# Mardo privacy notice

Status: counsel-reviewed and owner-approved. Effective date: 2026-09-01.

## The app

Mardo has no Mardo account, activation service, device list, license telemetry,
analytics, advertising identifier, or background license request. License
verification and the 14-active-use-day trial run locally. The local license
certificate contains the licensed display name in plaintext. The trial record
contains product/day counters and no name, email, document content, or device
identifier.

Mardo reads and writes documents at locations you choose. It does not upload
their contents to Floof Logic. Remote images are withheld by default. If you
choose **View → Load Remote Images**, or enable automatic loading for future
documents in Settings, Mardo may request referenced URLs from their hosts.
Those hosts (including admitted redirect hosts) receive your public IP address,
the request time and URL, and ordinary DNS/TLS/HTTP metadata, and apply their
own privacy policies. Mardo does not send the document, its path, surrounding
text, a referrer, cookies, or saved credentials. Admitted image bytes remain
only in bounded process memory and disappear on eviction or quit. Finder
previews never load remote images.

Save/Publish HTML saves locally by default. If you explicitly check **Run
publish script after saving**, Mardo runs the command template you entered and
gives that command the saved page's absolute path. Mardo stores the template
locally for later use, but not the enabled checkbox, and does not retain its
output. The external command may copy or upload the page according to that
tool's own behavior and privacy terms; Mardo and Floof Logic do not operate or
inspect that transfer.

## Feedback

Nothing is sent when you open the feedback dialog or choose **Nevermind**. If
you press **Send**, Mardo sends the message you entered, any optional contact
value you entered, and the diagnostic details you chose to include to a
Floof Logic service operated on Cloudflare. That service converts the
submission to an email delivered to `feedback@mardo.app`. The optional contact
value is plain message text, is not checked as an email address, and is never
used as a delivery or Reply-To header.

Mardo stores the optional contact value on your Mac so it is available the
next time you open the dialog. The diagnostic preview can include app, system,
appearance, document-mode, document-byte-count, and window facts. It does not
include the document name, path, selection, clipboard, logs, or document
contents. Cloudflare receives ordinary network information needed to operate
and rate-limit the request. Floof Logic does not add that network information
to the feedback email.

Choosing **Open in Gmail** hands the visible draft to Google in your browser;
Google's own terms and privacy practices apply to that operation.

## Purchase and delivery

Stripe hosts checkout and processes payment-card data under Stripe’s own
privacy terms. Floof Logic does not receive or store the full card number.
Floof Logic’s private fulfillment records retain the Stripe order and event
identifiers, licensed display name, delivery email, license class, seat count,
issued certificate, issuance status, and delivery receipts. Those records are
used to fulfill the order, prevent duplicate issuance, recover a purchased
certificate, handle refunds and disputes, keep required financial records,
and protect the service from abuse.

Floof Logic retains fulfillment and financial records only for as long as
needed for those purposes and applicable legal obligations. Production logs
must not contain private signing keys, complete certificates, payment secrets,
or document contents.

Checkout and transactional license delivery use Cloudflare. The signed
certificate and order record are kept in a private fulfillment database and in
the append-only issuer ledger. The private signing key remains on an isolated
issuer host and is never sent to the website, Stripe, or the Mardo app.

## Sharing and choices

Floof Logic shares purchase information with service providers only as needed
for checkout, transactional delivery, infrastructure, fraud prevention, and
legal compliance. It does not sell personal information or use purchase data
for third-party behavioral advertising.

To ask about, correct, or delete personal information where applicable, email
privacy@mardo.app. Some order and financial records may need to be retained for
legal, security, refund, or accounting obligations. Certificate recovery and
support procedures are in SUPPORT.md.
