Markdrip Privacy Policy

Version: September 9, 2026
Processing clarification updated: September 9, 2026
Applies when this notice is presented with the updated application. Earlier versions continue until replaced through the release process.

For a shorter, plain-language overview, see ourprivacy summary.

1. Who we are

Markdrip is developed by Markdrip.

For privacy inquiries, contact us at[email protected].

This policy covers the Markdrip desktop application and the website measurements described below.

2. Processing choices and your content

Content processing is on-device by default. Before the first connection, you review this policy. After acceptance, first-time setup makes a country-only request to Markdrip to choose regional usage-data controls. It sends no meeting content, license, installation identifier, or usage measurements. The server returns a country derived from the connection address and creates no reporting account or analytics record; the country is saved locally. UK/EEA and unknown regions require an unchecked opt-in. Confirmed regions outside EEA/UK default reporting on, with an opt-out in Settings → Privacy. An unavailable lookup leaves reporting off. Saved opt-outs and offline restrictions remain in force. Other service connections wait until you complete the service review. On-device processing is labeled Work offline and keeps Cloud processing: Off. AI processing stays on this device. Separately enabled service connections can still run. Licensing, update checks, and enabled usage reporting run independently of meeting processing. They contain no meeting content; their service data is described below.

Optional AI providers lets you choose an external service independently for supported tasks. Allowing service connections alone does not authorize content sharing. Each task identifies the recipient and what it needs to send and requires your specific, revocable permission. Only approved ordinary transcript words, minimal speaker labels and permitted text context may be sent. Recordings, voiceprints, acoustic information and voice-derived interpretations always remain on this device. No task permission authorizes sharing them.

Unavailable capabilities stay local. A provider preset does not silently substitute another external service. The service you select operates under its own retention, training, regional, and billing terms. You can stop future sharing or switch a task back to local processing; already transmitted data cannot be recalled by changing modes. A running content transfer must finish or cancel before on-device processing is confirmed.

Markdrip does not proxy, sell, or receive content sent directly to the provider you choose. Audio and voice data are never included in licensing or product telemetry. See the Biometric & Voice Data Notice for voice-data controls and participant-consent responsibilities.

A user-selected synced folder, other applications, and operating-system services may transmit data independently. Markdrip's mode does not disable networking for the whole computer.

Existing connection restrictions from an earlier version or an organization policy are preserved. A previous choice to stop every connection is not automatically relaxed; resuming service connections requires an explicit choice and remains subject to organization policy.

3. License and commerce communications

The desktop application's license service carries a deliberately minimal payload that includes no Tier 0 or Tier 1 content:

• At activation (once, when you first activate): your license key and a machine fingerprint (a device identifier bound to your license), so your paid license can be issued and bound to your device.
• On heartbeat (at most once per 24 hours, only when your device is already online): license validation only — an activation identifier, a timestamp and anti-replay nonce, and a cryptographic signature. No usage counters, no location data, no content of any kind.
• Licensing-security data. Where the licensing-security service is configured, it stores the connection IP encrypted in purpose-separated storage for trial enforcement, repeat-install abuse detection, rate limiting, and concrete security investigations. Only separately authorized investigators can access it for those purposes; it is not used for analytics, marketing, support tools, profiling, or visitor classification. Records are retained until a verified applicable deletion request requires removal: primary records and replicas are removed within 30 days, and affected backups age out within a further 35 days. A separate one-way-hashed abuse-prevention record is retained for at most 72 hours.

This license exchange never includes your audio, transcripts, notes, summaries, voiceprints, contacts, or any Tier 0 or Tier 1 content. License validation itself does not include product-usage data.

Product-usage measurement

The app sends pseudonymous, content-free usage measurements: integer counts of app openings, active days, completed recordings, feature actions, completed update checks, and updates found, plus current object counts in your vault. The service verifies Free/Plus edition. These measures describe participating installations, not individual people. No audio, transcripts, notes, summaries, voiceprints, speaker names, or other meeting content is included.

Regional default. Outside the EEA and UK, usage reporting is on by default. Inside the EEA and UK, it is off by default and requires your explicit opt-in. Unknown-region or unconfigured builds do not send usage data without a supported consent policy. No location request is made to choose a policy.

Opt-out. Turn usage reporting off — or on — at any time under Settings → Privacy & storage → Share basic usage data. Turning it off immediately stops future sends and clears any queued measurements on your device; it does not affect recording, transcription, local files, or your license. A "Delete previously shared data" button sends an authenticated deletion request for measurements already sent; a failed request remains retryable and does not re-enable reporting.

