Privacy Policy
Information pursuant to Art. 13 and 14 GDPR. Last updated: September 2026. markbird is local-first: your documents are stored in your browser and only leave your device when you sign in (sync), explicitly share a document, or use a feature that needs processing on our server (section 9).
1. Controller
adrule mobile GmbH
Feilnerstraße 10, 10969 Berlin, Germany
Email: hi@markbird.md
2. This website (markbird.md)
This marketing website is deliberately data-minimal: it sets no cookies, embeds no trackers or analytics, and serves fonts, scripts, and images locally from our server. No processing takes place beyond the technically necessary page request.
3. Hosting and server logs
The website and app are hosted on Google Firebase Hosting / Google Cloud Platform in data centres within the European Union (region europe-west1). On access, the provider processes technically necessary access data (e.g. shortened IP address, date and time, requested resource, status code, user agent) to deliver and secure the service. Legal basis: Art. 6 (1)(f) GDPR (legitimate interest in secure, reliable operation).
4. Local storage in the app (app.markbird.md)
The app stores your documents and settings (e.g. theme, language) via IndexedDB and localStorage solely in your browser. This data is not transmitted to us unless you sign in, share something, or use one of the features described in section 9. These are not tracking cookies.
5. Accounts and sign-in (optional)
You can use markbird without an account. If you sign in, this is handled via Google Firebase Authentication using Google, GitHub, or a passwordless email link. Depending on the provider, your email address and possibly display name and profile picture are processed to authenticate you and enable sync. Signing in with Google or GitHub transmits data to that provider. Legal basis: Art. 6 (1)(b) GDPR (provision of the service you requested). You can delete your account and its cloud data at any time in the app under "Account & data".
6. Synchronisation
When signed in, your documents are stored in Google Cloud Firestore (EU) for cross-device sync and linked to your account ID. No sync occurs without signing in. Legal basis: Art. 6 (1)(b) GDPR.
You can end-to-end encrypt sync (Settings → Encryption for synced notes). Title, content, folder and tags are then encrypted on your device with a key derived from your passphrase (PBKDF2-SHA256, 600,000 iterations; AES-GCM 256-bit), and our servers hold ciphertext only. The passphrase never leaves your device and is stored nowhere — if you lose it, the copies in the cloud cannot be recovered (the notes on your devices stay readable). Even with encryption on, what sync needs to work stays visible: account ID, document ID, the time of the last change, and whether a document was deleted. For each account we store a record with a random salt and a verifier, from which the passphrase cannot be derived.
7. Share links
When you create a share link, a copy of that document is stored on our servers (Google Cloud Firestore, EU) so recipients can open it via the link. Anyone who knows the link can view the document. You can set an expiry date and revoke links at any time. Legal basis: Art. 6 (1)(b) GDPR.
8. Real-time collaboration
For editable shares, changes are exchanged between participants for live collaboration via a WebSocket service (Google Cloud Run, EU). Content is held there only transiently in memory; persistent storage happens as described in section 7. Legal basis: Art. 6 (1)(b) GDPR.
9. Server-side processing on request
Two features run on our server (Google Cloud Run, EU) when you explicitly request them, including without an account:
- Export as a Word document (DOCX): when you are online, the content of the document, including embedded images, is sent to our server and converted into a Word file with the open-source software Pandoc, which is returned to you. Without a connection, the conversion runs on your device instead.
- Import from URL: the address you enter is sent to our server, which retrieves the document from it and returns it to you.
The content is processed in memory only for the duration of the request and is neither stored nor logged. It is not passed on to third parties. Legal basis: Art. 6 (1)(b) GDPR.
10. Reports about shared documents
You can report any shared document from the link beneath it, without an account. We store the reason you choose, the share concerned, the time, and — only if you provide them — your description and your email address. The purpose is to review the report and, where appropriate, remove the document. Legal basis: Art. 6 (1)(c) GDPR where we are legally required to handle such reports, and otherwise Art. 6 (1)(f) GDPR (legitimate interest in keeping illegal and abusive content off our service).
Your description and email address are deleted once the report has been handled. To document the decision, only the reason, the times and the outcome are kept. If a document is removed, the share and the copy of the document are deleted.
11. Processors
For hosting, authentication, database, collaboration, and the processing described in section 9 we use services from Google (Google Cloud EMEA Limited / Google Ireland Limited). A data processing agreement is in place; processing takes place in the EU. Where a transfer to a third country occurs in individual cases, it is based on the EU Standard Contractual Clauses.
12. No tracking, no advertising
We use no analytics, tracking, or advertising services and do not share personal data for advertising purposes.
13. Encryption
The website and app are served exclusively over an encrypted TLS connection (HTTPS).
14. Retention
Local data remains until you delete it in your browser. Synced documents remain until you delete them or your account. Shared copies remain until the link is revoked or expires. Content processed for a Word export or an import from URL (section 9) is not stored. For reports, see section 10. Server logs are kept only as long as necessary for security and operation.
15. Your rights
You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), and objection (Art. 21), as well as the right to withdraw consent at any time. To exercise these, contact hi@markbird.md. You also have the right to lodge a complaint with a supervisory authority, e.g. the Berlin Commissioner for Data Protection and Freedom of Information.
16. Changes
We update this policy when our processing changes. The version published on this page applies.