleshooting.

Anonymous features

If you upload an image or create a Share Snapshot without signing in, that content is stored for up to 90 days and anyone with the link can view it.

Cookies and browser storage

We use only cookies that are strictly necessary:

• __Host-mdh_session: keeps you signed in (up to 30 days).
• mdh_signed_in: tells the editor that you are signed in; it contains no personal data.
• __Host-mdh_oauth: protects the Google sign-in step (10 minutes).

The editor also keeps your documents and settings in your browser's local storage (IndexedDB) so it works offline. That data stays on your device.

How we use your data

• To provide the service: sync your documents between devices, publish the pages you choose to publish, and let your AI agents use the API.
• To keep the service secure: prevent abuse and spam, enforce rate limits, and investigate reports.
• To contact you about your account or important changes, if needed.

Our legal bases (where the GDPR applies) are performing our contract with you, our legitimate interest in running a secure service, and complying with the law.

Published content

Documents you make unlisted can be viewed by anyone who has the link. Documents you make public also appear on your profile page and in your llms.txt index, and search engines may index them. Making a document private again removes its public page, but copies others made, or cached by search engines, are outside our control.

Who else processes data

• Google: sign-in.
• Cloudflare: DNS, network protection, and R2 object storage for your documents, media, and our database backups.
• Our hosting provider: runs our servers and database, located in the European Union.

When you or your readers view documents, the browser may load content from third parties: code libraries from cdnjs and jsDelivr, diagrams drawn by kroki.io and plantuml.com (the diagram source is sent to them), map tiles from OpenStreetMap, and anything a document links to or embeds. Importing from GitHub contacts GitHub. These services receive your IP address under their own privacy policies.

Your data may be processed in Canada, the European Union, the United States, and other countries where these providers operate, with appropriate safeguards.

How long we keep data

• Account data and stored documents: until you delete them or your account.
• Deleted documents: removed from storage immediately; a small record of the deletion is kept so your other devices can sync it.
• Database backups: kept for up to 14 days, so deleted data disappears from backups within that time.
• Anonymous uploads and Share Snapshots: up to 90 days.

Your rights

Depending on where you live (for example under the GDPR or Canada's PIPEDA), you can access, correct, export, or delete your personal data, object to or restrict some processing, and withdraw consent. You can do most of this yourself:

• Download your data: account page → "Download all my data".
• Delete your account: account page → "Delete account". This removes your documents, media, published pages, and tokens.
• Correct your username: account page. Your name and picture come from Google and update when you sign in.

For anything else, email [email protected]. You can also complain to a data protection authority, such as the Office of the Privacy Commissioner of Canada or the authority in your EU country.

Security

Connections use HTTPS, session and API token secrets are stored only as hashes, published pages are sanitized and isolated from your account, and access to production systems is restricted. No system is perfectly secure; if a breach affects you, we will notify you as required by law.

Children

markdown.host is not intended for children under 16, and we don't knowingly collect their data.

Changes

We may update this policy. We'll change the date above and, for significant changes, notify signed-in users.

Terms of Service · Back to markdown.host