Last updated 16 October 2026
Privacy
Markdrop turns documents and files into links. This page says what we keep, what we measure, who helps us run the service, and how to opt out. Questions or requests: himanshu@markdrop.in.
What you publish
- Documents and files you publish are stored so the link can show them. Anyone with a link-access link can open it; private, password-protected and workspace documents are checked before they open.
- Encrypted documents are encrypted in your browser. We store only ciphertext. The key is in the part of the link after
#, which browsers never send to us. - Documents you set to expire are deleted when they expire. You can delete anything you own from your dashboard.
Your account
Markdown needs no account. Uploading files, workspaces and the dashboard need a free one: we keep your email address, your name and picture if you sign in with Google, and the documents you own. To delete your account and everything in it, email us from the address you signed in with.
What we measure
We use three kinds of analytics, all to understand how Markdrop is used and what to fix.
- Our own analytics. Page views, time on page, where visits come from and product events such as “published”. No cookies: a random id in your browser’s storage. Your IP address is used once to look up your country and city and is not stored. Kept for about 13 months.
- PostHog (product analytics and session recordings, hosted in the US). It records pages, clicks and scrolling, and, on most pages, a replay of how the page was used. When you sign in, your visits are linked to your account’s email.
- Google Analytics (aggregate traffic reports).
What PostHog and Google Analytics never receive:
- Document and file links. A document is reported as an anonymous reference, never its address.
- Anything after
#in a link, including encryption keys, and sign-in or invite tokens. - What you write. Editors, previews, document pages and lists of your documents are not recorded, and every text field is masked.
- The contents or names of files you send with Share.
Cookies and your choices
Our own analytics set no cookies. PostHog and Google Analytics do. If you are in the EU, the EEA, the UK or Switzerland, we ask first: until you accept, PostHog counts your visit without cookies and records nothing, and Google Analytics does not load. If your browser sends Global Privacy Control or Do Not Track, we treat that as a no.
You can change your choice at any time: .
Sending files (Share)
Files go straight from your device to the other person’s and are never stored on our servers. If a network blocks a direct path, an encrypted relay forwards the bytes and can’t read them. We keep the name, type and size of the files, how many there were, a hashed IP, your account if you’re signed in, and connection details (route, timing, browser), for 90 days.
Who processes data for us
- Vercel (website hosting) and Amazon Web Services in Mumbai (our API).
- MongoDB Atlas (database) and Cloudflare (file storage, the file viewer and the Share relay).
- Resend (sign-in and notification email).
- PostHog and Google (analytics, as above).
We don’t sell personal data, and we don’t use it for advertising.
We send sign-in codes, notifications you trigger, and occasional product updates. Every update has an unsubscribe link.
Changes
When this policy changes, the date at the top changes with it.