1. Who we are

AsItIs Markdown is made by Rohith Katta ("we"), an individual based in India. For privacy questions and grievances, contact privacy@asitis.app; the founder answers personally.

2. The desktop app

The AsItIs desktop app does not collect, transmit or store any personal data. It makes no network connections by default. The complete list of addresses it can contact, and what each sends, is on the Network activity page:

Optional update check (off until you turn it on): sends your platform, CPU architecture and app version. No identifier. We see aggregate counts only.
Licence resend page: a web page you open in your browser to have your licence emailed again. Your email address is used for that one email and rate limiting.

Your documents never leave your machine through the app. Licence files are verified locally. There is no account.

3. The website (asitis.app)

Waitlist

If you join the waitlist, we store your email address, the plan you said you were interested in (if any), the time you gave consent and the version of the consent text you agreed to, and the site page the form was on. We do not store your IP address, browser or device details. If the same address is submitted again, nothing we stored changes; to change your plan, write to privacy@asitis.app. The list is held in a Cloudflare D1 database (Cloudflare, Inc., United States) that only we can read. We use it to send you at most a few emails about the beta and the launch, nothing else, and we never sell or share it. When you join, we send one email to confirm the address is yours, and one reminder on day 5 if you have not confirmed by then.

The confirmation email is sent by Resend, Inc. (United States) from waitlist@asitis.app, only the first time an address (or another spelling of the same inbox) joins. Until you press the button on the page its link opens, your entry is marked unconfirmed. If it is still unconfirmed 5 days later, we send one reminder, and we record that we did; unconfirmed entries are deleted after 7 days, and after that we send nothing. When you confirm, we record the time. Neither email has tracking pixels, and the links are not rewritten to count clicks. Each contains one small animation served from asitis.app at the same address for every recipient, so loading it tells us nothing about who opened the email; your mail app may fetch it when you open the message, as it would any picture. Resend receives your email address and the message, and keeps a delivery record (address, subject, delivery status) for up to 30 days. The links in the emails carry your address encrypted, never in readable form, and work for up to 12 months; the remove link deletes your entry as soon as you confirm on the page it opens. To stop the emails being used to flood one inbox, we also keep a count of emails sent per day, with no addresses.

To keep bots off the list the form uses Cloudflare Turnstile, which checks your browser when you submit. Cloudflare states that it uses Turnstile signals only to tell people from bots, not for advertising; see Cloudflare's Turnstile privacy addendum. To slow down abuse we count submissions for one minute, keyed on a one-way hash of the date with your IP address, and of the date with your email address; the hashes are held briefly in Cloudflare's memory and never written to our database.

Processors for the waitlist: Cloudflare (D1 database, Turnstile) and Resend (confirmation email and reminder). Legal basis (GDPR) and ground (DPDP Act): your consent, given by ticking the box on the form. Retention: until 12 months after AsItIs 1.0 launches, or until you ask us to delete it, whichever comes first. To unsubscribe or have your entry deleted, use the unsubscribe link in any email we send or write to privacy@asitis.app; we delete the row within 30 days, usually the same day.

Analytics

We count page views with Cloudflare Web Analytics, run by Cloudflare, Inc. (United States), which already hosts the site. Each page loads a script from static.cloudflareinsights.com that sends one report to cloudflareinsights.com: the page address (without anything after a question mark), the page that linked to it, your browser, operating system and device type, your country (Cloudflare works it out from the connection) and how long the page took to load.

It sets no cookies, stores nothing in your browser and doesn't follow you to other sites. We only see totals, such as views per page and per referring site, never a list of individual visits or visitors. Legal basis (GDPR): our legitimate interest in knowing which pages people read so we can improve them. If a content blocker stops the script, the site works exactly the same.

Hosting

The site is served by Cloudflare Workers (Cloudflare, Inc., United States, with data centres worldwide). Cloudflare processes IP addresses and request logs to serve and protect the site. We do not have access to individual request logs. Operational logs of waitlist errors (for example a failed spam check or a failed database write) are kept in Cloudflare Workers Logs for up to 7 days and contain no personal data: no email address, IP address or browser details.

Email

If you write to us, we keep the correspondence to answer you and for as long as a support history is useful, at most 3 years.

4. Purchases

Pro and Firm licences are sold by a merchant of record (planned: Paddle.com Market Ltd, United Kingdom), which handles payment, invoicing, tax and refunds under its own privacy policy. We receive your name, email address, country and the licence purchased, and use them to issue the licence file, send it by email (via Resend, Inc., United States), honour refunds and keep the records that tax law requires (for as long as Indian tax law requires, generally up to 8 years). Legal basis: performance of a contract and legal obligation.

5. Data we never collect

Document contents, file names, file paths, what you open, how often you open the app, crash dumps, keystrokes, clipboard, IP addresses inside the app. If a future version adds an optional feature that changes this, it will be off by default, described here first, and listed on the Network activity page.

6. Your rights

Under India's Digital Personal Data Protection Act, 2023 and its Rules and, where it applies, the EU and UK GDPR, you can ask us for a summary of the personal data we hold about you, ask us to correct, complete or erase it, withdraw consent at any time, nominate someone to exercise these rights for you, and raise a grievance. Email privacy@asitis.app; we answer within 30 days. EU and UK residents may also complain to their supervisory authority. If we do not resolve a grievance, residents of India may approach the Data Protection Board of India.

7. International transfers

Cloudflare, Resend and the merchant of record process data outside India and the EU. Transfers rely on the providers' standard contractual clauses and equivalent safeguards. We choose providers with published data processing agreements.

8. Security and breaches

We hold little data by design. Access to the waitlist and licence records is limited to the founder and protected by two-factor authentication. If a breach affects you, we will notify the Data Protection Board of India without delay (with a detailed report within 72 hours), notify the relevant EU or UK supervisory authority within 72 hours where the GDPR applies, and tell affected individuals without undue delay.

9. Children

The site and app are not directed at children (anyone under 18 in India, or under the age of digital consent where you live, 13 to 16 in the EU and UK), and we do not knowingly collect their data.

10. Changes

Changes to this policy are dated at the top and listed in the changelog. Material changes to what the app can send are announced before they ship.

Privacy policy