Privacy Policy — Markd.ly

• Markd.ly sends a document to our servers only when you use a feature that does so: adding it to the cloud library, keeping it in a synced folder, or, on Mac and Windows, exporting it to Word, EPUB, LaTeX or slides. From Markd.ly 1.12 for iPhone and iPad, new documents and Quick Notes go into folders that sync. Each feature is described below. • What you keep in the cloud is private to your Bravely Account. We do not sell it or use it for advertising, and Markd.ly does not send your documents to any AI provider. • An encrypted document file is never uploaded, and we never receive its passphrase. • The apps also send usage analytics (which you can turn off), records of setting up and trying Markd.ly, error reports and diagnostic reports. They describe how the app is used and how it is working, not what you write, although an error message or a file's name can find its way into some of them, as described below. • Deleting a document from the cloud erases its text from our live database at once, and deleting your Bravely Account deletes all of your Markd.ly cloud data. Copies made before then stay in our database's recovery history for up to 30 days and in our encrypted backups for up to about 13 months, as described under "Data Retention".

Markd.ly opens and saves ordinary files where you keep them, and reads only the files and folders you open or choose to sync, or that an agent you connect asks for. On each device it also keeps your settings, recent files, favorites, snippets and styles; copies of the documents you have open, including unsaved changes, so your work survives a crash or a restart; the app's own logs and crash records; and your Bravely Account session, in the device's protected storage: the Keychain on Mac, iPhone and iPad, encrypted storage protected by the Android Keystore, Windows data protection for your user account, and files only your user account can read on Linux. None of this is sent to us except as this policy describes. Backups and transfers made by your device can include what Markd.ly keeps: on iPhone and iPad, a backup to iCloud or a computer can include documents saved in Markd.ly's own folders and its crash record; on Android, a backup to your Google account or a transfer to a new device can include text you shared into Markd.ly, its copies of unsaved documents and error reports waiting to be sent. Those backups and transfers are between you and the company that provides them, and we do not receive them.

The Mac, Windows and Linux apps can encrypt a document on your device with a passphrase you choose, using AES-256-GCM with a key derived from the passphrase. We never receive the passphrase and cannot recover it; on a Mac you can choose to save it in your Keychain. An encrypted file is never uploaded: the apps will not add it to the cloud library, and synced folders skip it. Once you unlock a document it is ordinary text in the editor, so if you then add it to the cloud library or export it, the unlocked text is what is sent, and while it is open the copies of open documents described above hold it unencrypted on your device. The iPhone, iPad and Android apps do not encrypt documents.

You need a Bravely Account to use Markd.ly on every platform; only the command-line converters in the Windows and Linux apps work without one. How you sign in, what your account holds, and your sessions and purchase records are covered by the Bravely Account policy at bravely.dev/privacy/bravely-account. We know you by your Bravely Account identifier and never use your email address as the customer identifier. If you create your account with Sign in with Apple in the Mac, iPhone or iPad app, that app asks whether you want marketing email (in the United States the box starts ticked) and, if you say yes, sends your email address and that choice to our marketing system, as described at bravely.dev/privacy/bravely-newsletter. The apps check what you have access to with our account service, which looks up your purchases and trials by your Bravely Account identifier. The Windows and Linux apps also check with our purchase-validation provider directly, and the iPhone, iPad and Android apps use that provider's library for App Store and Google Play purchases. The library starts when the app opens and identifies you to that provider by a random identifier until you sign in and by your Bravely Account identifier from then on, which it can keep on the device after you sign out. A confirmed purchase is remembered on the device for up to 72 hours, so Markd.ly keeps working offline. On the web and in the Mac, Windows and Linux apps, you buy on our merchant of record's checkout page, which takes the payment and handles invoicing and tax; we never see your card details. In the iPhone and iPad app you buy through the App Store, and in the Android app through Google Play. We receive the record of your purchase, not your payment details, and it unlocks Markd.ly on every platform. If you start the free 24-hour trial, extend it, or use the 60-minute pass that lets you try the cloud library during setup, we keep a record of it; the trial is offered once per account. In the iPhone and iPad app, our purchase-validation provider also receives a token from Apple that lets it ask Apple whether you installed Markd.ly after tapping one of our ads in the App Store, and if so which campaign and search keyword it was. The token does not name you, but once you sign in the answer is kept with your Bravely Account identifier. Markd.ly does not use your device's advertising identifier.

