Skip to content

PRIVACY.md

Latest commit

 

History

History
155 lines (116 loc) · 6.48 KB

PRIVACY.md

File metadata and controls

155 lines (116 loc) · 6.48 KB
Raw

Privacy Policy

Last updated: 2026-04-25

This policy covers this independent successor to StackEdit, maintained at github.com/soreavis/stackedit and its Vercel deployment. StackEdit is a Markdown editor that runs entirely in your browser. The short version: your documents live in your browser or in the cloud provider you connect them to — never on a server operated by this deployment. The longer version is below.

If you are using a different deployment or the original upstream (benweet/stackedit, dormant since 2023-05-27), that deployment has its own policy.

What stays in your browser

By default, StackEdit stores everything locally using the browser's IndexedDB and localStorage:

  • The documents you write and their revision history
  • Workspace settings and layout preferences
  • OAuth access tokens for any cloud provider you connect
  • Session state (current file, cursor position, undo history)

None of this is transmitted to a server operated by this deployment. Clearing your browser's site data removes it.

Files you drag-and-drop onto the file explorer panel are read in your browser via the standard FileReader / FileSystemEntry APIs and stored in the same local workspace. Their contents are never sent to a server operated by this deployment.

What leaves your browser (only if you opt in)

If you connect an external storage provider, your files are stored by that provider, not by us. You grant access explicitly via OAuth, and you can revoke it at any time from the provider's account settings.

Supported providers and their privacy policies:

When you sync or publish, the app holds an OAuth access token in your browser's local storage and sends it directly to the provider's API to complete the request. The token is not stored on a server operated by this deployment.

What the server sees

This deployment is hosted on Vercel. Vercel's edge network processes requests; standard web-server logs apply. The deployment does not operate its own database or account system.

Vercel platform

  • Request logs. Vercel logs HTTP requests (URL, status, IP, user-agent, timing) for operational purposes. Retention and access are governed by Vercel's privacy policy.
  • Vercel Analytics. Anonymized page-view events are collected to measure site traffic. They honor the DNT (Do Not Track) header and do not use cookies. See Vercel Analytics privacy.
  • Vercel Speed Insights. Real-user Web Vitals metrics (LCP, CLS, etc.). Performance numbers only — no document content.

Rate limiting

A small number of API routes (/api/conf, /api/userInfo, /api/cspReport, /api/googleDriveAction, /api/githubToken) are rate-limited via Upstash Redis. Your IP address is used as the key; keys expire within minutes and are not correlated across requests or joined to any other identifier.

OAuth token exchange

/api/githubToken performs the server-side leg of the GitHub OAuth flow (PKCE S256). The GitHub client secret lives on the server; the access token returned by GitHub is handed back to your browser and stored client-side. The server does not retain the token after returning it.

CSP reports

/api/cspReport receives Content Security Policy violation reports generated by your browser when the CSP blocks something. Reports include the violated policy, the blocked URL, and the document URL. They are used to detect deployment regressions and are not correlated to users.

Features that read local device data

  • "Import from clipboard" reads from your OS clipboard only when you click the menu entry. The content is parsed locally and imported as a new file. It never leaves your browser.
  • Image paste (Ctrl/Cmd+V into the editor) accepts image data from the clipboard and uploads it to whichever provider you have configured for image hosting (Google Drive, Imgur, etc., as explicitly selected). It follows the same "only if you opt in" rule as document sync.
  • Google Drive image picker opens a picker UI provided by Google; any data exchange happens between your browser and Google's servers under the token you granted.
  • "Copy diagram source" on rendered Mermaid diagrams writes the diagram's own source text to your OS clipboard only when you click the button. The content comes from the document you already have open and never leaves your browser.

What we don't do

  • No cookies for tracking or advertising
  • No third-party advertising networks
  • No sale of data to anyone
  • No email lists, newsletters, or account system
  • No tracking pixels or fingerprinting
  • No correlation across sessions or devices

Children

This application is not directed at children under 13. No personal data is collected from anyone, including children.

Your rights (GDPR / CCPA / similar)

Because this deployment holds no server-side user profile, data-subject rights are satisfied trivially:

  • Access / export. Your files live in your browser (File → Export as Markdown) or with the provider you connected (use the provider's export tools).
  • Rectification. Edit the file in the editor or in the provider.
  • Erasure. Clear your browser's site data, or delete the file from the provider.
  • Portability. Export as Markdown; it's already a portable format.

Server-side logs held by Vercel and Upstash are deleted on their own retention schedules; see their policies.

Contact

Privacy questions: open an issue at github.com/soreavis/stackedit/issues.

Changes

This policy is version-controlled in the repository. Material changes are noted in the CHANGELOG.

This policy is provided in good faith as an accurate description of the deployment's data handling. It is not legal advice.