Privacy & Local-First Guarantees

Markdrip is built local-first and private by default. This page states the guarantee plainly so you don’t have to take it on faith.

Who we are. Markdrip is the controller of the data described here. Contact us with questions or rights requests at [email protected].

Your processing choice

Your meeting content is processed on this device by default. Before the first connection, you review the Privacy Policy. During first-time setup, a country-only request to Markdrip selects the regional usage-data controls. It sends no meeting content, license, installation identifier, or usage measurements and creates no reporting account. The country is saved locally. UK/EEA and unknown regions require an unchecked opt-in; confirmed regions outside EEA/UK default to on, with an opt-out in Settings → Privacy. A failed lookup leaves reporting off. Existing opt-outs and offline restrictions are preserved. Other service connections wait until you complete the service review; these allow content-free licensing and daily update checks, with basic usage reporting controlled separately. No cloud meeting task is enabled by that choice.

Work offline keeps Cloud processing: Off (on-device processing) in Settings → AI providers. Licensing, update checks, downloads, and enabled usage reporting work independently. These connections contain no meeting content; their service data is described below.

Optional AI providers lets you choose external services independently for supported tasks. Each task names the recipient and data categories and asks for explicit, revocable permission. Recordings, voiceprints, acoustic measurements and voice-derived interpretations stay on this device through Markdrip-controlled AI routes, even when cloud text processing is enabled. Ordinary transcript words and speaker labels may be shared within the selected task. Unsupported tasks remain local, and a provider preset never silently chooses another external service.

Your provider’s retention, training, regional, and billing terms apply. Turning a task off stops future sharing but does not recall data already sent. A running content transfer must finish or cancel before on-device processing is confirmed. Synced folders, other apps, and OS services operate independently of Markdrip.

The separate channels below require your first-run service choice and their own applicable controls. “Tier 1” below means protected text/content; audio and voice data remain sensitive and are never part of licensing or product telemetry.

Optional egress modes (both off by default)

Mode A — Encrypted Markdrip-cloud sync (not yet available)

Optional cross-device sync of your Tier-1 content to Markdrip’s cloud. The design target is end-to-end encryption: your device holds the keys; Markdrip stores only ciphertext it cannot read. You can stop syncing and delete your cloud copy at any time.

Mode B — Your destination, your key

Send selected Tier-1 content directly to a destination you own — never through Markdrip infrastructure. You choose the destination, supply your own credentials, and can revoke access at any time. Markdrip never sees, proxies, or stores the content you send.

Note and action-item export (coming soon). When this feature ships, you will be able to send a meeting summary, manual notes, or action items from any note to a workspace tool you own. Each export will require your explicit confirmation — you enter the destination, preview what will be sent, and confirm before anything is transmitted. There will be no remembered approval, background sync, or automatic retry. Audio and voice fingerprints are structurally excluded from the export design and will not enter any export payload. Markdrip does not host audio clips or create hosted share links to your content. See Export and share meeting notes for details when available.

Encrypted backup to your own storage (not yet available) — a future Mode B capability for backing up your Tier-1 content to an encrypted location you own and control, with keys held only on your devices (distinct from Mode A, which would sync to Markdrip-hosted infrastructure).

What Markdrip does not do

• No crash reporting that phones home.
• No hosted or third-party search — search runs against a local index.
• No account required to use the app.

The public marketing site, documentation and account portal use Rybbit to understand website use. Marketing measurements cover page visits, download clicks and interest in monthly or annual Plus pricing; selecting a price is not a purchase. Documentation and the account portal also use button-click measurements; documentation also collects website error diagnostics. Session replay is disabled on all three websites. Copied text, form interactions and outbound-link URLs are not collected. Rybbit stores a persistent visitor identifier in browser local storage and respects its browser-local opt-out. Pages with URL query parameters or fragments, including authentication returns, are not recorded; this also applies when a page’s URL changes. Website measurement is separate from desktop usage reporting and does not receive your meeting recordings, transcripts or notes. The billing site and founder console do not load this tracker.

Outbound channels

License validation

Markdrip contacts the licensing endpoint to start or recover your trial and to issue and validate a paid license (activation, periodic heartbeat, and revocation check). That exchange never includes your audio, transcripts, notes, summaries, voiceprints, contacts, or usage measurements.

What the licensing service processes and about whom:

• Trial subjects. To start or recover a 14-day trial, the app sends a pseudonymous, HMAC-derived device identifier and a nonce — not your name, email, or any meeting content. The raw device fingerprint is never stored.
• License holders. Paid activation and periodic heartbeats carry an activation identifier, a timestamp, and a cryptographic signature only. Where a paid license was purchased via the web, an account record (verified email, plan, billing status) exists for billing management; the app itself does not require an account.
• Licensing-security subjects. Where the licensing-security service is configured, it records the connection IP for exactly four purposes: trial enforcement, repeat-install abuse detection, rate limiting, and concrete security investigations. The IP is encrypted at rest in purpose-separated storage accessible only to a separately authorized investigator. It is not used in support tools, marketing, advertising, analytics, profiling, or visitor classification. It is retained until a verified applicable deletion request requires removal; primary records and replicas are removed within 30 days, and affected backups age out within a further 35 days.