If you ask us to email you Markd.ly’s download links on bravely.dev/markdly/download, we use your address to send that one email; it doesn’t sign you up for anything. For this, we don’t store the address itself: we keep a record of the request with a keyed fingerprint of your address and of the network address the request came from, so we can limit repeat requests, look into abuse and honor delivery blocks. We keep that request record until you ask us to delete it; the fingerprint of your address and a record of the email we sent stay after that, so we can keep honoring delivery blocks. If you’ve ever subscribed to our emails with the same address, or you later subscribe or create a Bravely Account with it, these records are linked to that address. Our email delivery provider keeps its own delivery log of the email, including your address and the subject line.

The cloud library, in every Markd.ly app, lets you open a document on your other devices. A document is added only when you choose Add to Cloud, and its cloud copy changes only when you update it or, in some of the apps, when you rename a document whose cloud copy is up to date. For each document we store its text, its name, its size, a fingerprint of its text, a version number, when it was added and last changed, and the name of the device that last changed it: your computer's name on Mac, Windows and Linux, just "iPhone" or "iPad" on those devices, and the maker and model on Android. Deleting a document on your device leaves its cloud copy in place; Remove from Cloud deletes it. Opening, downloading and removing cloud documents need only your account; adding and updating them need access to Markd.ly.

Markd.ly for Mac 1.7 and Markd.ly for iPhone and iPad 1.12 add sync, which keeps folders the same on each of your devices by passing their documents through our servers in the background: while the app is open and, on iPhone and iPad, also when the system briefly wakes the app. Sync works while your Bravely Account has access to Markd.ly. • On a Mac, you choose each folder to sync with Sync with Markd.ly Cloud. Markd.ly uploads the markdown files in it and, from then on, every change, rename, move and deletion. Folders you sync from a Mac are downloaded to your iPhone and iPad as well. • Your Notes, Quick Notes and Agent Inbox folders always sync. On a Mac they are kept in the Markd.ly Cloud folder, which you can move in Settings. • On iPhone and iPad, what you create in Markd.ly goes into folders that sync: each new document into Notes, and each Quick Note into Quick Notes, whether you write it in the app, with Siri, Shortcuts or the Action Button, from a widget or Control Center, or by sharing text, a link or a markdown file to Markd.ly. A Quick Note written before you sign in starts syncing once you have signed in and have access to Markd.ly. A document you open from the Files app stays with the service that provides it and is not added to Markd.ly's sync, though that service, such as iCloud Drive, may sync it on its own. If you dictate a Quick Note, Apple's speech recognition turns your voice into text, on the device where it can and otherwise on Apple's servers; we receive only the text. • Only markdown files sync (names ending in .md, .markdown, .mdown, .mkd, .mkdn or .mdx). Hidden files, symbolic links, files larger than 1 MB (1,048,576 bytes), files that are not plain text, and common build and dependency folders are skipped. For each synced document we store its text, which synced folder it is in and its path inside that folder, its name, its size, a fingerprint of its text, version numbers and change times, the name of the device that last changed it, and an identifier for the Markd.ly installation that made the change. For each synced folder we store its name and the name of the device it was first synced from. Each device keeps a record of what has synced, including the last version both sides agreed on, so that edits made on two devices can be combined. When they cannot be, the document keeps the version from the cloud and your version is saved beside it as a conflict copy, which syncs like any other file. Deleting a synced document on one device deletes it from the cloud and from your other devices (on a Mac, into the Trash), unless another device changed it in the meantime, in which case that version is kept. On a Mac you can pause sync in Settings. Stop Syncing on This Mac stops a folder syncing on that Mac and leaves it in the cloud; Remove from Cloud deletes it from the cloud, and the copies already on your devices stay where they are. Signing out stops sync and keeps every file on the device. On iPhone and iPad, if a different account signs in afterwards, the previous account's synced files are moved aside to a separate folder on the device.

