MarkTodo has no account system, no server and no sync service. There is nowhere for your todos to go, because nothing was ever built to receive them. This page says precisely what that means for each of the three things carrying the name.
The Obsidian plugin
Collects nothing. Sends nothing.
The plugin reads and writes Markdown files in your vault and keeps an in-memory index of the todos it finds. It makes no network requests of any kind — there is no telemetry, no crash reporting, no update ping, and no remote configuration.
Its index is a cache. Delete it, restart Obsidian, and it rebuilds from your notes, because the notes were always the only copy that mattered.
The Android app
Collects nothing. Sends nothing.
The app opens the vault folder you pick through Android’s storage picker and works on the files inside it. That folder grant is the app’s entire access to your device; it cannot read anything you did not hand it. No sign-in, no profile, no analytics SDK, no advertising identifier, no crash reporter.
For accuracy, the permissions it declares and what each is for:
| Permission | Why |
|---|---|
| Storage access (SAF) | Reading and writing the vault folder you choose |
| Notifications, exact alarms, boot completed | Local reminders for due todos, scheduled on your device |
| Vibrate | Haptic feedback |
| Internet | Declared by the React Native framework; the app makes no network requests of its own |
| Display over other apps | Returning to MarkTodo after handing a note off to Obsidian |
One thing outside our control: the app is distributed through Google Play, and Google collects its own data about installs and crashes under its privacy policy. We see only the aggregate counts Play shows every developer — installs, uninstalls, ratings, and anonymised crash traces. We cannot see who you are or what is in your vault.
This website
The site is static HTML on Cloudflare. It sets no cookies and has no sign-in. Fonts are served from this domain, not from Google Fonts, so loading a page tells no third party you were here.
The docs search runs entirely in your browser, against an index served from this domain, so what you type into it never leaves your device. The docs sidebar remembers which sections you have open in your browser’s session storage, which is cleared when you close the tab and is never sent anywhere.
It runs Cloudflare Web Analytics, which counts page views without cookies, without fingerprinting, and without tracking you across other sites. It records things like the page, referrer, country and browser, aggregated. There is no identifier that follows you from one visit to the next, and nothing that can be tied back to a person. Cloudflare’s analytics privacy notice has the details.
Cloudflare also keeps short-lived request logs to serve the site and block abuse, as any web host does.
Links that leave this site
Discord, X and Google Play are other companies’ services with their own privacy policies. Following a link to one hands you over to them.
Your rights
Since nothing about you is collected, stored or shared, there is nothing to
request, correct, export or delete. Your todos are .md files on hardware you
control — you already have the export, and deletion is the same key it has
always been.
Children
MarkTodo is not directed at children under 13 and collects no personal information from anyone, of any age.
Changes
If this ever stops being true — if a feature needs a server, for instance — this page changes before that ships, and the change is announced in Discord. It will not be edited quietly.
Contact
Questions about any of this: ask in Discord, or send a message on X.