This update: website visit statistics

Updated 10 October 2026: the website adds Cloudflare Web Analytics to view overall visits and page views. The service also collects page-load performance, without analytics cookies, browser storage or cross-site visitor identifiers. Recording starts only after this Policy and the corresponding webpage code are published. This does not change how the desktop application handles local documents. The existing server-log disclosures still apply to records not yet retired or removed.

Cloudflare retains its analytics; its dashboard currently provides access to the previous six months. This is not a promise that raw data is deleted after six months and does not extend the retention periods for existing server logs. Details: https://developers.cloudflare.com/web-analytics/faq/ .

1. Controller and scope

NoveMD is operated by Xudong Wang, an individual developer based in Tianshui, Gansu, China. Xudong Wang is the data controller for the personal information described in this Privacy Policy. Privacy enquiries may be sent to annunziata.mansker@gmail.com; China support is available at 613427838@qq.com.

This Policy applies to the NoveMD website, purchase and digital licence delivery, desktop licence activation, voluntary device deactivation, update checks and support communications that you initiate.

2. Local-first design and device data

NoveMD is a local-first desktop Markdown editor. Documents you open or create, local backups and recovery information, language and interface preferences, licence state and recent workspace state are stored on your device.

  • You control your documents and save locations.
  • NoveMD does not upload Markdown document content for cloud storage, advertising or product analytics.
  • Uninstalling the application may not remove documents, backups or preferences outside the installation folder; you can delete those files and application data yourself.

3. Information we process

When a device is activated or voluntarily deactivated, we may process the redemption or licence code, a random device identifier, device public key or device fingerprint, request identifier, application version, IP address, request time and security logs.

Daily website statistics cover only GET requests for allowlisted public information pages and Windows installer download endpoints. The statistical log records the connection-source IP address, request time, page or installer path without query parameters, and HTTP response status. The browser User-Agent is used only while processing a request to exclude common bots and is not stored in the statistical log.

The statistical log does not retain complete requests, query parameters, request or response headers, cookies, referrers, request bodies, order details or licence codes. Activation and payment-result pages, licensing and payment APIs, health checks, update manifests and other resources are excluded from these statistics. This restriction does not prevent separate security records necessary to operate the services.

For a purchase, Waffo Pancake may provide the order number, purchaser email, product, amount, currency, payment status and refund or chargeback status needed to deliver the licence and provide support. We do not receive or store complete payment-card numbers.

When you contact us, we process the email address, message, attachments and other information you choose to provide for support. Do not email complete card details or publish a licence code.

4. Purposes and legal bases

We process the relevant information only to perform the software licence contract, deliver licences, administer the two-device limit, process voluntary deactivation, provide support and refunds, check for updates, secure the services, prevent fraud and meet legal obligations. Minimal website access logs are separately used to understand overall use of public pages and download endpoints and improve content and delivery, not for advertising profiles or linking to orders, licences or device records.

The corresponding legal bases are performance of a contract, compliance with legal obligations and legitimate interests in operating and protecting the services and improving the website through minimal statistics. Processing that requires consent will occur only after valid consent is obtained. You may object as described in the privacy-rights section of this Policy.

5. Payment processor

China-region and Global checkout and payment-card data are processed by Waffo Pancake. Complete card numbers do not pass through or remain on NoveMD servers. Waffo Pancake processes payment, tax, fraud-prevention, refund and chargeback information under its own privacy policy and applicable payment rules.

NoveMD receives only the limited order information needed to deliver a digital licence, reconcile an order and provide after-sales support.

6. Cookies, analytics and sale of information

The NoveMD desktop application does not use product-usage analytics. Neither the desktop application nor the website uses behavioural advertising or marketing trackers, and we do not sell personal information. The website may use technology strictly necessary for language, regional or essential security functions, and hosting providers may produce standard access and security logs.

