Privacy.

The desktop app

MDHero collects no personal data, no telemetry, no usage events. Your markdown files never leave your machine. The app makes one HTTPS request to mdhero.app/api/version at most once every 24 hours to check for a new release; that request is aggregate-counted (operating system bucket only — no device IDs, no IPs).

This website (mdhero.app)

Four tools run here, all visible in the page source:

• Vercel Web Analytics — cookie-free, aggregate page views. Respects the Do Not Track browser setting.
• GoatCounter — cookie-free, aggregate page views. It also records an anonymous event when a download button is clicked, holding only which file was chosen (e.g. the Windows installer) and which page the button was on, so we can tell which pages are useful, and an anonymous event if the page visibly jumps about while it loads, holding only how far it moved and the CSS selector of the element that moved, so we can fix it. No identifier is attached and nothing is stored in your browser. Public dashboard at stealinghero.goatcounter.com.
• Microsoft Clarity — session recordings and heatmaps. Sets two first-party cookies (_clck for ~1 year, _clsk for ~1 day). Not loaded for visitors in the EU, UK, or EEA — the country is determined at request time from Vercel's edge geolocation and Clarity is skipped before the script runs.
• PostHog — product analytics: which pages and buttons get used, session replays, and heatmaps. Sets first-party cookies (names beginning ph_) to recognise a returning browser, and records clicks, page views and page performance. Not loaded for visitors in the EU, UK, or EEA — the same edge geolocation check used for Clarity runs first, and where it applies the PostHog code is never downloaded at all. Replays mask the text you type; we use this to see where the site confuses people, not to identify you.

What we don't do

• No accounts, no logins, no email collection on this site.
• No ads, no advertising trackers, no data sold to third parties.
• No cross-site tracking pixels.

Opt out

• Microsoft Clarity: opt out globally at clarity.microsoft.com/optout, or block the domain clarity.ms in your browser / an ad blocker.
• PostHog: block the domain i.posthog.com in your browser or an ad blocker — most blocklists already do. Clearing your site data removes the ph_ cookies.
• Vercel Analytics & GoatCounter: both respect Do Not Track. Enable it in your browser and neither will record your visit.

Contact

Questions, requests to delete data, or anything else — open an issue at github.com/vaibhav-kakde-in/mdhero.

Last updated: 16 June 2026.