Markd.ly for Mac 1.7 lets AI agents that you run on your Mac, such as command-line coding assistants, work with Markd.ly through a helper built into the app. The helper talks to Markd.ly over a connection that stays on your Mac and that only your user account can use. The Connect buttons in Settings, under Agents, add the helper to an agent's own settings on your Mac. Through the helper, an agent can open documents in Markd.ly, read markdown files, list recent files in your favorite folders or in a folder it names, create or change markdown and text files if you turn on Allow agents to write files (off by default), and send you questions, or a draft to review, and wait for your answer. Markd.ly does not send your documents or your answers to any AI provider. The agent receives what it reads and the answers you send it, and what it does with them, including anything it sends to the company that runs it, is governed by that agent's own terms and privacy policy, not this one. Each question or review is a document in your Agent Inbox, which syncs like the folders above: the request, and your answers when you send them, are stored in your cloud and appear on your other devices, and an answered request records the name of the device you answered on. From each request we also keep a short index so we can list it and notify you: its title, the names of the agent and project that sent it, how many questions it has, whether it is meant for your Mac, your iPhone or both, whether it is open, answered or cancelled, and when. Send agent questions to my iPhone, in Settings, decides when your iPhone is also notified of a request: When I'm away, the default, notifies it once your Mac has been idle for five minutes or its screen is locked, which the Mac works out on its own; Always and Never do what they say. The Mac app can also show its own notifications about agent questions; those are made on the Mac and do not pass through our servers. In Markd.ly for Windows and Linux, and in Markd.ly for Mac before 1.7, the setting that lets agents edit files only prepares files on your computer for an agent tool you install yourself; on Windows and Linux, while it is on, the open document's location and text are written to a file on your computer for that tool to read. Nothing from it is sent to us.

From Markd.ly for iPhone and iPad 1.12, the app registers the device with our servers each time it opens while you are signed in: the platform, the app's identifier and version, the device's name (on iPhone and iPad this is just "iPhone" or "iPad"), an installation identifier, when it was last seen, and whether notifications and previews are on. The app asks whether it may send notifications only when you first open the Agent Inbox or turn them on in Settings. If you allow them, the registration also holds the push token Apple gives your device, and we send notifications through Apple's push service when an agent sends you a question or a review meant for your iPhone, or when you ask for a test notification. A notification names the agent and says whether it has questions or a draft for you to review, for example "Your agent has 3 questions". While the setting that shows titles in notifications is on, which is the default, it also shows the request's title and project; with it off, those are hidden and the rest of the notification says only "Open Markd.ly to answer" or "Open Markd.ly to review." Each notification also carries identifiers for the request and its document, so the app can open it. A notification never contains your answers. When you sign out, the app asks our servers to remove the device's registration; if that request fails, the registration stays until a later request succeeds or you delete your account. When Apple tells us a push token no longer works, we delete it.

In the Mac and Windows apps, exporting to Word (DOCX), EPUB, LaTeX or slides sends the document's text to our conversion service at bravely.dev, which converts it on a server we run and sends the file back; the Mac app sends it before asking where to save. The request carries the document's text, the format you chose and your account session, not the document's name; we convert the text in memory and do not store or log it. On a Mac, the converted file is written to a temporary file on your Mac before you choose where to save it, and stays there if you cancel. Every other export is made on your device: HTML and PDF on every platform that offers them, all exports in the Linux app, which includes its own converter, and the command-line converters in the Windows and Linux apps.

The apps draw documents with the code, styles and fonts built into them and load none of those from the internet. If a document includes a picture from the web, the app fetches it from the website that hosts it whenever it shows the document or makes a PDF of it, as a web browser would, and that website receives your IP address and the usual details of the request. Markd.ly opens a link only when you choose it.