A label note. Any internal view of a license record shows only “last online validation observed” — not “last app use,” “active user,” or “last meeting.” The licensing service cannot see your meeting activity, which never leaves your device.

Our hosting edge keeps ordinary access logs for at most 30 days for security and availability. None of these records contains your meeting content, which stays on your device unless you separately consent to a supported external task.

Product-usage measurements

The app sends pseudonymous, content-free usage measurements to help improve Markdrip. These are integer counts of app openings, active days, completed recordings, feature actions, completed update checks, and updates found, plus current object counts in your vault. Free/Plus edition is verified by the service. These measurements describe participating installations, not people. No audio, transcripts, notes, summaries, voiceprints, speaker names, or other meeting content is included.

Regional default. Outside the EEA and UK, usage reporting is on by default. Inside the EEA and UK, it is off by default and requires your explicit opt-in. Unknown-region or unconfigured builds do not send usage data without a supported consent policy. No location request runs to choose this policy.

Opt-out (or opt-in). Turn usage reporting off — or on — at any time under Settings → Privacy & storage → Share basic usage data. Turning it off immediately stops future sends and clears any queued measurements on your device; it does not affect recording, transcription, local files, or your license. A “Delete previously shared data” button sends an authenticated deletion request for measurements already sent.

What the service receives. The app sends authenticated numeric measurements linked to a random installation identifier and authenticated with an install-specific key. The server observes the connection address and derives a coarse network prefix (/24 for IPv4, /48 for IPv6) and a two-letter country code, stored alongside the measurements for aggregate product analysis. This analytics channel never writes the raw connection address to a database, log, or export.

IP Geolocation attribution. Country-code derivation uses a third-party IP-to-country dataset. IP Geolocation by DB-IP — licensed under CC BY 4.0.

Timing and retention. Eligible reporting runs in the background, with at most one successful scheduled batch per UTC day. It does not send a request on every app opening. Up to seven daily snapshots are queued locally; pseudonymous server rows are retained for 35 days and aggregate statistics for 13 months. Reports suppress groups with fewer than 10 participating installations. Turning usage off does not disable local features, licensing, or your selected AI providers. On-device processing does not disable usage reporting or deletion requests. No website pixel or analytics SDK is loaded by the desktop app.

Update checks

After the first-run service choice permits connections, Markdrip checks for updates daily by default. Turn this off in Settings → General; a manual check is also available. Available updates download automatically when enabled. You confirm installation and restart; a download alone does not install an update. Update checks contain no meeting content. Basic usage reporting, if enabled, counts completed checks and available updates without recording version strings or URLs.

Model downloads

Explicit, user-initiated downloads fetch on-device models (e.g. the first time you enable a feature that needs a model you don’t have yet). These are downloads to your machine and send a request and connection metadata, but no meeting content. You can manage them in Settings → Recording and Transcripts & summaries; once a model is downloaded, using it needs no network at all.

Calendar access (optional)

Local calendar access is off by default and uses operating-system permission. Remote calendar accounts additionally require their own account authorization. Calendar permission does not authorize sending recordings or reusable voice data. Details included in a note may be shared only within a separately authorized task’s disclosed scope. You can clear calendar-derived note details with Forget calendar data; your manually saved preparation remains on your device.

Visitors to markdrip.app

Visiting markdrip.app or this documentation site is not evidence that you have installed the app, started a trial, or hold a license. Hosting and edge providers see connection-level data (IP, path, timestamp, user-agent) for website delivery, security, and availability only. That data never flows into account, trial, license, or security records, and anonymous website visits are never classified as app users, trial subjects, or customers.

Your rights

Depending on where you are, you may have rights regarding data we hold about you through the licensing and usage-measurement channels described above. These include rights to access, correction, deletion, restriction, and objection (and where applicable, data portability). If you are in the United States, you may also have state-law rights to know, delete, correct, opt out of sale or sharing (we do not sell or share your data), non-discrimination, and appeal.

If you have a paid account, a trial record, a licensing-security record, or a usage-measurement record and want to exercise any of these rights, email [email protected] with a brief description of your request. For a local, pseudonymous-subject request (if you have no account email), describe the nature of your request and we will provide an alternate identity-verification route.

For full details on how we verify requests, the timeline, exceptions, and the relevant regulator contacts, see Rights and data requests.

For voice data rights — including how to erase all enrolled voice data from your device — see the Biometric & Voice Data Notice.

Changes to this guarantee

Any change that would ship a new egress mode — new telemetry, product analytics, content sync, or a user-directed integration — is a non-negotiable CEO review gate + security review gate internally, and does not ship without explicit privacy/security review. If you ever see Markdrip behave otherwise, that’s a bug: please report it.