mdnow Privacy Policy

Last updated: 2026-10-19 — applies to mdnow 1.1.1

mdnow saves the webpage you are looking at as a Markdown file on your own computer. It has no account, no server, and no analytics. This document says exactly what it touches and what it does not.

Everything below is a statement about what mdnow's code does, and each claim names the source file that backs it.

The short version

mdnow collects nothing. No personal data, no browsing history, no page content, no usage statistics — not to us, not to anyone.
Nothing you save is uploaded anywhere. The Markdown file is built inside your browser and handed straight to Chrome's own downloads, on your machine.
mdnow contacts no server of its own, ever. There is no mdnow server.
It makes exactly one kind of outgoing request, only if you turn on "Save as files" for pictures, and only to the addresses the page's own images already point at. Details below.

What happens when you click the icon

mdnow injects a script into the tab you are on — only that tab, only on that click, and only for as long as it takes to read the page (entrypoints/background.ts, entrypoints/content.ts).
That script reads the page's already-loaded content, in your browser, and converts it to Markdown there (lib/converter/). The page is not re-fetched — mdnow reads what your browser already has.
The resulting Markdown text is passed inside the extension from the page to the extension's own background script, and nowhere else.
That text is turned into a data: URL — the file's own contents, inline, with no address to fetch — and handed to chrome.downloads.download(), which writes it into your Downloads folder (lib/shell/data-url.ts, entrypoints/background.ts).

The page content never leaves your computer at any point in that sequence.

The one network request

If you leave the pictures setting on its default, Link to the web, mdnow makes no network request at all. The saved file simply links to the images where they already live.

If you switch the setting to Save as files, mdnow asks Chrome to download each image the article contains, so the file works offline. That means:

One request per image, to the image's own web address — the same address the page you are reading already loads it from. No other address is ever contacted.
The request is made by Chrome's own download manager, not by mdnow: the call passes only the image's URL, a filename, and Chrome's duplicate-name handling. mdnow attaches no data of its own, no identifiers, and no headers (downloadOneImage in entrypoints/background.ts).

mdnow's own code contains no fetch, no XMLHttpRequest, no WebSocket, and no sendBeacon anywhere. That is not a promise — it is checked automatically against every production build by npm run check:build (scripts/build-audit.ts), which fails the build audit if any of them appears outside a documented allowlist. The allowlist currently has one entry: a standard build-tool polyfill that loads the extension's own files from inside the extension, and cannot reach the network at all.

Permissions, and why each one exists

mdnow asks for the smallest set that makes it work. When you install it, Chrome shows one warning: "Manage your downloads."

Permission	Why
`activeTab`	Lets mdnow read the tab you are on, and only at the moment you click the icon or press your shortcut. It grants nothing before that click and nothing after that page.
`scripting`	How the reading code gets into that tab. mdnow deliberately has no always-on content script — that would require access to every site you visit, which is the warning mdnow exists without.
`downloads`	Writes the `.md` file (and, in download-images mode, the images) into your Downloads folder. This is the one permission Chrome warns about.
`storage`	Remembers your one setting — whether images are linked or downloaded. Stored on this computer only, never synced to an account (`lib/shell/image-mode.ts`).

The optional permission

Some pages keep their real article inside an embedded frame from another site — HuggingFace Spaces are the common example. Chrome will not let activeTab reach inside such a frame, so mdnow declares an optional host permission that it does not hold until you grant it.

It is never requested on install, and never in the background. The only thing that can request it is your own click on the popup's "Allow access to this box" choice (allowIframeAndRetry in entrypoints/popup/main.ts).
What it requests is the address of that one embedded site, worked out from the frame actually on the page (lib/collector/iframes.ts) — not blanket access to the web, even though the optional declaration in the manifest is written broadly enough to allow asking about any site.
It is used for one thing: reading that frame's content on that page, the same way mdnow reads any other page.
You can take it back at any time from chrome://extensions → mdnow → Site access, and mdnow simply goes back to asking next time.

What is stored, and where

Everything stays on your own computer, in Chrome's extension storage:

Your pictures setting (remote or download) — kept until you change it. This uses local storage, never Chrome's account sync, so it does not travel to your other devices (lib/shell/image-mode.ts).
The options for the save in progress — whether you chose "Read the whole page instead", and the pictures setting in effect — handed between mdnow's own parts while a single save runs.
A save that is waiting on your answer to Chrome's permission prompt — the tab, the embedded box's site, and the options you chose for that save. Removed once Chrome has your answer, or when you leave or close the page; after two minutes it is ignored and removed the next time mdnow checks.
A save that finished in the background after you allowed access, with nothing open to show it: the file's name, the article's title, the site's name, the page preview's shape (no text), word and picture counts, and what was left out. The popup needs these to tell you the save worked; they are removed as soon as it has, or when you close the tab.

The last three use session storage, which Chrome keeps in memory and discards when the browser closes (entrypoints/background.ts). No page text and no browsing history are ever stored by mdnow, and nothing but your pictures setting outlives the browser session. The saved .md files are ordinary files in your Downloads folder, belonging to you.

What mdnow does not do

No analytics, telemetry, crash reporting, or usage counting of any kind.
No advertising, and no data sold, shared, or transferred to anyone.
No remote code: everything that runs ships inside the extension package. Nothing is downloaded and executed, and there are no calls to eval().
No AI model and no API calls to any AI service. All the extraction logic is ordinary code running on your machine.
No account, no sign-in, no identifiers of any kind.
No reading of pages you did not ask it to read.

Children

mdnow is a document-conversion utility. It collects nothing from anyone, of any age.

Changes to this policy

If the extension's behaviour ever changes in a way that affects this document, this policy is updated in the same release, with a new date at the top.

Contact

Questions or concerns: email the developer at the contact address shown on mdnow's Chrome Web Store listing.