Unless you turn it off, each app sends usage analytics so we can see which features are used and what goes wrong: for example that the app was opened or updated, a document was opened, saved, exported or added to the cloud, a setting was changed, sign-in or checkout started or failed (with the error message), or a purchase screen was shown. Each event carries the app version and platform, a random installation identifier and, on most platforms, the system version, and, once you have signed in, your Bravely Account identifier, which also links the events from before you signed in to your account. No event is meant to carry your email address or the text of your documents, but an error message can contain personal details. They go to our analytics provider, and some also go to our own account service. Some apps send more: • Android: the analytics library also records the screens you open and when the app starts and stops, together with the device's model and model code, mobile carrier, language and time zone. • Windows: when the app crashes, the event includes the error's own message, which can include a file's name or location. • Linux: when you expand a snippet, the event includes the snippet's shortcut as you typed it. You can turn usage analytics off at any time in Settings: on Mac, Windows and Linux under General, Privacy, with Share usage analytics (on Windows, then choose Save settings); on iPhone and iPad under Privacy, with Share anonymous usage analytics; and on Android under Privacy & Support, with Share usage analytics. That stops these events from that device. It does not stop the setup and trial records, error reports or diagnostic reports described below, which have their own rules.

The apps also report the steps of getting started with, trying and buying Markd.ly to our account service: for example that the welcome or sign-in screen was shown, which setup steps you completed or skipped, which option you chose on the trial and plan screens, when you reached the app, and when a trial started, was extended or ended. Each record carries your Bravely Account identifier (steps taken before you signed in are sent once you do), the app, platform and version, an installation identifier and the time, and never anything you typed. We need these records to run your trial and to help you when something goes wrong, so they are sent whatever your analytics setting is. Our account service also records the sign-in, trial and purchase steps it handles itself and passes them to our analytics provider. Most of the apps also ask our servers which country your connection comes from, to set the default for error reports.

When something goes wrong, the apps can send a short error report: the kind of error, its message with common patterns for email addresses, file paths and tokens removed, the app, platform and system versions, counts, and whether you were signed in, had access and were online. Reports from some apps also include the top of the error's stack and the last few things the app did. A report has no field for your account identifier or email address, and we do not store its IP address. Instead of an identifier for your device it carries a code that changes every day, and we group reports of the same error, including across days, to diagnose it. Common patterns for personal details are removed from messages, but some, such as a file's name, can remain. In the EEA and the UK, error reports are off until you turn them on; elsewhere they start on. You can turn them off in Settings with Send anonymous error reports automatically. Markd.ly for Linux before version 0.7.5-beta.2 does not follow these rules: it sends error reports in every region, and turning its switch off does not stop them.

A diagnostic report helps us fix a particular problem. The apps send one when you choose Send Diagnostic Report in Settings: it is sent as soon as you choose it, without a preview, and gives you a short code to pass to support. The Mac, Windows, Linux and Android apps also send one on their own, at most once an hour for each kind of problem, after a crash or a failed export, or when saving, restoring your sign-in or checking your access keeps failing, unless you turn off Send diagnostic reports when something goes wrong (in some versions it is called Send anonymous diagnostic reports when something goes wrong). Whatever the switch is called, every diagnostic report is sent with your account session, so it is linked to your Bravely Account. Versions that send our newer diagnostic reports, described below, can also send one, under the same switch and hourly limit, when the app stops responding for 5 seconds or more, or the next time you open it after it closed unexpectedly. A report holds the app and system versions, how many documents were open, recent save failures, on some platforms a few of your settings, and the app's recent log lines (in the Linux app, up to seven days of them), with common patterns for email addresses, sign-in tokens, network addresses and your home folder's name masked before they are sent, though parts of an address, a file's name or its location can remain. In versions that send the newer reports, a report can also hold: • A record of your recent activity in the app: the names its code gives to its screens and to events such as signing in, changing a setting, the network going offline or a key press the app ignored, with details limited to numbers, yes-or-no values and fixed words that the app's code defines, such as a count or which part of the app something started from. Any other word is left out, so the record is built to leave out names, what you typed, which keys you pressed, file names, addresses, identifiers and the contents of your documents. The app keeps this record, up to its latest 200 entries, only in its memory while it runs, and it leaves your device only inside a diagnostic report. • The state of the app when the report was made. For example: the screen, dialog and tool you were using, what kind of control your typing would go to, what kind of item was selected and how many, and which kinds of window were open. It also shows the state of the network, whether you have an active plan or trial, how long the app had been running and, in apps that sync, the state of sync. In some apps, it shows whether the app has the system permissions it uses. In apps with system-wide keyboard shortcuts, it can show up to eight of them, with the keys each is set to and whether it is working, and how long ago the app last noticed any key being pressed. Like the record, it holds only numbers, yes-or-no values and fixed words, never titles, names or text. • Your display and time zone: the size in pixels and the scale of the display the app is on, and the difference between your time zone and UTC; on a computer, how many displays you have; on Windows and Linux, the version of the software framework the app runs on; and on Linux, which desktop you use and whether it runs on X11 or Wayland. • Up to 50 recent warnings and errors, each with a description with details removed and, where it has one, a short code, and how many warnings and errors the app had recorded. • How the app's previous session ended (normally, in a crash, or unexpectedly, for example because it was forced to quit), with its version, how long it ran and the main steps it recorded, such as starting up. To know this, the app keeps a list of those steps in a file on your device, which it starts again each time it opens. Those versions also remove text in common quotation marks, the names of document and media files they recognize by their endings, and your user and computer names from log lines, though some details, such as a name they do not recognize, can still appear. If you have turned off usage analytics, their reports leave out the record of your activity and the previous session's list of steps, carrying instead a note that the record was left out and a few counts: how many entries the app recorded, combined or dropped to stay within its limit, how many event names or details its filter refused or replaced, and how many times the signed-in account changed; the rest, including the state of the app and the previous session's last step, is still sent. When a different account signs in, they first discard everything they recorded for these reports until the previous account signed out (or, with no sign-out, until the switch), keeping only a count of how many times the account has changed since the app started; what they recorded while no one was signed in, such as the steps of signing in, can appear in the new account's reports. With each report we record your Bravely Account identifier, the app's user agent and the country your connection came from.

