Privacy for a local-first Markdown editor
Last Updated: July 2026 (v2.3.2)
Overview
Mark It Down is a Chrome extension that provides a WYSIWYG Markdown note-taking experience in your new tab and side panel. As of v2.3.2, its optional network features include Web Clipper, AI chat extraction, RSS, Repository Reader, URL Preview, and Git synchronization. These features connect directly to the source or provider you choose; Mark It Down does not operate an account system or product backend. This privacy policy explains what stays local, what communicates externally, and when Chrome asks for permission.
Data Collection
Mark It Down does not collect, receive, sell, or share your personal data with us.
All your notes and settings are stored locally in your browser using Chrome's storage API. The extension includes no analytics, advertising, or third-party error-reporting service. When you use an optional network feature, your browser communicates directly with the source site or configured provider — not with a Mark It Down server.
Data Storage
| Data Type | Storage Location | Transmitted? |
|---|---|---|
| Notes | Local (chrome.storage.local) | No* |
| Settings | Local (chrome.storage.local) | No |
| Git Token | Local (encrypted) | GitHub / GitLab only during authenticated requests |
| RSS / clipped / repository content | Local after retrieval | Retrieved directly from the source you request |
*Note content is transmitted only when you explicitly use Git synchronization. Other network features retrieve content from the source named in the feature.
Web Clipper (Added in v2.0.2)
The Web Clipper lets you right-click any page to save it as Markdown into your notes.
How It Works
- When you right-click and choose a clip action, the extension reads the current tab's HTML and converts it to Markdown
- The resulting Markdown is saved locally to your notes — no data is sent to any server
- Some platforms (e.g. AI chat services) may use your authenticated session cookies to retrieve higher-quality content for conversion. These cookies are never collected, transmitted, or stored by the extension
What the Web Clipper Does NOT Do
- No automatic background reading — pages are only read when you explicitly trigger a user action (clip command, or the RSS fetch action described below)
- No credential collection or transmission of any kind
- No browsing history tracking
- No access to other tabs or windows
RSS Feeds (Added in v2.2.0)
The RSS feature only operates on feed URLs that you yourself register in Settings > RSS Feeds. The extension never autonomously contacts URLs you have not registered or origins you have not authorized.
How It Works
- Per-origin grant: When you register a feed URL, Chrome prompts you to grant access to that feed's origin only (e.g.
https://example.com). The manifest declares<all_urls>as the optional capability ceiling, but RSS requests only the specific origin pattern you register - Feed fetching: When you press the refresh button, or when scheduled refresh is enabled, the extension issues HTTPS requests to the registered origin to retrieve the RSS XML
- Article clipping: When you save an article from a feed, if the article URL's origin has not been granted yet, you are prompted again for that origin only. You can decline
- Local conversion: Retrieved RSS XML and article HTML are converted to Markdown entirely inside your browser. They are never sent to our servers (we don't have any) or to any third-party server
- Revocation: Removing a registered feed automatically revokes its host permission. You can also revoke permissions individually from Chrome's extension settings
Background Polling and Notifications (Added in v2.2.2)
When you enable scheduled refresh in RSS settings, the extension uses Chrome's alarms API to wake the background service worker at your configured interval and fetch registered feeds. If you also enable desktop notifications, the extension uses Chrome's notifications API to show a local notification listing new article titles when new items arrive. Both features are opt-in and can be disabled independently in RSS settings — disabling scheduled refresh cancels the alarm; disabling notifications suppresses the local alert. No data leaves your browser as a result of either feature.
Things to Note
- The feed publisher's server will see normal HTTP access logs (IP address, User-Agent, timestamp, etc.) just like any web request. This is between you and that publisher
- Registered feed URLs and retrieved article data are stored only locally (chrome.storage.local) and are deleted when the extension is uninstalled
Repository Reader (Added in v2.2.10)
Repository Reader opens a GitHub Markdown repository only after you enter or select a repository URL. Your browser communicates directly with the GitHub API; repository content is not proxied through a Mark It Down server.
- Public repositories: Read without a token through the GitHub API
- Private repositories: Use your saved GitHub token only when you explicitly enable the token option for Repository Reader
- Local state: Reader history, pinned repositories, and imported notes stay in Chrome extension storage
- Explicit import: Reading a repository does not add its files to your notes until you choose to import one
Git Synchronization (Optional)
If you choose to enable Git synchronization:
Token Security
- Encryption: Your token is encrypted using AES-256-GCM with PBKDF2 key derivation
- Storage: The encrypted token is stored only in your browser's local storage
- No transmission to us: Your token is never sent to our servers (we don't have any)
- Scope: The encryption seed is stored in the same Chrome profile. This reduces casual plaintext exposure but does not protect a compromised browser profile or extension context
Data Transmission
- Direct Communication: Notes are transmitted directly between your browser and your Git repository
- No Mark It Down Intermediary: Data goes to the GitHub or GitLab service you configured and does not pass through a server operated by us
- Your Control: You can disconnect Git synchronization at any time
Permissions Explained
| Permission | Purpose |
|---|---|
| storage | Store your notes and settings locally in Chrome |
| unlimitedStorage | Support unlimited notes without storage restrictions |
| sidePanel | Enable the side panel feature for note-taking while browsing |
| contextMenus | Add right-click menu entries for the Web Clipper |
| activeTab | Read the current tab's content when you trigger a clip action |
| scripting | Run the content extraction script on the active tab during a clip action |
| alarms | Schedule periodic RSS feed polling at your configured interval. The schedule runs entirely inside your browser using Chrome's built-in alarm API; no remote scheduler is contacted |
| notifications | Show a desktop notification when new RSS articles arrive, only if you opt in from RSS settings. Notification content (new article titles) is generated locally from feed data already stored in your browser |
| optional_host_permissions (http/https) | The manifest declares <all_urls> as the optional capability ceiling. RSS and Web Clipper normally request only the origin you register or clip, and each grant can be revoked |
| optional <all_urls> grant for URL Preview | Requested only when you enable URL Preview, because link metadata can come from any site. Chrome shows a separate broad-access prompt; URL Preview remains off if you decline |
| host_permissions (api.github.com / gitlab.com) | Direct Git synchronization and GitHub Repository Reader requests. No Mark It Down server is used as an intermediary |
Third-Party Services
Mark It Down does not integrate with any third-party analytics, advertising, or data collection services.
The only external services involved are listed below. In every case, your browser communicates directly with the service — nothing passes through any server we operate:
- GitHub / GitLab (only if you enable Git synchronization) — destination for note sync
- GitHub API (only when you use Repository Reader) — source of repository metadata and Markdown files
- RSS feed publishers you register (v2.2.0+) — source of feed XML
- Hosts of articles you clip with Web Clipper — source of article HTML
- Hosts of links shown by URL Preview (only if you enable URL Preview) — source of link metadata
These services are limited to destinations you registered, opened, clipped, or enabled through an optional feature. The extension does not send their content to a server operated by Mark It Down.
Data Retention
- Your data remains on your device as long as the extension is installed
- Uninstalling the extension will delete all locally stored data
- We have no access to your data and cannot recover it
Contact
If you have questions about this privacy policy, please visit our Feedback page.
Summary
Your notes stay on your device by default. Optional network features communicate directly with the source or provider you choose; nothing passes through a Mark It Down backend.