Public information pages load the Cloudflare Web Analytics script, which sends page addresses, referrers, page-load identifiers and loading-performance information to Cloudflare for aggregates such as visits and page views. We do not intentionally send orders, licence codes, email addresses, device identifiers or document content, or link these statistics to licensing or payments. Activation and payment-result pages do not load the script. It is also skipped when the page or referrer has a query string or fragment, or the referring page is an activation or payment-result page on this website.

The Cloudflare script is not loaded when the browser exposes doNotTrack as 1 or globalPrivacyControl as true. Visits are not exact unique people, and page views are not completed downloads or installations. Opt-outs, ad blockers, network failures and service-side sampling can cause undercounting.

The existing server-statistics scheme uses access-restricted logs for daily Beijing-time aggregates without analytics cookies. IP addresses are used only for within-day deduplication, not for browsing profiles across days or websites; requests carrying DNT: 1 or Sec-GPC: 1 are not recorded in the statistical log. Existing download counts represent successful requests, including range requests, not completed downloads.

If other non-essential analytics or marketing technology is introduced, this Policy will be updated first and a meaningful choice will be provided where applicable law requires it.

7. Providers and international processing

Cloud providers support the NoveMD website, licensing and update infrastructure. The licensing service is deployed in South Korea, while domain and related infrastructure providers may operate in China. Depending on your location, limited order, activation, device, support and request information may be processed in China, South Korea and the regions where Waffo Pancake or its payment partners provide their services.

Cloudflare processes Web Analytics through its global infrastructure, potentially outside your country or region. Normal network connections expose the source IP to Cloudflare; Cloudflare states that RUM discards it at the receiving data center, without retaining it in core databases or logs, and does not track individuals through cookies, browser storage or fingerprinting. Service details: https://developers.cloudflare.com/speed/observatory/rum-beacon/ .

We share information only as necessary to provide the service, meet legal obligations or act with your consent. Providers are required to apply security and confidentiality measures appropriate to their role. Contractual or other lawful safeguards are used for international transfers where applicable law requires them.

8. Retention

Local documents, backups and preferences remain on your device until you delete them. Licence and device records are retained while a licence remains valid. After a licence ends through refund, chargeback, termination or final deactivation, related records are retained for no more than 24 months for dispute resolution and abuse prevention unless law requires longer retention.

The minimal raw statistical log, which includes IP addresses and must not be treated as anonymous, is kept for no more than seven days in a private server directory accessible only to necessary services and administrators. Daily count aggregates without IP addresses or personal identifiers are kept for no more than 365 days. Logs have capacity limits and scheduled cleanup; these directories are not publicly accessible.

Support records are retained for no more than 24 months after the last communication, and routine server security logs for no more than 90 days. Order and transaction records received by us may be retained for up to seven years for tax, accounting, refund and dispute obligations, unless applicable law requires a longer period or permits a shorter one. Expired records are deleted or anonymised.

9. Your privacy rights

Depending on where you live, you may request information, access, correction, deletion, restriction or portability, object to certain processing, or withdraw consent previously given. You may also complain to your local data-protection authority.

Send requests to annunziata.mansker@gmail.com. We may need to verify your identity and normally respond within 30 calendar days, subject to any different period required by applicable law.

10. Security

We use technical and organisational safeguards proportionate to the risk, including HTTPS in transit, access controls and protections for the licensing service. No system can be guaranteed completely secure.

If a personal-data incident requires notice, affected people and the competent authority will be notified within the period required by applicable law.

11. Children and third-party resources

NoveMD purchase and licensing services are intended for people aged 18 or older. We do not knowingly collect personal information from anyone under 18. A parent or guardian who believes a child provided information may contact us to request deletion.

Documents and the website may refer to images, fonts or links hosted by third parties. Loading them connects to the third party and its own privacy terms apply.

12. Changes and contact

This Policy may change when features, providers or legal obligations change. Material changes will be presented clearly before they take effect through a website notice or another appropriate method, and the effective date and version at the top of this page will be updated.

Controller: Xudong Wang, Tianshui, Gansu, China. International privacy and support: annunziata.mansker@gmail.com. China support: 613427838@qq.com.