The Mac app checks bravely.dev for a new version once a day and offers it to you. The Windows and Linux apps check when they open and every 12 hours, download new versions in the background and install them the next time they start. An update check sends the installed version and, from Windows and Linux, the operating system and processor type; it carries no account or installation identifier. You can check for updates yourself and choose beta versions in Settings, but you cannot turn automatic checks off. When an app downloads an update, and when you download Markd.ly from our website, we record the download: the file and its version and platform, the country your connection came from, the user agent, the page that linked to it, and an identifier calculated one way from your network address and browser details, so we can count repeat downloads without keeping the address. A download from our website also sets a cookie, kept for up to a year, that identifies your later downloads to us. The iPhone, iPad and Android apps are updated by their app stores.

Signing in, checking your access, the cloud library, sync, device registration and exports send the request details needed to run them, such as your account session, the app version, your network address, and connection or error details. Request logs used to operate the service are kept for a short period and then expire.

Markd.ly does not collect your precise location, contacts, calendars or photos, your device's advertising identifier, your card details, or your browsing outside the app. It uses the microphone only while you dictate a Quick Note, and that audio goes to Apple's speech recognition, not to us.

• On your devices: documents, settings, copies of open documents, logs and sync records stay on the device until you or the app removes them, or you remove the app. Signing out does not delete your files. • Cloud documents, in the cloud library and in synced folders, stay until you delete them or delete your Bravely Account. Deleting one erases its text from our live database at once; copies made before then remain for a while, as the next point describes. We keep a record that it was deleted, with its name, where it was, a fingerprint of its last text, the name of the device that last changed it and when, so that your other devices can remove their copies; that record is deleted with your account. • Our database keeps a recovery history for up to 30 days, and our encrypted backups keep a copy of the database from each night for about four months and one copy each month for about 13 months, as described under "Backups" below. We use the recovery history only to restore the database after a failure, and the backups only to restore lost data and to test that restoring works. Deleted text can remain in them until they expire, up to about 13 months after you delete it, and is then gone from our systems. • Request index entries stay until you delete your account, even after their documents are deleted. • Device registrations stay until they are removed when you sign out on that device, or until you delete your account. We also keep a log of notification attempts for your account (whether it was for an agent request or a test, which request or device, and when) to limit how many go out; older entries are cleared when a later notification is attempted, and all are deleted with your account. • Text sent for conversion is not kept. • Diagnostic reports: the log bundle, which in the newer reports also holds the record of your activity, the recent warnings and errors and any steps from the previous session, is deleted after 90 days. The rest of the report is kept so we can see patterns across reports: its code, your account identifier, the versions, the user agent and country, when it was sent, and, in the newer reports, the state of the app, your display and time zone details, how many warnings and errors the app had recorded and, if it had recorded any, a short label for the most recent error (or, if there was none, the most recent warning), and, where the app records it, how the previous session ended and its last step. If our team attaches a report to an issue in our own issue tracker, whose data Google stores for us, the issue keeps the report's code (or its number), the app and platform, the versions, whether it was sent by hand or automatically, when it arrived and, for a newer report, a one-line summary of what it shows, even after the report itself is deleted. It stores the sender only as "customer account" unless the sender