Zero-Knowledge Processing Architecture
Unlike conventional software-as-a-service (SaaS) document conversion platforms that receive your confidential files on a remote server, process them in a cloud worker queue, and return a download link, AllMDConverter operates on a **zero-knowledge, client-side paradigm**.
Our conversion pipelines (including Markdown to PDF, Markdown to HTML, Markdown to DOCX, Markdown to Text, PDF to Markdown, HTML to Markdown, DOCX to Markdown, and Text to Markdown) use:
Information We Do NOT Collect
Because we do not want or require access to your personal data or intellectual property, we deliberately refrain from collecting:
No Document Content
We never read, inspect, store, or transmit the text, diagrams, code, or images contained in your documents.
No Account Credentials
We do not require user registration, passwords, social logins, email addresses, or phone numbers to use the converters.
No Payment Details
AllMDConverter is 100% free. We never request credit cards, billing addresses, or financial data.
No Document Metadata
Original filenames, document authors, timestamps, and EXIF attributes remain private on your computer.
Local Browser Storage
We use browser localStorage only to preserve non-sensitive interface preferences across sessions. This information never leaves your device:
| Storage Key | Purpose | Retention |
|---|---|---|
| theme | Saves your preferred color mode ('dark' or 'light') | Persistent until cleared |
| preview-font | Stores your chosen typography font for export previews | Persistent until cleared |
| preview-palette | Stores selected color theme styling for generated PDFs/HTML | Persistent until cleared |
You can remove this data at any time by clearing your browser cache and cookies, or via developer tools.
Security & Content Isolation
We take application security seriously. In-browser document conversion is protected by multiple defense-in-depth layers:
- DOMPurify Sanitization: All rendered Markdown and HTML previews are sanitized against cross-site scripting (XSS), malicious script tags, nested payloads, and dangerous SVG exploits.
- Strict Content Security Policy (CSP): Our HTTP headers enforce strict script execution boundaries, forbidding untrusted external script injection.
- Sandboxed PDF & Worker Execution: PDF parsing occurs inside isolated Web Workers, shielding the main thread from memory corruption or blocking.
GDPR & CCPA/CPRA Compliance
Under global privacy frameworks including the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA/CPRA):
- Right to Know / Access: Since we store zero personal data, there are no personal records or document files for us to disclose.
- Right to Deletion: Your document data is held exclusively in your local device's volatile RAM; closing or refreshing your browser immediately destroys any in-memory document state.
- No Sale or Sharing of Personal Data: We do not sell, rent, monetize, or disclose your personal data to any third party for marketing or advertising purposes.
Policy Changes & Inquiries
We may periodically update this Privacy Policy to reflect enhancements to our toolset or evolving regulatory standards. Any modifications will be posted directly to this page with an updated timestamp.
If you have questions regarding this Privacy Policy or our architectural security model, please reach out via our Contact Page or submit an issue on our GitHub repository.