What the service receives. The app sends authenticated numeric measurements linked to a random installation identifier and authenticated with an install-specific key. The server observes the connection address and derives a coarse network prefix (/24 for IPv4, /48 for IPv6) and a two-letter country code, stored alongside the measurements for aggregate product analysis. This analytics channel never writes the raw connection address to a database, log, or export.

IP Geolocation attribution. Country-code derivation uses a third-party IP-to-country dataset. IP Geolocation byDB-IP — licensed underCC BY 4.0.

Retention. The pseudonymous measurement series is retained for 35 days. Aggregate statistics (thresholded, not linked to any install or person) are retained for 13 months. Reports suppress groups with fewer than 10 participating installations. Up to seven daily snapshots are queued on your device.

Timing and independence. Eligible usage reporting runs in the background, with at most one successful scheduled batch per UTC day. It does not send a request on every app opening. Turning it off does not disable licensing, local work, or your selected AI providers. Provider activity and costs stay in your local history and are not product-usage measurements. The desktop app loads no website pixel or analytics SDK.

Update checks

After you allow service connections, Markdrip checks for updates daily by default. You can turn this off or check manually in Settings → General. Checks contain no meeting content. Available updates download automatically when enabled. You choose whether to install an available update and when to restart. If basic usage reporting is enabled, numeric counters record completed update checks and updates found, without version strings or URLs. These checks work independently of the processing choice.

4. Optional Google Calendar connection

Google Calendar is an optional connection. It is off by default: we access it only after you choose to connect Google Calendar and select the calendars you want Markdrip to read. The connection requests only the read-only calendar.calendarlist.readonly andcalendar.events.readonly permissions. Markdrip cannot create, change, or delete your calendar events.

What we read and why

From the calendars you select, Markdrip reads event titles, start and end times, attendees, locations, and event descriptions (including join-link context). We use that information on your device to auto-title meetings and enrich their local meeting context. We do not read calendar data for advertising, profiling, product analytics, or any unrelated purpose.

Direct connection, local storage, and sharing

Calendar metadata travels directly from Google to your device under your Google account. Markdrip infrastructure is not in this data path, does not receive a copy of your event metadata, and does not share it with third parties. Access and refresh tokens are stored only in your operating system's keychain, not in your vault or on Markdrip servers. Event metadata used for meeting context stays local by default. If you separately authorize an external task that includes calendar context, its disclosed data scope controls that transfer.

Retention and disconnect

You can disconnect Google Calendar at any time. Disconnecting removes local keychain tokens and purges the local remote-calendar state and derived calendar context. Markdrip also asks Google to revoke the grant; this provider request is best-effort, so you can revoke access directly in your Google Account if it does not complete. Calendar access never authorizes audio or voiceprint sharing.

5. Purchases

Markdrip sells its plans directly. Stripe is our payment processor: it processes the checkout transaction on our behalf and is not the seller of the plan. Checkout is currently unavailable; this section describes the data handling that applies if you choose to purchase when checkout is enabled.

Checkout and billing data

Stripe processes your email address, billing name and address, payment-method details, browser IP address, selected plan, price, tax, currency, and recurring-charge consent. Stripe uses this information to complete the transaction, calculate tax, prevent fraud, manage a subscription, and provide a receipt. Markdrip receives and keeps the minimum commerce information needed to deliver and manage your license, provide billing support, reconcile payments, and meet accounting, tax, security, and legal obligations. We do not receive or store your full payment-card number.

We keep commerce records only for as long as needed for those purposes. Some purchase, payment, tax, fraud-prevention, and dispute records may be retained longer where law, regulation, or a valid legal request requires it. Closing an account or cancelling a subscription does not necessarily erase records that Markdrip or Stripe must retain for those purposes.

Recipients and international transfers

Stripe receives checkout and payment data as Markdrip's payment processor. Stripe may process that data in the United States and other countries and uses service providers to operate its services. Stripe publishes information about its data-processing terms,international-transfer safeguards, andservice providers. We will keep our processor and transfer records current before checkout is enabled.

Your choices and rights

For questions, access, correction, deletion, restriction, objection, or portability requests concerning commerce data, contact[email protected]. We will respond under applicable law and explain any record we cannot delete because of a legal, tax, accounting, security, or dispute-retention obligation. These requests do not affect your local meeting data, which remains on your device.

Commercial measurement

We do not collect a role field or segment commercial measurement by role at this launch. We do not infer a role from meeting, contact, support, license, or product-use data.

