Last updated: October 2026

static.md is run by Vadim Russu, an individual based in Moldova, not by a company. Vadim Russu is the controller of the personal data described in this policy (“we”, “us”). For anything about your data, write to salut@static.md.

This policy explains what static.md collects, why, who else handles it, how long it’s kept and what you can do about it. In short: we keep what’s needed to run notes, whiteboards, image hosting, Pro and AI agent access, and to stop abuse. We don’t show ads or sell data.

The terms for using static.md are in the Terms of Service.

What we collect

Your account. You can use static.md without an account: your browser then gets an anonymous sign-in, a random identifier your notes and whiteboards belong to. You can sign in with Google or GitHub, or with an email address and password. With Google or GitHub we receive your email address, name and profile photo URL from them; with a password, the email address you enter. Firebase Authentication keeps these with the dates you joined and last signed in, and keeps a password only as a salted hash: we never see your password, or your Google or GitHub one. To confirm your email address or reset a password, Firebase emails you a one-time link.

Notes and whiteboards. Their content, title, folder and sharing settings, including the email addresses of people you share an item with, and the full IP address it was created from, which we keep to deal with abuse. While you edit with others, a random display name, colour and cursor position are shared with the people in the same note; that presence data is removed about 60 seconds after you leave.

Duplicates and the free-plan footer. When you duplicate a note, we keep a private record of which note it was copied from and which account copied it; it isn’t shown on the copy, which is otherwise a new note like any other. Public notes and galleries of free accounts show a “Made with static.md” footer, so anyone viewing them can tell the owner is on the free plan.

Images. The file and its details (original file name, size, format, dimensions and a content hash used to spot identical files), the full IP addresses it was uploaded from, how often it has been viewed, and the results of automated moderation (see below). With Pro, your uploads also appear in your own library. A password-protected gallery stores only a salted hash of its password. Downloads of StaticShot for Mac are counted as a total; we don't record who downloaded it.

Payments. Pro and Founding Lifetime are sold through Creem, our merchant of record. To start a checkout we send Creem your account identifier and your account’s email address. Creem collects your payment details and billing information; we never see your card number. From Creem we receive and keep your plan, trial and renewal dates, Creem’s customer and subscription identifiers, and for lifetime orders the amount, currency and any refund.

AI agents and tokens. For each app you connect over MCP or OAuth (for example Claude, Cursor or StaticShot for Mac) we keep its name, where it signs in from (its redirect address), the permissions you granted, when it was connected and last used, and a hash of the IP address that registered it. For personal access tokens: their name, permissions, expiry and last use. Tokens are stored only as hashes. We count each account’s agent tool calls per day to apply plan limits, and items an agent creates are marked as created through MCP.

Abuse prevention. Short-lived counters keyed on a hash of your IP address enforce rate limits (for example on creating notes, signing in apps and exporting).

Server logs. Our hosting provider records requests (IP address, browser user agent, address requested and time) in its logs.

Encrypted content. For an end-to-end encrypted note or whiteboard we store only the encrypted data, plus its title, which isn’t encrypted. The key stays in the link, after the #, which browsers never send to our servers, and we keep it out of analytics too. An AI agent can read an encrypted note only with its key, through software on your side such as the E2E bridge, which runs on your computer, keeps the key there and sends us ciphertext only. Our agent tools refuse to store text that contains a key.

What we don’t do. No ads, no advertising trackers, no selling or renting of personal data, and no marketing email.

How we use it

To run static.md: store and serve your notes, whiteboards and images, sync edits between collaborators, and apply your sharing settings.
To keep it safe: rate limits, blocking abuse, and automated moderation of uploaded images. Images are checked with Google Cloud Vision for adult or violent content and labelled; nobody looks at an image unless it’s flagged or reported.
To run Pro and Founding Lifetime: checkout, plan status, renewals and refunds.
To let AI agents and apps you connect act on your behalf, within the permissions you approve.
To understand how static.md is used and improve it (see Analytics).
To answer you when you write to us, and to meet legal obligations.

We don’t read your notes, whiteboards or images except when needed to investigate abuse, handle a report, or when you ask us to.

Analytics, cookies and your browser

Google Analytics. We use Google Analytics 4 (through Firebase) to understand how static.md is used. It receives page views, with the query string and everything after the # removed so note keys and link parameters never reach it, the page you came from, and events such as signing up, visiting the pricing page, checkout steps and purchases (with an order number), and downloading the Mac app, plus whether you’re on a paid plan. Google sets _ga cookies to recognise your browser across visits and uses your IP address to estimate a rough location. These cookies are set on your first visit; static.md doesn’t ask for your consent first. You can block these cookies in your browser, or with Google’s Analytics opt-out add-on; static.md works the same without them.

