Markway logo

Privacy Policy

Effective date: 16 October 2026

This policy explains what Markway does with personal data. It covers the Markway browser extension and the website at markway.io.

Who we are

The controller is Daniel Wirtz, a sole proprietorship (eenmanszaak) trading as Markway, registered with the Dutch Chamber of Commerce (Kamer van Koophandel) under number 81308388.

Johannes Uitenbogaertstraat 53
3553 VN Utrecht
The Netherlands
support@markway.io

We decide why and how the data below is used, except where another company is the controller of its own service. Polar is the controller for the payment. A notes app is the controller for a note you choose to send it.

The short version

  • Highlighting happens on your device. Visiting a page does not upload that page to us.
  • Notes, highlights, templates, and keys for note apps stay in the extension until you export them or use a feature that sends them.
  • An account is optional. If you create one, we store your name and email on our servers.
  • Pro AI prompts, including page text that the prompt includes, are sent to our server and then to an AI provider.
  • Product analytics in the extension include the domain of the page, not the full address. This is on by default. You can turn it off in settings. If that setting cannot be read, nothing is sent.
  • We do not sell personal data, and we do not show ads.

What the extension handles on your device

On an http or https page, Markway can read:

  • Text you highlight, and the note you write in the editor
  • The page address, title, and domain, and article text extracted from the page when a template field or an AI prompt needs it
  • A screenshot of the visible tab, if that control is included in the build you installed
  • PDF bytes, so a PDF can open in Markway's viewer. A PDF on your computer is read only after you turn on "Allow access to file URLs" in the browser's extension settings

That data stays in the browser except in the cases under "What leaves your device".

The extension stores this locally:

  • Settings, including API keys and webhook addresses you enter
  • Templates you create, and copies of templates downloaded from the library
  • Highlights, stored with the page address they came from. While "Restore Editor State" is on (it is on by default), the editor draft for that page is stored too
  • If you sign in: a session token, your name, email, profile image, and a cached note of whether Pro is active
  • A random analytics id
  • PDF bytes, the PDF address, and the file name, in a local database. We delete them when you close or leave the viewer tab, and we delete anything older than 48 hours

Uninstalling the extension, or clearing its data in the browser, deletes this local copy.

What leaves your device

Account

If you create an account, we store:

  • Your name and email address, and your Google profile image if you sign in with Google
  • A hash of your password if you use email and password. We do not store the password itself. We do not currently email you to verify the address or to reset the password
  • A session: a token, when it expires, the IP address, and the browser user agent
  • Whether Pro is active and until when, and whether the account is a normal user or an admin

The extension does not use a cookie for sign-in. After you sign in on the website, the site gives the extension a bearer token. The extension stores that token and sends it to markway.io when it calls the API.

Creating an account also creates a Polar customer with your name and email, including if you never buy Pro. Polar is the seller of record for payments.

There is no delete button in the product yet. Email us and we will delete the account and the data we can tie to it.

Template library

The extension downloads the published template list from markway.io. That download does not include the page you are on, your highlights, or your account. A template can store a match pattern. We do not apply that pattern by uploading your page address. The extension reads the page address locally when a template field asks for it, such as a URL or domain field.

AI prompts (Pro)

If you are signed in with active Pro and you run an AI prompt, the extension sends the prompt to markway.io. By default the text includes the extracted text of the current page, up to about 40,000 characters, followed by the prompt you wrote. If the prompt already includes the page-content field, the page is not attached a second time.

We do not save the prompt or the reply in our database. The server sends the prompt through the Vercel AI Gateway. The provider is DeepSeek, and the default model is DeepSeek V4.1 Flash (deepseek/deepseek-v4.1-flash). We can change the model in hosting configuration. DeepSeek is based in China. Do not put passwords, private keys, or anything you would not send to that provider into a prompt.

AI, feedback, and help requests are rate-limited. The counter is tied to a hash of your user id or, if you are not signed in, a hash of your IP address. The counter does not store the raw IP. It expires after about an hour.

Feedback and help

If you send feedback, we store the message in our Notion workspace. If you ask for help, we store the message and the email address you type. The ticket title is the first few words of your message. We send what you type, not your highlights, unless you paste them in.

Analytics

Extension. If "Anonymized Tracking" is on, we send product events to PostHog's EU cloud (eu.i.posthog.com). The switch is on by default. Events can include the domain of the page (the hostname only: never the full address, path, or query), which feature you used, text lengths rather than the highlighted text, the name of an integration, and error messages. We do not attach your email. The id is the random one stored in the extension. Session replay is off. You can turn this off in Markway's settings. If the extension cannot read that setting, it sends nothing. A domain can still be personal, for example a private site you host, so this is product analytics rather than anonymous data.

Website. markway.io loads PostHog in cookieless mode. It records page views and clicks, including text on an element you click. It does not record sessions and it does not set an analytics cookie. It runs without a cookie banner. PostHog and our host can see the IP address on the request. PostHog's cookieless mode hashes identifiers on their side.

