← Markdown Editor

Privacy Policy

Last updated: 21 October 2026

Markdown Editor (https://markdown.ericperret.org/) is a browser-based Markdown editor. This policy explains what data the app handles and what it does not.

Summary

• Your documents are processed in your browser.
• This site does not run a backend that stores the contents of your Markdown files.
• Optional Google Drive access is limited to files and folders you create or open with this app.
• We do not sell personal data and do not use advertising trackers in the app.

Who operates this app

The hosted instance at ericperret.org is operated by the project maintainer. Contact: markdown@ericperret.org. Security reports: see SECURITY.md.

Data processed in your browser

Depending on how you use the app, it may store or process the following on your device:

• Editor content — Markdown you type, paste, upload, or open.
• Drafts and history — recent document drafts and revision data in browser storage (including IndexedDB and localStorage).
• Preferences — settings such as theme, layout, and files-drawer options.
• Local files — if you use “Open folder” (Chromium File System Access), the app reads and writes files you choose on your computer. Those files stay on your device unless you export or share them yourself.
• Share links — if you create a share URL, the Markdown is encoded in the link (for example in the URL fragment). Anyone with the link can open that content. The app does not host that payload on a document server.

Clearing site data in your browser removes local drafts, history, and preferences for this origin.

Optional Google Drive

If the host enables Google Drive and you choose Connect Drive, you sign in with Google. The app requests the OAuth scope https://www.googleapis.com/auth/drive.file, which allows it to create, open, edit, rename, and trash only Drive files and folders that you use with this app (under the app’s markdown-editor folder), not your entire Drive.

• Access tokens stay in the browser for Drive API calls, held in memory for the current tab only (not written to sessionStorage). Across refresh or a new tab they are sealed with a WebAuthn passkey (PRF) as ciphertext in localStorage and require Unlock; without a passkey seal, refresh requires Connect again. Tokens are not sent to the Markdown Editor operator’s server.
• File names and contents you open or save go between your browser and Google’s Drive API.
• Google’s use of account data is governed by Google’s Privacy Policy.
• You can disconnect by signing out of Google / revoking the app under your Google Account permissions, and by clearing this site’s data.

Optional GitHub Gist

If the host enables GitHub Gist and you choose Connect Gist, you paste a fine-grained personal access token with Gists permission. The token stays in the browser (memory, optionally sealed with a WebAuthn passkey) and is sent only to https://api.github.com for listing, opening, and saving gist files. It is not sent to the Markdown Editor operator’s server.

• Gist file names and contents you open or save go between your browser and GitHub’s API.
• GitHub’s use of account data is governed by GitHub’s Privacy Statement.
• Disconnect clears the in-memory token and any sealed copy. You can also revoke the token under your GitHub settings.

Network requests

Besides loading the app itself, the browser may request:

• Libraries and assets from this site (and, when needed, from CDNs configured by the build, such as jsDelivr for Mermaid).
• Google Identity / Drive endpoints when you use Connect Drive.
• api.github.com when you use Connect Gist.

Preview Markdown does not load remote https:// images or media (so hostile documents cannot phone home after Accept). Prefer paste-as-data-URI embeds. Clicking a normal link still navigates as you choose.

Third parties may receive standard technical data (for example IP address and User-Agent) as part of HTTPS requests you initiate (Drive, Gist, or clicked links).

Cookies and analytics

The app does not set advertising cookies and does not include a third-party analytics product for tracking personal browsing across sites. Browser storage described above is used for app functionality (drafts, settings), not ads.

Children

The app is a general-purpose writing tool and is not directed at children under 13. Do not use Google sign-in features if you are not allowed to consent under applicable law.

Changes

We may update this policy when the app’s behavior changes. The “Last updated” date at the top will change when we do. Continued use of the hosted app after an update means you accept the revised policy.

Contact

Questions about this policy: markdown@ericperret.org.

Forks and self-hosted copies are separate deployments. Their operators should publish their own privacy policy and OAuth branding if they enable Google Drive or GitHub Gist.