Privacy Policy

MDSpin (“we”, “our”) is a Chrome Extension and web service that converts document files into Markdown. This policy describes, in full, what data we collect, how we use it, who we share it with, and how long we keep it.

1. Data we collect

We do not collect: browsing history, page content from ChatGPT/Claude/Gemini conversations, mouse/keystroke telemetry, location, financial data, health data, or extension usage analytics.

2. How we use data

• File contents — transmitted to our conversion API solely to produce Markdown output, then returned to you. Used for no other purpose.
• Email + account ID — to identify your account and enforce daily conversion quotas.
• Password — verified by Supabase Auth at sign-in. Used only to authenticate you. Not used for any other purpose. We have no ability to read it.
• Google OAuth tokens — used server-side to fetch documents from your Google Drive when you choose to import a file. Tokens are never shared with third parties.
• IP address (anonymous users only) — counted against the per-IP daily quota and discarded after 24 hours. Not linked to an account.
• Session tokens — to keep you signed in.
• Conversion counts — to enforce per-user daily limits across devices.
• Local preferences — to remember your UI settings. Never transmitted.

3. Who we share data with

We share data only with the following infrastructure providers, strictly for the purposes listed:

We do not sell, rent, or transfer user data to any other party. We do not use user data for advertising, profiling, or any purpose unrelated to MDSpin's single purpose (file-to-Markdown conversion). We do not use or transfer user data to determine creditworthiness or for lending purposes.

4. Google API Services — Limited Use disclosure

MDSpin's use and transfer of information received from Google APIs to any other app will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements.

5. Data retention

• File contents: 0 seconds (in-memory only; discarded after response).
• Account data (email, ID): until you delete your account.
• Password (hashed): stored by Supabase Auth until you delete your account or change your password.
• Google OAuth tokens: until you revoke access in your Google account settings or delete your MDSpin account. Refresh tokens are rotated automatically by Google.
• IP addresses (anonymous quota): 24-hour rolling window; deleted when the daily quota row is reset.
• Session tokens: until you sign out or they expire.
• Quota counters: 24-hour rolling window.
• Local preferences: until you uninstall the extension or clear browser storage.

6. Security

All communication between the extension, the conversion API, and Supabase uses HTTPS/TLS encryption. Passwords are never stored in plaintext: when you sign up with email + password, the password is sent directly from your browser to Supabase Auth over TLS and hashed there using bcrypt before storage. MDSpin's backend never receives the plaintext password, and neither MDSpin nor anyone else can read the stored hash. Authentication is performed entirely by Supabase Auth.

7. Your rights and controls

• Access or delete your account data: email trenkner.peter@gmail.com and we will delete your account and all associated data within 30 days.
• Sign out: available from the extension popup. Ends the session immediately.
• Stop local storage: uninstalling the extension clears all locally stored preferences.

8. Children

MDSpin is not directed at children under 13 and we do not knowingly collect data from them.

9. Changes to this policy

We will update the “Last updated” date above when the policy changes. Material changes will be announced in the extension's release notes.