We do not sell analytics data and we do not use it for advertising.

Payments

Polar collects card details, invoices, and VAT. We never receive your card number. We store the Pro flag and end date Polar sends us. The price, billing period, and taxes are shown on Polar's checkout before you pay.

Exports you start

The note goes only where you send it:

  • Clipboard, or a Markdown file you download: stays on your device
  • Roam Research
  • When that connection is included in your build: Notion, Readwise, Reflect, Capacities, Tana, Obsidian, Logseq, Anytype, or a webhook address you set

Those services control what they receive, under their own terms. Keys you type stay in the extension and are sent to that service when you connect it or export. Obsidian, Logseq, and Anytype are contacted on your own computer.

If a note contains an embedded image and that build was configured with image hosting, the image is uploaded to a public Supabase Storage bucket named "screenshots", and the note then links to that public address. Anyone with the link can open the image. The default configuration in our source leaves image hosting unset, so images stay inside the note. The screenshot button is hidden unless that feature is enabled for the build.

Cookies

Cookies on the website are described in the Cookie Policy. The extension does not set browser cookies.

Why we use personal data

  • Contract, GDPR Article 6(1)(b): your account, sign-in, the template library, Pro status, and AI prompts you ask us to run
  • Legitimate interests, Article 6(1)(f): security, rate limits, and the analytics described above. The interest is running and improving Markway. You can object. In the extension, turn off Anonymized Tracking. On the website, email us. Website analytics do not use a cookie, so we may not be able to find older events from your email alone
  • Consent, Article 6(1)(a): Google sign-in, which you start yourself. You can stop it by signing out and removing Markway from your Google account. That does not undo processing that already happened
  • Legal obligation, Article 6(1)(c): tax and accounting records Polar must keep as merchant of record

You can use the highlighter without an account. Pro AI needs an account and an active subscription. Running an AI prompt sends the prompt, and usually the page text, as described above.

How long we keep it

  • Account and Pro status: until you ask us to delete them, or we no longer need them to provide the service. A website session lasts about seven days, which is the session library's default; we have not set a different lifetime in code. Signing out ends it sooner
  • AI prompts: not written to our database. The model provider may keep them under its own rules. Rate-limit rows expire after about an hour
  • Feedback and help tickets in Notion: until we delete them
  • Polar's customer and payment records: for as long as Polar must keep them
  • Data in the extension: until you delete it or uninstall
  • PDF bytes: when you leave the viewer, and after 48 hours at the latest
  • Analytics in PostHog: until you ask us to delete events we can connect to you, or we no longer need them

Who else receives data

  • Vercel hosts the website and API, and runs the AI Gateway that forwards prompts
  • Supabase hosts the Postgres database for accounts, sessions, the template library, and rate limits. Supabase Storage is used only when image hosting is configured
  • Polar sells Pro as merchant of record and handles payment, invoices, and VAT. Their privacy policy is at polar.sh/legal/privacy
  • PostHog, on its EU cloud (eu.i.posthog.com), receives analytics events
  • Google handles sign-in if you choose it
  • DeepSeek, through the Vercel AI Gateway, receives Pro prompts. DeepSeek is established in China. The European Commission has not issued an adequacy decision for China. Using an AI prompt sends the prompt, which may include the page you are reading, to that provider
  • Notion (United States) stores feedback and help tickets. We also use Notion to publish the public changelog, which is not your account data

A notes app or webhook receives a note only when you export it.

Some of these companies are outside the European Economic Area, including in the United States and, for AI prompts, China. Where there is no adequacy decision, a transfer needs a safeguard such as standard contractual clauses, or a narrow exception in the GDPR. Email us if you want the safeguard that applies to a particular recipient.

Security

The site and API use HTTPS. Passwords are stored only as hashes. The website session cookie is httpOnly, so page scripts cannot read it. No online service is perfectly secure.

Your rights

If the GDPR applies to you, you can ask us to:

  • Tell you what personal data we hold about you
  • Correct it
  • Delete it
  • Restrict processing, or object to processing based on legitimate interests, including analytics
  • Receive data you gave us, in a portable form, where we process it by automated means on the basis of a contract or consent
  • Withdraw consent where we rely on consent

Email support@markway.io. We may ask you to prove it is your account. We answer within one month, and we will tell you if we need more time. You can also complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl). If you live in another EU country, you can complain to the authority there.

We do not make solely automated decisions that produce legal effects about you. AI returns text for you to edit. Pro access follows the subscription status Polar reports.

Children

Markway is not directed at anyone under 16. We do not knowingly create accounts for children under 16. If you believe we have, email us and we will delete the account.

Changes

We will post changes on this page and change the date at the top. The terms for using Markway are in the Terms and Conditions.

Contact

Daniel Wirtz (Markway)
Johannes Uitenbogaertstraat 53
3553 VN Utrecht
The Netherlands
KvK 81308388
support@markway.io

Last updated: 16 October 2026