Previously saved refund feedback

Earlier versions let you save refund reasons and additional text on your Mac. Those records are not sent to Markdrip, Stripe, or the licensing service and are not used for central measurement. They become eligible for deletion 47 days after being saved and are removed at the next app startup. The current app directs subscription management to the portal and does not offer that feedback form.

6. Model downloads

In optional-connections mode, you may start explicit, user-initiated downloads of on-device models (for example, the first time you enable a feature that needs a model you do not have yet). These are downloads to your machine. They send a network request and connection metadata, but do not upload meeting content. You can see and control them from the Models settings panel; once a model is downloaded, using it requires no network connection.

7. What Markdrip does not do

• No meeting content shared by default. On-device processing keeps cloud processing off. Optional external tasks need specific consent; meeting content never enters licensing or product telemetry.
• No crash reporting that phones home.
• No hosted or third-party search — search runs against a local index.
• No account required to use the application.

The public marketing site, documentation and account portal use Rybbit to understand website use. Marketing measurements cover page visits, download clicks and interest in monthly or annual Plus pricing; selecting a price is not a purchase. Documentation and the account portal also use button-click measurements; documentation also collects website error diagnostics. Session replay is disabled on all three websites. Copied text, form interactions and outbound-link URLs are not collected. Rybbit stores a persistent visitor identifier in browser local storage and respects its browser-local opt-out. Pages with URL query parameters or fragments, including authentication returns, are not recorded; this also applies when a page's URL changes. Website measurement is separate from desktop usage reporting and does not receive your meeting recordings, transcripts or notes. The billing site and founder console do not load this tracker.

8. Voice and biometric data

After you enable voice memory through the one-time awareness step, Markdrip can automatically create and store voice fingerprints (mathematical representations of a person's voice) and short voice clips (up to approximately ten seconds) to recognize speakers across your meetings. This data may constitute biometric information under applicable law.

For complete details — including what is stored, why, how automatic recognition works, your controls, retention terms, consent, and the no-sale guarantee — see theBiometric & Voice Data Notice.

Retention

Voice data is retained on your device until you delete it. There is no automatic expiration. You control retention entirely through in-app actions (forget a person, erase all voice data, or discard individual samples).

Permanent destruction and uninstall

Deleting (uninstalling) the Markdrip application does not automatically delete your voice data or your meeting vault. The voice-data database and your vault remain on your Mac in their respective application-support and vault directories.

To permanently destroy all voice data before uninstalling:

1. Open Markdrip → Settings → Privacy.
2. Select “Erase all voice data” and confirm.
3. Uninstall the application.

Alternatively, you can manually delete the Markdrip application-support directory after uninstalling. The application provides an “Erase all voice data” control so that you can verify destruction before removing the app.

9. Data-subject rights

Because your data lives on your device, you exercise your rights directly in the application — no request to Markdrip is needed:

If you believe Markdrip is not honoring these commitments, contact us at [email protected].

10. Children's privacy

Markdrip is not directed at children under 13 (or under 16 in jurisdictions where that threshold applies). We do not knowingly collect personal information from children. If you believe a child has provided personal information through the use of Markdrip, please contact us at [email protected].

11. Changes to this policy

Any change that would introduce a new egress mode in the desktop application — new telemetry, product analytics, content sync, or a user-directed integration — will be reflected in a published update to this policy before that change ships. Material changes will be communicated through the application and on our website.

First-party website analytics on public marketing pages are governed by this policy and do not affect the desktop application's mode and consent guarantees (§2).

We will not expand content sharing without updating this policy and obtaining any consent required by applicable law.

Local external-service activity

Content-free activity records stay on your device: task, service, time, outcome, duration, provider-reported usage, and estimated cost with currency and price date. An estimate is not an invoice and missing usage is unavailable. Records contain no meeting content, names, credentials, or provider error bodies. Clearing them does not delete provider data or reset its bill. They are separate from product telemetry and are not automatically sent to Markdrip.

App Store privacy nutrition labels

For the purposes of App Store privacy disclosures:

• Meeting content is not collected by Markdrip. Audio, transcripts, notes, contacts, voice data, and search queries are excluded from licensing and product-usage measurements. A separately authorized external task may send its disclosed content directly to the chosen provider. Store disclosures must match the capabilities and behavior of the submitted version.
• Data Not Linked to You — pseudonymous usage data collected when enabled under the controls and retention periods in Section 3 (integer product-action counts and vault-object counts, linked to an install-specific key, not to your name, Apple ID, or account).
• Data Linked to You — license identifiers and purchase history; Stripe processes payment details for checkout.

This policy is published alongside theBiometric & Voice Data Notice and linked from the Markdrip application.