ONLY MD — Privacy Policy
Last updated: 2026-11-05. English translation of the canonical source docs/PRIVACY.md. The Vietnamese original is the source of truth in case of discrepancy; see Vietnamese version.
- No telemetry. ONLY MD does not send usage data, document content, or device information to any server.
- No network access. ONLY MD (the app and its bundled MCP server) never fetches
images, fonts, scripts, or updates from the internet. Remote images referenced inside a document
are blocked by Content-Security-Policy.
http(s)/mailtolinks only open in the system browser when the user clicks them (and policy allows it).
⚠️ Warning — AI assistant connection (MCP). When you enable this optional feature,
documents in the folder you selected may leave your machine: the AI assistant you
connect yourself (e.g. Claude) reads the documents and sends the parts it read to its own model
provider. That transmission is performed by the assistant, not by ONLY MD, and
ONLY MD does not control or see it happen. The feature is off by
default, only turned on by your own action, and administrators can block it (see
AI assistant (MCP) below). Do not enable it for a folder
containing confidential documents, or documents your organization does not allow sending to a
third party.
Local data (OS application-data folder)
| Data | Stored at | Contents | Deleted when |
|---|---|---|---|
| Recovery drafts | recovery.json |
Contents of unsaved tabs (one draft per tab) | On save, or when the user discards the draft |
| Version history | history/<path hash>/*.md |
Full content of every save (unencrypted); up to 50 versions, 20 MB, 30 days per document | Auto-trimmed by the limits above; "Delete version history…" command; can be disabled via
the allowHistory policy |
| Logs | logs/app.log (rotating) |
Event names, file names (not folders), errors — no document content | Rotates at 5 × 1 MB |
| Crash reports (minidump) | crashDumps/ |
In-memory data at crash time, may contain fragments of open content | Deleted manually by the user; can be disabled via the allowCrashDumps policy |
| Settings | settings.json |
Font size, reading-column width, image folder, autosave interval, language (no document content, no paths) | Settings → "Reset to defaults", or delete the file |
| Session, recent files, workspace | session.json, recent.json, workspace.json |
Paths of files currently/previously open and the working folder (no content) | "Open Recent" → Clear list; session is overwritten on each tab change |
| UI preferences | localStorage |
Theme, view mode, pane widths, table of contents | Clear application data |
| MCP configuration | mcp.json |
Mode (off/read-only) and the folder path being shared (no content) | User deletes it or sets mode to off |
| MCP audit log | mcp-audit.jsonl |
Timestamp, tool, relative path within the shared folder (a path outside the folder that the assistant sends is logged only as "(path outside folder)"), result, SHA-256 hash, and byte count — no document content or query text | Rotates at 5 MB (keeps 1 previous file); user deletes manually |
- Crash reports (minidumps) are never sent automatically. If needed for support, the user shares them manually.
- Version history stores a full copy of document content in the app-data folder,
unencrypted: anyone who can read that folder can read every saved version, even
after the original file is deleted. Subdirectories are named by a hash of the path, so the name
itself does not reveal the path. Organizations handling confidential documents should disable
this via the
allowHistorypolicy. - At-rest encryption (optional, enabled by an administrator via
encryptAtRest): recovery drafts and version history are encrypted using the OS keychain; if no keychain is available, nothing is written in place of writing it in the clear. Off by default (plaintext as described above).logs/and minidumps are not covered by this encryption. - Application audit log (optional, enabled by an administrator): records open/save/delete/rename/export/blocked events along with file name, SHA-256 of the content, OS username, and machine name — no document content or folder path. Off by default.
- An organization can disable minidump writing, version history, recovery drafts, external links, drag-and-drop, and file export, or set read-only mode / restrict folders, via policy.
AI assistant (MCP)
ONLY MD ships with a read-only MCP server so that an assistant you run yourself (e.g. Claude Desktop, Claude Code) can find and read documents in one folder you choose. Important details:
- Off by default. It only runs once you configure the assistant yourself (or enable it in the app) and pick a folder. Administrators can forbid it entirely or restrict it via policy.
- Data leaving the machine is the assistant's action, not ONLY MD's. The MCP server runs locally, opens no network port, and makes no network calls itself. But whatever content the assistant reads enters its own conversation and (for a cloud assistant) reaches its model provider. ONLY MD does not control or see that happen. Do not share a folder that contains documents your organization does not allow sending to a third party.
- Scope: limited to the selected folder; hidden files/folders (
.git,.onlymd, …), symlinks, hard-linked files, and paths blocked bydenyGlobsare not read. This is enforced on the MCP-server side only: an assistant with its own file/shell access (e.g. Claude Code) can still read the disk directly, bypassing ONLY MD. - Document content is untrusted data. A document may contain text crafted to influence an assistant. The MCP server executes nothing from document content and, in the current version, offers no write/delete tool; how the assistant reacts to content is the assistant's responsibility.
- Audit log (
mcp-audit.jsonl) records every call, including denied ones, with a hash chain to detect tampering. This is a record, not yet non-repudiation proof: anyone with write access to the data folder can still delete the file. The assistant name is self-reported by the assistant. If the log cannot be written, the server refuses to serve requests. - Search index lives only in the MCP server process memory (not written to disk in the current version) and disappears when the process stops.