is a member of our team, and while the report and the sender's account exist, our team can see the sender's email address when they view the issue. Deleting your Bravely Account deletes your diagnostic reports from our live systems; our data warehouse keeps the rest of each report, without the user agent and country, under your account identifier. • Error reports: individual reports are deleted after 30 days. We keep a summary of each kind of error: its cleaned message, where in the app it happened, the versions it affected, when it was first and last seen, how often it happened, and a sample of the last things the app did before it. • Usage analytics and setup and trial records are kept without a fixed end date, so that long-term statistics stay accurate. • Request logs expire after a short period. Deleting your Bravely Account deletes all of your Markd.ly cloud data: your cloud library, your synced folders and their documents, Notes, Quick Notes, and the Agent Inbox with its request index, and your device registrations and push tokens. In the iPhone, iPad and Android apps you can delete your account in Settings with Delete Account; from any other device, email privacy@bravely.dev from the address on your account. Deletion happens when the 30-day grace period described in the Bravely Account policy ends; until then, signing back in keeps everything. It does not touch the files on your devices, and copies made before it stay in our encrypted backups until they expire, as described above. Afterwards, usage analytics and setup records stay under your account's identifier with your email address and name replaced, as the Bravely Account policy describes; the payment provider or app store that handled a purchase keeps its own record of it. To have something deleted without deleting your account, or for any other request about your data, email privacy@bravely.dev.

Markd.ly is not directed at children. We do not knowingly collect personal information from children under 13, or under 16 where 16 is the relevant age for information-society services. If you believe a child has given us personal information, email privacy@bravely.dev and we will delete it.

We keep backups so that we can recover our customers' data if it is ever lost. Each night we copy the databases that hold accounts, purchases and the content our apps and services keep for their users, including sign-in records and the protected form of passwords, and we copy the files stored with us, such as documents, screenshots and attachments. Unless a section above says otherwise, the account, purchase and content records this policy describes, and the files you store with us, are in these backups. Where backups are kept Backups are kept in two places, both in the United States: on storage equipment that we own, and in Amazon S3, a storage service run by Amazon Web Services. Every copy of a database or of sign-in records is encrypted, with a key that only we hold, before it is stored in either place. The copies of stored files that we keep in Amazon S3 are also encrypted with a key that only we hold, file names included; the copy of those files on our own equipment is not separately encrypted. Amazon does not have our keys, so it cannot read your data in the backups. How long backups are kept Each night's copy of our databases and sign-in records is deleted after 90 days and fully purged within 30 days after that, so it is kept for about four months at most. One copy each month is kept for up to 12 months instead, and fully purged within 30 days after that, so it is kept for about 13 months at most. The backup of stored files keeps each file for as long as it is stored with us; when a file is deleted or replaced, the backup keeps the earlier version for 90 days and then deletes it. Separately, Cloudflare, which runs most of our databases, keeps a recovery history of each of them for 30 days. How backups are used We use backups and that recovery history only to restore data after it has been lost, for example in an outage, through a mistake or in an attack, and we also use backups to test that restoring works. Deleting something, or deleting your account, does not remove it from backups made before the deletion or from the recovery history: those copies stay until they are deleted on the schedules above. If we restore data from a backup or from the recovery history, we re-apply the deletions made after the point we restore to, including account deletions, so that the restore does not bring back data that had been deleted.