PostHog. We also use PostHog, hosted in the EU (Frankfurt), to see which features people use and where they get stuck. It receives the same page views and events as Google Analytics, with everything after the # removed and only the ref and utm_ tags kept from the query string, and only the site you came from (not the page). It doesn’t record your screen, the text you click on or what you write. PostHog keeps a random identifier in your browser’s local storage (not a cookie) to recognise your browser across visits. Once you sign in, these events are linked to your account identifier (never your name or email), along with where you first came from. Our servers also tell PostHog, under that identifier, when you connect an app such as Claude through static.md login, when a connected app uses a static.md tool (which tool, which app, and whether it worked, never which note or what’s in it), and when your plan changes. PostHog uses your IP address to estimate a rough location.

Where you came from. The first time you land on static.md, your browser stores where you came from in local storage under smd:first-touch (not a cookie): a ref, utm_source or utm_campaign tag in the link, the referring site’s host name (not the full address), and the time. If that first visit had no tag, the tags of the first later visit that has one are added, for example from a “Made with static.md” link. If you then sign in with Google or create or duplicate a note, we save those values once in a separate record tied to your account identifier, together with which of those it was and when your account was created. We never store your IP address, browser details, the full link or which note it was with them. The browser copy is dropped after 90 days if it’s never used, and once saved only a marker stays in your browser. The saved record has a retention period of 12 months, is read only by us to see which links bring people to static.md (such as the “Made with static.md” footer on free notes and galleries), isn’t sent to Google Analytics, and isn’t shared with anyone. When you sign in with Google, the same tags also go to PostHog with your account identifier (see PostHog above), where they sit alongside your other product events, including plan changes.

Stored in your browser. Your sign-in session; preferences such as theme and reduced motion; a list of your recent uploads; your collaborator name and colour; for the current tab only, keys for galleries you’ve unlocked; and a few technical flags that help the app reload cleanly. Clearing your browser’s storage removes them, and with them access to notes made without an account.

Who else handles it

We use these services to run static.md. They process data on our behalf or, where noted, as independent providers under their own terms:

Google (Firebase Hosting, Cloud Functions, Firestore, Cloud Storage, Firebase Authentication, Google Analytics, Cloud Vision and Cloud Logging): hosting, database, file storage, sign-in, analytics, moderation and logs. Firebase Hosting delivers pages through Fastly’s network on Google’s behalf.
PostHog (EU cloud): product analytics.
Cloudflare: sits in front of static.md for DNS, delivery and protection, so every request passes through it, including your IP address.
Creem: payments, as merchant of record, under its own terms and privacy policy.
GitHub: if you sign in with GitHub, it tells us who you are, under its own terms and privacy policy.
Google Fonts: some pages load a font from Google, which receives your IP address.
AI apps you connect: when you connect an agent such as Claude, Cursor or VS Code, what it reads from static.md goes to that app and its provider, under their privacy policy. You decide which apps to connect and can disconnect them at any time.

People you share notes, whiteboards or galleries with can see them, and anything public is visible to anyone with the link. We disclose data to authorities only when the law requires it.

Where it is processed

static.md runs on Google Cloud; its server functions run in Belgium (europe-west1). Google, Cloudflare and Creem operate worldwide, so your data may also be processed in other countries, including the United States.

How long we keep it

Notes and whiteboards, with the full IP address they were created from: until you or we delete them.
Images, with the full IP addresses they were uploaded from: for as long as the image is hosted.
Your sign-in details (email address, name, profile photo URL, password hash): until you ask us to delete your account.
Payment records: for as long as we need them for your plan, refunds and our accounting.
Sign-in tokens for connected apps: access tokens last an hour and refresh tokens 60 days; used refresh tokens are kept 7 days to detect misuse, and expired tokens are deleted a day or two after they expire. Connected apps and personal access tokens stay until you disconnect them or they expire. An app’s registration (its name and redirect address) is kept so it can sign in again.
Agent usage counters are set to expire after 3 days; rate-limit counters are deleted daily once their hour has passed; export counters (one per account and per hashed IP address) reset every day.
Collaboration presence: about 60 seconds.
Server logs and analytics: as long as Google and PostHog keep them under our settings for those services.

Your choices and rights

Delete your notes and whiteboards yourself, and with Pro your uploads.
Disconnect apps and delete personal access tokens under Connected apps; they stop working within seconds.
Cancel a subscription from the billing portal.
Block analytics cookies, or clear what static.md stores in your browser.

You can also ask us for a copy of your personal data, to correct or delete it, to delete your account, or to stop using your data for analytics. Write to salut@static.md; we may ask you to show that the data is yours (for example by writing from your account’s email address). If you think we’ve mishandled your data, you can also complain to the data protection authority where you live.

Security

Everything travels over HTTPS. Sign-in tokens and gallery passwords are stored only as hashes, the database checks every read and write of a note or whiteboard against its sharing settings, and only we have administrative access. End-to-end encryption keeps a note’s content unreadable even to us. No system is perfectly secure; if you find a problem, please tell us at salut@static.md.

Changes to this policy

We’ll post any new version here with a new date. If a change significantly affects you, we’ll tell signed-in users in the app or by email before it takes effect.

Contact

Questions or requests about your data: salut@static.md, or see Contact.

Privacy Policy