Privacy Policy

Your privacy matters to us. This Privacy Policy explains what data EDTR.md collects, why, and what choices you have. The short version: anonymous use collects nothing. Everything stays in your browser unless you choose to sign in and sync.

1. Anonymous use — no data collected

Without an account the editor runs entirely in your browser. Your Markdown files, editor settings, and preferences are stored in localStorage only. No data is sent to our servers, no cookies are set, and no analytics are attached to your content.

2. Account data

Creating an account is optional. If you sign up, we store the following in our PostgreSQL database:

• Email address — to identify your account and send transactional emails (email verification, password reset).
• Display name — provided during sign-up or pulled from your OAuth provider profile.
• Avatar URL — provided by your OAuth provider (Google or GitHub), if any. We do not host your avatar.
• Plan — free or pro, determines your media storage quota.
• Editor settings — your font, theme, and layout preferences, stored as a JSON string so they sync across devices.

Authentication is handled by Better Auth. Passwords are hashed and never stored in plain text. OAuth tokens from Google or GitHub are stored encrypted and used only to power the respective integration.

3. Session data

When you are signed in, we store a session record containing your user ID, IP address, and user-agent string. Sessions are managed via a secure, httpOnly cookie scoped to edtrmd.com. Sessions expire automatically and are deleted on sign-out.

4. Cloud sync and files

Signed-in users can sync files to our servers. Synced files are stored in our PostgreSQL database associated with your user ID. File content is transmitted over HTTPS. We do not read, index, or share your file content.

The local-first delta engine means your edits happen locally first and are pushed to the server in the background. You can use the editor fully offline; sync only requires a connection when pushing or pulling changes.

5. GitHub & GitLab sync

Connecting GitHub or GitLab stores an OAuth access token (and refresh token where provided) in our database, scoped to the permissions you granted. We use this token only to read and write Markdown files in repositories you have explicitly selected as a workspace. We do not access other repositories or data.

You can disconnect GitHub or GitLab at any time from within the editor. Doing so deletes the stored token from our database immediately. You should also revoke access from your provider's OAuth applications page.

6. Media uploads

Uploaded files (images, PDFs) are stored in Cloudflare R2 object storage under a private bucket. Files are served via presigned URLs and are not publicly listed. Storage is quota-limited: 100 MB on the free plan, 2 GB on the Pro plan, with a 50 MB per-file limit. Accepted types are JPEG, PNG, GIF, WebP, SVG, and PDF.

Uploaded files are associated with your user account and are deleted when you delete your account.

7. Analytics

We do not use third-party analytics services. No tracking scripts, cookies, or personal identifiers are collected for analytics purposes.

8. Cookies

We set one cookie: a secure, httpOnly session cookie when you sign in. It is scoped to edtrmd.com, expires with your session or after 30 days, and contains only a session token — no personal data. We do not use tracking or advertising cookies.

9. Data retention

Without an account, all data lives in your browser and is cleared when you clear browser storage. With an account, your data is retained until you delete your account. You can delete your account from the account settings panel; all server-side data (profile, files, media, and OAuth tokens) is permanently deleted.

10. Where your data is stored

All server-side data — your account, synced files, and media uploads — is stored on infrastructure hosted by Hetzner Online GmbH, a German company, in their Helsinki, Finland datacenter. Finland is an EU member state; all data processing is subject to the GDPR.

Cloudflare R2 is used for media file storage. R2 object storage does not replicate data globally by default; files remain in the region configured for the bucket.

11. Third-party services

• Hetzner Online GmbH — server hosting (Helsinki, Finland / EU). Processes connection logs per their privacy policy.
• Cloudflare R2 — object storage for media uploads (signed-in users only).
• GitHub — optional OAuth sign-in and repository sync.
• Google — optional OAuth sign-in.
• GitLab — optional repository sync.

12. Children's privacy

EDTR.md is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us personal information, contact us and we will delete it promptly.

13. Changes

We may update this policy from time to time. The “Last updated” date above reflects the most recent revision. Continued use after a change constitutes acceptance of the updated policy.

14. Contact

Questions about this policy? Reach out via our GitHub repository. See also our Terms of Service.