Privacy Policy

Last updated: September 23, 2026

This English version is provided for convenience. If there is any difference between this translation and the Japanese version, the Japanese version prevails.

1. Basic Policy

markdown.bz (the “Service”) respects users’ privacy and complies with the Act on the Protection of Personal Information and other related laws and regulations.

2. Information Collected

The Service collects the following information.

2.1 Uploaded content
Markdown text and images uploaded or entered for display on share pages. If the creator updates the text after publishing, this includes the text of the earlier versions.

2.2 Share settings and metadata
Information needed for sharing (such as the title, the no-expiry or expiry setting, whether password protection is used, file size, number of images and publication status). Even if a password is set, it is not stored in plain text; it is hashed before being stored.

2.3 Usage logs
Access records needed to operate the Service and maintain its security (such as the date and time of access and the usage environment). Information on the source of access (such as IP addresses) is not stored in its original form; it is hashed before being handled.

2.4 Information entered in the report form
The reason, additional details and optional contact information entered in “Report a problem / removal request”.

2.5 Google account information
The ID that identifies a user’s Google account and the user’s email address, if the user signs in with Google. The ID is converted into a form that is difficult to reverse and is stored in association with the shares created while signed in and the shares merged into the account at sign-in from the records in this browser. The email address is used to show that the user is signed in; it is kept only in a cookie and is not stored in the database.

3. Purposes of Use

Information collected is used for the following purposes.

Creating and displaying Markdown share pages, and providing image display and download features
Processing no-expiry or expiry settings and password protection
Enabling creators to list their shares, update the text and delete shares, and displaying the change history (diffs) when the text is updated
Detecting and preventing unauthorized use, attacks and nuisance behavior
Handling reports and operating the Service, investigating failures and improving quality
Deleting expired content

To the extent necessary to operate the Service, such as responding to reports, checking for violations of the Terms of Service and responding to requests based on laws and regulations, the operator may review uploaded content, including password-protected shares. The fact that content was reviewed is kept in administrative records.

4. Provision to Third Parties

The Service does not provide personal information to third parties without the user’s consent, except in the following cases.

Where based on laws and regulations
Where necessary to protect a person’s life, body or property
Where service providers are entrusted with handling it to the extent necessary to provide the Service

The Service uses cookies to retain the unlocked state of password-protected shares and, for users who sign in with Google, their signed-in state (for up to 30 days).

In addition, so that users can later list and delete the shares they have created, the share URL, title, expiry, whether password protection is used, and verification information for deletion are saved in the local storage of the browser used to create the share. This information is stored in the user’s browser; the share URL and the verification information for deletion are sent to the Service when the user performs a deletion, or when the user signs in with Google and merges their shares into their account. It is lost if the browser data is cleared.

6. Analytics

The Service uses analytics tools (Google Analytics 4 and Microsoft Clarity) to improve the Service. These tools use cookies and similar technologies to collect information on usage (such as page views, interactions and the usage environment).

Note that these analytics tools are not loaded on pages involved in creating, viewing or managing shares (such as “Upload”, the shared document pages at /d/... that only people who know the URL can view, “My shares”, and “Report a problem / removal request”). Information collected by each tool is handled in accordance with the privacy policy of its provider. Users can disable this collection through browser settings, opt-out add-ons or similar means.

7. Service Providers and Data Storage Locations

The Service is operated using services provided by the following companies.

Vercel Inc. (United States): website delivery and server-side processing. Server-side processing takes place in a region in the United States (around Washington, D.C.).
Supabase Inc. (United States): database and storage of uploaded files. Data is stored in the United States (Northern Virginia, an Amazon Web Services region).
Google LLC (United States): Sign in with Google, analytics (Google Analytics 4), and retrieval of the fonts used for link preview images of shares (Google Fonts; only the distinct characters contained in the title are sent, in a form that does not reveal their original order)
Microsoft Corporation (United States): analytics (Microsoft Clarity)
Email delivery provider: sending notification emails that inform the operator of what was submitted in “Report a problem / removal request”

For this reason, uploaded content, share settings, information entered in “Report a problem / removal request” and other data are stored and processed in the United States. Having understood the personal information protection system of the United States with reference to the Personal Information Protection Commission’s Survey on Systems for the Protection of Personal Information in Foreign Countries (in Japanese), the Service takes the security control measures described in the next section.

8. Security

To prevent the leakage, loss or damage of personal information, the Service implements the following measures.

Encryption of communications
Storing passwords after converting them into a form that is difficult to reverse
Setting storage to private, and limiting viewing, images and downloads to access authorized by the application

9. Retention Period

Share URLs have no expiry by default. Content set to no expiry is retained until it is deleted due to a removal request, action against a violation of the Terms of Service, a legal requirement, operational needs of the Service, or similar reasons. If an expiry is set, the uploaded files are deleted by a periodic deletion process after the expiry has passed. “No expiry” does not guarantee permanent storage. If the creator deletes a share from “My shares”, the uploaded files are deleted at that time. If the creator updates the text, the text of the earlier versions is kept as change history until the share is deleted, and is shown together with the diffs to anyone who knows the share URL.

10. Changes to This Privacy Policy

This Privacy Policy may be amended as necessary. The amended content takes effect when it is posted on this page.