Privacy

Last updated 12 October 2026

Markpad (markpad.md) is run by M Salauddin Morshed, an individual based in Bangladesh ("we", "us"). This page says what we collect, why, who helps us run the service, and what you can do about it. Questions: contact[at]markpad.md.

What we collect

  • Your account. Name, email address, and a password (stored only as a hash) or your Google account if you sign in with Google. A profile photo if you add one.
  • What you write. Your docs, folders, titles and the images you upload, your sharing settings, and — on docs you open for editing — who last edited them.
  • Drafts without an account stay in your browser. They reach us only if you sign in and choose to import them.
  • Reports. If you report a doc: the reason and details you give, and your account if you are signed in.
  • Technical data. Our host keeps short-lived request logs (IP address, browser, the page requested) to run and secure the service. We keep simple counters to stop abuse, such as too many sharing changes.
  • Views of shared docs. When someone opens a shared doc, we record when, roughly where (country, region and city, from their connection), their browser, system and type of device, the site that linked to it, their language, and their account if they are signed in. Never their IP address. We also note when a link preview (WhatsApp, Slack and the like) fetches it.
  • Usage statistics. Vercel Web Analytics and Speed Insights count page views and page speed without cookies. Doc addresses are removed before anything is sent.
  • How the home page and help pages are used. On markpad.md's home page and its help pages (/docs) only, PostHog records what visitors do: pages viewed, clicks, how far they scroll, and a replay of the visit with anything typed hidden. It never runs in the editor or on your docs. It remembers a visit only until the tab closes, with no cookie.

Cookies

Only the ones Markpad needs: your sign-in session, and a short-lived cookie with your timezone when you create an account. Editor preferences stay in your browser's local storage, and the home page's usage statistics keep an ID for the open tab only (session storage). No advertising or tracking cookies.

Why we use it

  • To run your account and your docs — the service you asked for (for people in the EU and UK: performance of a contract).
  • To keep Markpad secure, stop abuse and deal with reports (our legitimate interest in a safe service).
  • To meet legal obligations when they apply.

We don't sell your data, show ads, or train AI models on your docs.

Who can see your docs

Docs are private until you share them. A shared doc can be read by anyone who has its link, or edited by anyone signed in if you allow editing, until you stop sharing, the link expires or you reset it. Search engines can list a shared doc only if you turn that on. Markpad's operators can open any doc, private ones included, to review a report or when the law requires it. Images you upload are reachable by anyone who has their address, whether or not the doc is shared.

Who helps us run Markpad

  • Vercel — hosting and usage statistics (United States)
  • PostHog — how the home page and help pages are used (European Union)
  • Neon — the database (United States)
  • Cloudflare — image storage and our domain (global)
  • Resend — account email
  • Google — sign-in, only if you choose it

Some of them process data outside your country, including in the United States. They do so under their own data protection terms, including the European Commission's standard contractual clauses or the EU–US Data Privacy Framework where those apply.

How long we keep it

  • Your account and docs, for as long as you keep your account.
  • Docs and folders in Trash are deleted for good after 30 days.
  • Uploaded images that no doc uses any more are deleted within about a day.
  • Deleting your account deletes your docs and folders straight away; its images follow within about a day.
  • Reports, for as long as we need them to handle abuse.
  • The details of each view of a shared doc, 90 days. The count on the doc stays.
  • Request logs, for as long as our host keeps them (days, not months).

Your rights

You can see and correct your details on your profile, download any doc as Markdown, and delete your account at any time from your profile. You can also ask us for a copy of your data, to correct or delete it, or object to how we use it: write to contact[at]markpad.md and we will answer within a month. If you are in the EU or the UK, you can also complain to your local data protection authority.

Children

Markpad is not for children under 16.

Security

Connections use HTTPS, passwords are stored as hashes, and your docs are reachable only by you unless you share them. No service is perfectly secure; if a breach affects your data, we will tell you and the authorities as the law requires.

Changes

When this policy changes, we update this page and its date. For a significant change we will also tell you by email or in the app.