Depending on where you live, you have rights over the personal data we hold about you. We honor these rights for everyone who asks, regardless of where you live. • Access — ask what personal data we hold about you and get a copy. • Correction — ask us to fix data that is wrong or incomplete. • Deletion — ask us to delete your personal data by emailing privacy@bravely.dev from the address on your account. Where a product has a built-in Delete Account control you can use that instead; bravely.dev/delete-account explains what applies to each product. • Portability — ask for your data in a portable, machine-readable format. • Objection and restriction — ask us to stop or limit certain processing. • Withdraw consent — where we rely on consent (for example, marketing email), you can withdraw it at any time without affecting processing that already happened. • Non-discrimination — we will not degrade your service or charge you more for exercising any of these rights. EEA and UK residents also have the right to lodge a complaint with your local supervisory authority. California residents may use an authorized agent; we may verify the agent's authority and confirm the request with you first. Other US states with comprehensive privacy laws (including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and others as they take effect) have equivalent rights, including a right to appeal a denied request — reply to our decision email with "Appeal" and we will respond in writing within the period the law requires. Canadian residents have access, correction, and consent-withdrawal rights under PIPEDA; Australian residents have access and correction rights under the Australian Privacy Principles. To exercise any right, email privacy@bravely.dev. We respond within the timeframe the applicable law requires — generally 30 days under GDPR and 45 days under the CCPA, with an extension where the law permits one. We may need to verify your identity before acting, usually by confirming control of the email address on the account.

If you are in the EEA or UK, we rely on these lawful bases under the GDPR and UK GDPR: • Performance of a contract — creating and securing your account, delivering the features you paid for, syncing your content, processing purchases, and providing support. • Legitimate interests — keeping the service secure and reliable, preventing fraud and abuse, understanding how our products are used through usage events tied to an installation or to your account, and improving the product. We balance these against your rights and do not use them to justify intrusive tracking. Where an app lets you turn its usage analytics off, doing so is one way to object. • Consent — marketing email, and anything else we ask your permission for before we collect it. You can withdraw consent at any time. • Legal obligation — keeping tax, accounting, and consent records, and responding to lawful requests.

Bravely Studios LLC is a US company. We and our sub-processors process data in the United States and in other countries where they operate. For personal data originating in the EEA, UK, or Switzerland, we rely on appropriate transfer safeguards in our processor agreements — such as the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum — where those safeguards are required. Email privacy@bravely.dev if you want more detail about the safeguards that apply to you.

For California residents, the categories of personal information we collect for this product are: • Identifiers: your Bravely Account identifier and email address, installation identifiers, the names of the devices you use with the cloud features, and, if you turn on notifications, your device's push token. • Commercial information: records of your purchases, plans, trials and refunds, and, for iPhone and iPad installs that came from one of our App Store ads, the campaign and search keyword. • Internet or other electronic network activity: usage events, setup and trial records, app and system versions, error and diagnostic reports, download records, and request details such as your network address. • Coarse geolocation: a country-level signal derived from your network connection, used for consent defaults and tax and recorded with downloads and diagnostic reports. • Your content: the documents you add to the cloud library or keep in synced folders, including Notes, Quick Notes, and agent questions with your answers, and the text of documents you send for conversion when you export, which is not kept. We collect this from you, your device, and our own systems, and we use it to run the product, honor what you have bought, keep the service secure, and support you. We disclose it to the service providers listed under "Sub-processors," each for a business purpose under a written contract. We do not sell your personal information and we do not share it for cross-context behavioral advertising, as those terms are defined by the CCPA and CPRA, and we have not done so in the preceding 12 months. We do not use or disclose sensitive personal information for any purpose that would trigger the right to limit. If that ever changes we will update this policy and provide the required opt-out before the practice begins. Retention is described under "Data Retention" and "Backups" above and, for account-level data, in the Bravely Account privacy policy.

