Privacy Policy
TL;DR
md does not collect, transmit, sell, or share any
data. It contains no analytics, no advertising SDKs, no
trackers, and no servers operated by us — we operate none for the
app. The documents you open and edit stay where you put them — on
your computer, or in folders your own cloud provider
syncs. The app's only network activity is fetching images that
your own documents reference by a remote URL, so they can
appear in the preview and in what you print or export — and, when
you export an EPUB whose front matter names its cover by an
https: URL, that one image. Nothing about you is ever
sent anywhere.
If that already answers your question, you don't need to read the rest.
What we collect
Nothing. md has no account to create, no email to
register, and no telemetry. It contacts no servers of ours, and it
does not check for updates: a new version arrives as a new package
that you download and install yourself. The app initiates exactly
two kinds of network request, and only on your behalf: downloading
an image that your document points at by remote URL
(), and, when you export an EPUB,
downloading the cover its front matter names by an
https: URL. See Network use below.
Network use
An image your document references by a remote URL is fetched when that document is rendered — in the live preview, and also when you print it or export it to PDF or EPUB, because the printed page has to show the same picture the preview does. It happens only for documents that contain such a link.
The request goes directly to whatever host your document names. That host sees your computer's IP address and a normal HTTP request, exactly as it would if you had opened the same URL in a web browser. We are not party to it: no request is ever made to us.
The same goes for an EPUB export whose front matter says
cover: https://…: the export fetches that one image to
put it on the book, and nothing else — at most 20 MB, within 15
seconds. If the host redirects the request, md follows at most five
redirects, and only to https addresses; each host along
the way sees your IP address in the same way.
A local image beside the document is deliberately not
shown in the preview: md's document is its text. The one time md
reads a file beside your document is File ▸ Export ▸
TextBundle…, which copies the local images the document links
into the new bundle's assets/ folder — from disk, at
your request — and, likewise, File ▸ Export ▸ EPUB… reads
the one image a cover: in the front matter names, from
the document's own folder only.
A link you click in the preview, Help ▸ md Help and Help ▸ Privacy Policy open in your web browser; md itself fetches nothing for them.
Everything else is built on your computer: the Markdown renderer, and the math and diagram engines (KaTeX with mhchem, Mermaid, Graphviz, PlantUML, highlight.js) are installed with the app and run offline. No code is downloaded or updated at run time.
Your documents
md is a document editor. The files you open, create and save are handled through GTK's file dialogs (on GNOME, the desktop's own file chooser), file associations and drag and drop, and are stored wherever you choose — locally or in a folder your own cloud provider syncs. We never see them. If you keep a document in a synced folder, it syncs through your account under that provider's privacy terms, not ours.
One file may be written beside your document rather than in
md's folders: if a save fails while a window is closing — a full
disk, a read-only folder — md keeps your text next to the original
as <name> (rescued) with the original extension
(then (rescued 2), and so on), and tells you so. It is
your document, in your folder, and md never touches it again.
What md stores on your computer
A few small settings, in ~/.config/md/settings.conf (or
under $XDG_CONFIG_HOME). They are, in full:
| Setting | What it holds |
|---|---|
md.viewModeMemory | Which layout (Edit / Split / Preview) you last had each of your 200 most recently opened documents in. Each entry is a short hash of the file's path, not the path itself, and a mode. |
md.pdfPageSize | The page size chosen for PDF export (A4 unless you pick another). |
md.bookBookmark | The path of the book folder you have open in writer mode, if any. Book ▸ Close Book removes it. |
md.bookLastArticle | Which article in that book you had open last, as a path relative to the book, so the book reopens where you left it. |
md.bookOpensInSeparateWindows | Whether a book opens its articles in separate windows. |
md.bookViewMode | The book window's one layout. |
md.linux.windowSize.document, md.linux.windowSize.book | The last size of a document window and of the book window, so new windows open at it. |
md.continueLists, md.capitalizeSentences, md.wrapSelection | The three switches under Edit ▸ Typing, on or off. All three start on. |
md.linux.recentClearedAt | When you last chose File ▸ Open Recent ▸ Clear Menu, so md's menu shows only what you opened after it. |
Beside those settings the app keeps exactly the following:
| File | What it holds |
|---|---|
~/.local/state/md/session.json(or under $XDG_STATE_HOME) | The documents and drafts you had open when md last closed, with each one's layout, Zen state, window size and whether it was maximized, and whether the book window was open and its size, so the next launch reopens them. File paths and window sizes, nothing else. |
~/.local/share/md/drafts/(or under $XDG_DATA_HOME) | The text of untitled documents you have not saved yet, one file each, readable only by you. A draft is deleted when you save the document or close its window with Don't Save. |
Temporary PDF files in $XDG_RUNTIME_DIR/md/ | The pages an export or a book compile renders before they are copied to the file you named; each is deleted as soon as it has been copied. The folder is in memory and emptied when you log out (without a runtime folder, the system's temporary folder is used instead). |
The preview keeps no web data: it runs with an in-memory session, so no cookies, cache or browsing state is written anywhere. The per-document encoding, line endings and scroll position live in memory only.
Two things are held for md by the desktop itself. The recent
documents list in ~/.local/share/recently-used.xbel,
which md adds a document to when you open or save it, and which
GNOME Files and other applications share; Clear Menu empties
md's menu without deleting anybody else's entries, and md removes an
entry whose file no longer exists. And the file chooser's own
preferences: whenever md shows GTK's Open or Save dialog,
GTK itself records how you left that dialog — its size, the sort
order, whether hidden files are shown, the sidebar's width, and the
like; never a file or folder name — in the desktop's settings
database, ~/.config/dconf/user, which every GTK and GNOME
application shares. md's own code writes nothing there.
None of these settings and files leave your computer, and none of
them contain personal information beyond the file paths named above.
Removing the package — apt remove or apt
purge, dnf remove, or deleting the folder you
unpacked the .tar.gz into — leaves them in place, as
packages always leave the files in your home folder; delete the
folders above to remove them. If a future version remembers anything
else, it is added to this list in the same commit that adds the
setting.
Permissions
md asks for no permissions and none are needed: like any program you install on Linux, it runs with your own user's rights. That is worth stating plainly, because it is not a sandbox. md reads and writes only the files you open, save, drop on it or pick as a book — by how it is written, not by a fence the operating system draws around it.
The preview is different: WebKitGTK runs its web content in processes
of their own, inside a sandbox (bubblewrap) that needs an unprivileged
user namespace. Ubuntu 26.04 grants one only to programs an AppArmor
profile names, so the .deb installs
/etc/apparmor.d/md. That profile confines nothing and
grants nothing else; it is the same profile Ubuntu ships for its own
WebKitGTK applications, and it exists only so that the preview's
sandbox can start. Fedora needs no such profile, so the
.rpm installs none; the .tar.gz carries the
profile as a template, for you to install if you run it on Ubuntu.
Around the app
Two things happen around md rather than inside it. Downloading a
package from nettrash.me is an ordinary web request to this site.
And when you install the .deb or .rpm, your
package manager downloads the libraries md needs (GTK 4, libadwaita,
WebKitGTK and two font packages) from your distribution's own
mirrors, under your distribution's terms. Once md is installed, it
sends nothing back to either.
Children's privacy
Because md collects no data at all, it collects no data from children.
Changes to this policy
Any change is committed to PRIVACY.md in the app's source
repository and published on this page in the same sitting, with a new
Last updated date.
Contact
Questions: nettrash@nettrash.me.