Privacy Policy

Who we are

This privacy policy covers freemarkdowntools.com (the "Service"), operated by Shashwat (the "Company", "we", "us", or "our"). If you have questions about this policy or your data, contact us at freemarkdowntools.com/contact.

Our five privacy promises

1. Your markdown never leaves your device — unless you ask it to. Every client-side tool (all ten Phase-1 tools) processes your input locally in your browser via JavaScript. For the few heavy tools that must fall through to a Cloudflare Worker (PDF, DOCX, Image conversion), we show an explicit notice before the conversion runs. Your content is processed and discarded within seconds, never stored, never logged.
2. We don't require an account. Ever. Every tool works fully for signed-out visitors. No email wall, no gated output, no upgrade pressure. Registration is an upgrade, never a gate.
3. We don't track what you type. No analytics event, no log line, no error report ever contains the raw content you paste into a tool.
4. We use one ad, shown honestly, with your consent. No retargeting, no cross-site profiling, no fingerprinting, no third-party tracking pixels beyond the single ad unit per page. Consent Mode v2 is on. If you deny consent, the ad slot shows a house ad instead.
5. You can see everything we know about you, export it, and delete it. Registered users get a one-click data export and one-click account deletion from their dashboard. Deletion is immediate — all database rows are hard-deleted, no 30-day cooling-off period.

What we collect

The complete list of data we collect, from both registered and unregistered visitors:

From unregistered visitors

• IP address — used only for rate limiting and abuse prevention. Hashed before storage. Expires with the rate-limit window (maximum 1 hour).
• User agent string — used for aggregate browser market share reporting in Cloudflare Web Analytics. Never associated with individual users.
• Referrer — where you came from (e.g. google.com, twitter.com). Aggregated.
• Consent choice — your choice of Accept All / Only Essential / Customize, stored in a first-party cookie (fmt_consent) for 1 year so we don't ask you again on every visit.
• Theme preference — your Light / Dark / Auto choice, stored in a first-party cookie (fmt_theme) for 1 year.

From registered users (in addition to the above)

• Email address — required for account creation, verification, password reset, and (opt-in) weekly usage emails.
• Password hash — we store the Argon2id hash, never the password itself. We cannot recover your password; we can only reset it.
• Display name — optional, shown on the dashboard.
• Session ID — an opaque identifier stored in an httpOnly cookie (fmt_session) for 30 days. Lets you stay logged in.
• Saved documents — if you opt in to saving a tool output to your history, the input and output are encrypted and stored in Cloudflare R2. We cannot read them.
• API keys — if you create an API key, we store the hashed version only. You see the raw key once at creation.
• Usage counts — tool slugs, byte counts, and response times for each API request. No content is stored with these metrics.

What we don't collect

• The content you paste into tools. Never.
• Raw IP addresses. Only hashed rate-limit keys, which expire.
• Browser fingerprints. No canvas fingerprinting, no font enumeration, no device identifiers.
• Cross-site tracking. No Facebook Pixel, no TikTok Pixel, no LinkedIn Insight Tag, no Reddit Pixel.
• Location data. We don't ask for it and we don't want it.
• Payment information. When paid features launch, payment data goes directly to Stripe or our payment provider. It never touches our servers.

Cookies

We use exactly four cookies, all first-party:

• fmt_theme — your theme preference (Light / Dark / Auto). 1 year. No PII.
• fmt_consent — your cookie consent choice. 1 year. No PII.
• fmt_session — session ID for registered users. 30 days. httpOnly, Secure, SameSite=Lax.
• An ad provider cookie — only if you consent. Managed by the ad provider (currently Google AdSense).

No tracking cookies. No analytics cookies (we use Cloudflare Web Analytics, which is cookieless). See our full Cookie Policy for details.

