Security & data flow
This is the official, plain account of how Markdownly Anything handles your data. Standard file conversions run in your browser and are not uploaded. Only three opt-in features use a server — and this page lists exactly what each one sends, and to whom.
What runs on your device
Converting between Markdown and DOCX, PDF, EPUB, RTF, ODT, LaTeX, MDX, HTML, JSON and TXT happens entirely in your browser. The file you drop in is processed locally and is not sent to our servers. The editor, the local asset manager and your drafts are stored in your browser via IndexedDB; theme and language preferences use localStorage. The default voice dictation uses your browser's built-in speech recognition (see the note on voice below).
Data-flow at a glance
| Operation | Where it runs | What leaves your device | Who receives it |
|---|---|---|---|
| Standard file conversions (DOCX/PDF/EPUB/… ↔ Markdown) | Your browser | Nothing | — |
| Editor drafts & saved files | Your browser (IndexedDB) | Nothing | — |
| Web page import (by URL) | Server | The URL you enter | Our server (Cloudflare) fetches that page |
| Google Docs import | Server | The public share link | Google (the doc is fetched from docs.google.com) |
| Voice — default (Web Speech) | Your browser | Audio, handled by your browser's speech engine | Your browser vendor (e.g. Google) — not us |
| Voice — Whisper Cloud (Founder) | Server | The audio clip | OpenAI (Whisper API) |
| Sign-in (optional) | Server | Email, name | Clerk (authentication) |
| Payment (optional) | Stripe-hosted | Email, name, billing details | Stripe |
What we store — and what we don't
- Entitlements: your email address and which plan you bought (free, day-pass or founder) in a Cloudflare D1 database. Nothing else.
- Your documents: not stored. Standard conversions never reach our servers, so there is nothing to keep.
- Identity & payments: your sign-in identity is held by Clerk and your payment records by Stripe — we do not store card data.
- No analytics, no trackers, no ad cookies.
Web page import safety
The URL importer only fetches public web pages over http / https. It blocks private and internal network addresses (loopback, link-local and private IP ranges) and localhost, caps the request with a timeout and a size limit, and only accepts HTML pages. It runs on Cloudflare Workers, which have no internal network to reach. JavaScript-only pages that aren't server-rendered are reported back to you rather than silently mangled.
Third parties
Markdownly Anything works with a small, named set of providers, each only for its purpose:
- Cloudflare — hosting; sees standard request data (IP, user-agent) for delivery and bot/DDoS defence.
- Clerk — authentication; receives your email and name when you sign in.
- Stripe — payments; receives your billing details when you buy a plan.
- OpenAI — Whisper Cloud transcription only (a Founder feature); receives the audio clip you record.
- Google — when you import a Google Doc (the doc is fetched from Google) or import a Google-hosted URL.
- Google Fonts — the page loads web fonts from Google, which may log the connection.
Frequently asked
- Does Markdownly Anything upload my files?
- Not for standard file conversions. When you convert between Markdown and DOCX, PDF, EPUB, RTF, ODT, LaTeX, MDX, HTML, JSON or TXT, the conversion runs in your browser and the file is not sent to our servers. Only three opt-in features use a server: web page import, Google Docs import and Whisper Cloud voice.
- What data does Markdownly Anything send to a server?
- Only what a feature needs. Web page import sends the URL you enter (our server fetches that page). Google Docs import sends the public share link (the document is fetched from Google). Whisper Cloud sends the audio clip to OpenAI. Signing in sends your email and name to Clerk; paying sends your billing details to Stripe. Standard file conversions send nothing.
- Does the Google Docs import run locally?
- No. It is server-side: our server fetches the document from Google using the public share link you provide (no Google sign-in; the link must be set to ‘Anyone with the link’). Google sees that fetch.
- Is voice transcription local?
- The default dictation uses your browser's built-in speech recognition; in some browsers (e.g. Chrome) the browser sends the audio to its own vendor — that is your browser, not Markdownly Anything. The optional Whisper Cloud (a Founder feature) sends the audio clip to OpenAI's Whisper API, processed under OpenAI's terms.
- What do you store about me?
- For entitlements we store your email address and which plan you bought (free, day-pass or founder) in a Cloudflare D1 database — nothing else. We do not store your documents. Sign-in identity is held by Clerk and payment records by Stripe.
- Do you use analytics or tracking cookies?
- No. There are no analytics tools, no third-party trackers and no advertising cookies. Preferences such as theme and language are kept locally in your browser.
Last reviewed: June 25, 2026