Privacy Policy

Last updated: April 11, 2026

What md.page does

md.page converts Markdown into shareable HTML pages. You can use it anonymously (pages expire in 24 hours) or sign in with Google to get permanent pages under your own subdomain.

Anonymous pages

No account is required for anonymous pages. Each page is assigned a random 6-character ID and expires automatically after 24 hours. Once expired, the content is permanently deleted.

No password protection

Published pages are not password-protected or encrypted. Anyone with the link can view your page (unless you set it to private, which restricts access to the page owner). Do not publish sensitive, confidential, or personal information on public pages.

Accounts and authentication

When you sign in with Google, we store:

• Your Google ID, name, and profile picture — used to identify your account and display in the dashboard.
• A session cookie — an HttpOnly, Secure cookie (session) that keeps you logged in for up to 30 days. This cookie is scoped to .md.page and is not accessible to JavaScript.
• Your pages and metadata — page titles, doc names, visibility settings, view counts, and timestamps are stored in our database.
• API keys — if you create API keys, we store a cryptographic hash (SHA-256). The plaintext key is shown only once at creation and is never stored.

We do not store your Google password or access token beyond the initial authentication exchange.

Rate limiting

To protect against abuse, md.page enforces rate limits on publishing and page access. Automated scanning or scraping is not permitted.

Data we store

• Anonymous pages: Rendered HTML, stored in Cloudflare KV for up to 24 hours.
• Permanent pages: Rendered HTML and original Markdown source, stored indefinitely until you delete the page.
• Account data: Google ID, username, display name, avatar URL, and session data.
• Aggregate analytics: Anonymous event counts (page views, publishes) with no personally identifiable information.

Data we do NOT collect

• No browser fingerprinting
• No third-party tracking, advertising, or data sharing
• No email addresses are stored (only your Google ID)

Cookies

md.page uses the following cookies:

• session — authentication session (HttpOnly, Secure, SameSite=Lax, 30-day expiry)
• oauth_state — temporary CSRF protection during login (HttpOnly, Secure, 10-minute expiry, deleted after use)

No third-party cookies or tracking cookies are used.

Data deletion

You can delete your pages at any time from the dashboard or via the API. To delete your account entirely, please open an issue on GitHub.

Infrastructure

md.page runs on Cloudflare Workers and uses Cloudflare KV and Cloudflare D1 for storage. Cloudflare may process requests according to their own privacy policy.

Your responsibility

Do not publish content that is illegal, harmful, or that you do not have the right to share. Do not publish sensitive personal data, passwords, API keys, or confidential information on public pages.

Contact

md.page is open source. For questions or concerns, please open an issue on GitHub.