Privacy Policy

Last updated: May 5, 2026

Data collection

Markdraw does not collect analytics, trackers, or telemetry, and does not send personal data to any Markdraw-controlled server. There is no Markdraw backend.

Scope (extension and desktop)

This policy applies to both the Chrome extension and the desktop app.

Local processing

Document parsing and rendering happen locally inside your browser tab (extension) or inside the Tauri webview (desktop app). Document text is never uploaded by Markdraw infrastructure. The only exceptions are explicit, user-triggered network requests listed below.

Local storage usage

Markdraw persists user-controlled state in the browser’s localStorage and, on the extension, in IndexedDB and chrome.storage.session. Nothing in this list leaves your machine.

• Theme preference (light / dark / system).
• Editor preferences (indent mode, line numbers, wrap, invisibles, font).
• Preview font preferences (family and size).
• Recent files and recent folders, plus pinned favorites.
• Tab session per pane (open files and the active tab) and the pane layout (number of panes, active pane, split ratio).
• Sidebar width and visibility, table-of-contents visibility and depth.
• Extension only: directory handles in IndexedDB for session restore.
• Extension only: temporary URL-mode payload in chrome.storage.session — captured by the content script when redirecting to the viewer page, cleared on session end.

Permissions explained

• storage (extension): used for the temporary URL-mode payload above via chrome.storage.session.
• host_permissions: https://kroki.io/* (extension): the only host the extension can fetch. Used solely to render Kroki diagram blocks.
• File URL access (optional, extension): enables previewing local file:// documents. Off by default; toggled at chrome://extensions.

Network requests

• Document URLs (extension): when the extension renders a remote .adoc or .md URL, it fetches the file from that URL the same way a browser would — directly between your machine and the document host.
• Kroki rendering: diagram blocks (plantuml, graphviz, mermaid, etc.) are sent as plain text to https://kroki.io via POST and the response is a static SVG. No JavaScript is fetched. Skipped if the document has no diagram blocks.
• Auto-updater (desktop): on startup the desktop app checks https://github.com/djalmajr/markdraw/releases/latest/download/latest.json for a newer version. If you accept an update prompt, the signed binary is downloaded from the same public GitHub repository. The check sends no document content — it only contacts GitHub.

Sharing safety (extension)

When you copy the source URL of a document being viewed in the extension, Markdraw strips query parameters (such as GitHub’s short-lived ?token=… on raw private-repo URLs) before placing the URL on the clipboard. This prevents the token from leaking when the URL is pasted into chats or issues. The original URL the viewer uses is unchanged.

Third-party libraries

Markdraw bundles open-source packages, all running locally:

• @asciidoctor/core (AsciiDoc parser)
• markdown-it and plugins (Markdown parser)
• Prism (syntax highlighting)
• Mermaid (diagrams rendered locally; some Kroki diagrams use the service above)
• KaTeX (math rendering)
• CodeMirror (editor)
• SolidJS (UI framework) and Kobalte (UI primitives)
• Tauri (desktop runtime) and tauri-plugin-updater (desktop only)

Third-party services

• Kroki (https://kroki.io) — only when your document contains supported Kroki diagram blocks.
• GitHub (github.com/djalmajr/markdraw) — only for desktop auto-updates and downloads of installer / update artifacts.

Policy changes

Any future updates to this policy are published on this page. The Last updated date at the top reflects the most recent change.

Contact

For privacy questions, open an issue at github.com/djalmajr/markdraw/issues.