Legal basis (GDPR)

Under the General Data Protection Regulation (EU + UK), we rely on the following legal bases for processing personal data:

• Contract performance (Art 6(1)(b)) — for account creation, login, password reset, and API key issuance. We need this data to provide the service you requested.
• Legitimate interest (Art 6(1)(f)) — for abuse prevention (rate limiting, fraud detection) and aggregate analytics. We believe these processing activities are necessary and don't override your rights.
• Consent (Art 6(1)(a)) — for marketing emails, display ads with personalization, and any optional analytics. You can withdraw consent at any time.

Your rights

Under GDPR, CCPA (California), DPDP (India), and similar laws, you have the right to:

• Access — request a copy of all data we hold about you. Available instantly from your dashboard at /dashboard/privacy/export, or email us at [email protected].
• Rectify — correct inaccurate data. Use your dashboard to edit your display name, email, or password at any time.
• Erasure — delete your account and all associated data. Available instantly from /dashboard/privacy/delete. Deletion is immediate — all D1 rows are hard-deleted, R2 files are purged, and audit log entries are anonymized within 60 seconds.
• Portability — export your data in machine-readable format (JSON + ZIP of files). Same endpoint as Access.
• Object — opt out of legitimate-interest processing for analytics, or withdraw consent for marketing emails at any time.
• Withdraw consent — revoke cookie consent or email marketing consent at any time without affecting lawfulness of prior processing.
• Lodge a complaint — with your local data protection authority (e.g. ICO in UK, CNIL in France, BfDI in Germany, DPA in Ireland).

We aim to respond to all data subject requests within 24 hours. There is no fee for any of these requests.

California residents (CCPA / CPRA)

California residents have the right to know what personal information we collect, to delete that information, to opt out of the sale or sharing of personal information, and to non-discrimination for exercising these rights. We do not sell personal information. We do not share personal information for cross-context behavioral advertising.

To exercise your California rights, email us at [email protected] or use the Do Not Sell or Share link in the footer of every page.

Do Not Sell or Share My Personal Information

We do not sell personal information. We do not share personal information with third parties for cross-context behavioral advertising. This clarification exists because California law requires us to provide an opt-out link on every page even when we don't sell data.

Third-party services

We use a small number of vendors to run the site. Each has its own privacy policy:

• Cloudflare — hosting, CDN, edge compute, storage, bot protection. Cloudflare Privacy Policy.
• Cloudflare Web Analytics — cookieless aggregate analytics. No personal data, no cookies.
• Resend — transactional email delivery (signup confirmation, password reset). Resend Privacy Policy.
• Google AdSense — only if you consent. Ads are shown using Consent Mode v2 with non-personalized defaults in EEA/UK/CH. Google Privacy Policy.

Data retention

• Tool content (input and output) — never stored. Processed in the browser or Worker, then discarded. Zero retention.
• Usage metrics — 90 days rolling. Aggregated into monthly totals after that; raw rows are purged.
• Account data (email, display name, password hash) — retained until you delete your account.
• Saved documents — retained until you delete them or your account.
• Audit log — 2 years, for security forensics. Anonymized on account deletion.
• Rate limit counters — maximum 1 hour (the length of the rate-limit window).
• Consent / theme cookies — 1 year from last update, or until you clear them.

Children

The Service is not directed at children under 13 (or 16 in the EU). We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us with personal information, contact us at [email protected] and we will delete the data.

Data transfers

We operate on Cloudflare's global edge network. Your data may be processed in any of Cloudflare's data center locations. Transfers outside the EU/EEA are covered by Cloudflare's Standard Contractual Clauses. Our email provider (Resend) is US-based; transfers are covered by SCCs.

Changes to this policy

We may update this policy from time to time. When we do, we'll update the "Last updated" date at the top of the page. For material changes that affect your rights, we'll notify registered users via email at least 30 days before the new policy takes effect.

Contact us

Questions, concerns, or requests about this policy? Email us at [email protected] or use our contact form. For general support, see Contact. To report a bug, use Bug Report.