We use the following service providers to run this product. They receive only what they need to perform their service for us, and each is bound by the data-processing terms that apply to our use of their service. Where a provider is not yet covered by a written data-processing agreement with us, its entry below says so. If you need a data-processing agreement in place before you use this product, email privacy@bravely.dev: • Cloudflare, Inc.: hosting, the Workers runtime, D1 databases, R2 object storage, and bot protection for bravely.dev and our app subdomains. See cloudflare.com/privacypolicy. • Google LLC: Firebase Authentication, which backs Bravely Account sign-in (including Sign in with Google). See policies.google.com/privacy. • Apple Inc.: Sign in with Apple, and App Store purchase and receipt handling for our Apple platform apps. See apple.com/legal/privacy. • Paddle.com Market Ltd: our merchant of record for purchases made on the web or in our desktop apps. Paddle handles checkout, payment processing, invoicing, and sales tax/VAT. When you open a checkout while signed in, we give it your email address; otherwise you enter it on Paddle's checkout page. Each purchase carries the app it is for, any campaign tags on the link that brought you to checkout, and either your Bravely Account identifier or, for a purchase made before you had signed in, a temporary identifier that we link to your account when you claim the purchase. As the seller of record, Paddle keeps its own records of your purchases. See paddle.com/legal/privacy. • RevenueCat, Inc.: keeps the purchase record for each Bravely Account. It validates App Store and Google Play purchases and reports subscription changes, and we also record trials and web and desktop purchases with it, so we can unlock what you bought on every platform. We identify you to it by your Bravely Account identifier. The first time you sign in with Apple or Google, and on some other sign-ins, we also send it your email address, your name (when the sign-in provides one), your country and the app you signed in from. Some apps also record with it the name of the device you use, and a few older parts of our service identify you to it by your email address instead. See revenuecat.com/privacy. • PostHog Inc.: product analytics. Our apps, some of our websites and our account service send it usage events, such as which features are used and the steps of signing in, starting a trial and buying, and our websites and web apps also send it recordings of how their pages are used. An event carries an identifier for the installation or browser it came from, your Bravely Account identifier, or both (most apps add your account identifier once you have signed in); a few events, such as a failed sign-in or a purchase made before you had signed in, carry an identifier for that one request or purchase instead, and some copies of app events that reach it through our account service carry only a shared identifier for the app and platform. PostHog receives the network address each event was sent from. A few apps also send it your email address, and a few older parts of our service identify you to it by your email address instead. The Bravely Account policy describes this under "Usage and Purchase Analytics". See posthog.com/privacy. • Resend Inc.: sends our transactional email (sign-in codes, receipts, password resets, support replies). See resend.com/legal/privacy-policy. • Amazon Web Services, Inc.: Amazon S3, which stores our backups in the United States, as described under "Backups". The copies of your data that we keep there are encrypted, with a key that only we hold, before they leave our systems, so Amazon cannot read them. See aws.amazon.com/privacy. • Google LLC: Google Play, which distributes our Android apps and handles purchases and subscriptions made in them, including payment and refunds under Google's own terms, and confirms each purchase to RevenueCat, which tells us. See policies.google.com/privacy. • Apple Inc.: the Apple Push Notification service, which delivers Markd.ly notifications to iPhone and iPad from Markd.ly 1.12 and receives each device's push token and the text of each notification; attribution for our App Store ads, described under "Your Bravely Account and Purchases"; and speech recognition, when you dictate a Quick Note and your device cannot turn speech into text by itself. See apple.com/legal/privacy. If we add or change a sub-processor in a way that materially changes how your data is processed, we will update this policy and give additional notice where the law or our data-processing commitments require it.

We protect your data with authenticated accounts, encryption in transit, access controls on our backend systems, and a deliberately small number of people who can reach production. No system is perfectly secure, and we do not claim guarantees we have not built and verified. Where a product makes a specific security claim, that claim appears in the app-specific sections above and is limited to what we have actually shipped. If we become aware of a breach affecting your personal data, we will notify you and the relevant regulators as required by law.

We may update this Privacy Policy from time to time. If we make a material change — a new category of data, a new sub-processor, a new purpose, or a new legal basis — we will update the "Last updated" and "Effective" dates and give additional notice where the law requires it. Where a change requires fresh consent under the GDPR, UK GDPR, CASL, or a similar regime, we will ask for it before relying on the new purpose. Non-material changes (typos, clarifications, link fixes) are reflected by updating the "Last updated" date.

Bravely Studios LLC Privacy and data rights: privacy@bravely.dev Product support: support@bravely.dev Website: https://bravely.dev Postal address: available on request to privacy@bravely.dev.