Privacy Policy

Local files

Ritemark is a free, open-source desktop application for macOS and Windows. Ritemark stores and edits user files locally. Productory does not receive or host a copy of the user’s workspace as part of ordinary editing. Users choose and control any separate file synchronization or backup service.

Desktop analytics

When analytics is enabled, Ritemark uses PostHog’s EU service to collect anonymous product-usage events. Analytics is enabled by default and can be disabled in Ritemark settings. Ritemark sends no events until the user has passed the second step of the welcome screens, where analytics can be turned off. If a user turned analytics off in an earlier version of Ritemark, it stays off. Ritemark stores a random anonymous identifier in local application state. Events may include app version and platform, app-session starts, feature use, selected agent use, and four setup steps: that the welcome screens were shown, that an AI provider was signed in, that a project (a folder) was opened from the welcome screens, and that a first message was sent. They do not include AI prompts or file contents. Events never include a file path, a file or folder name, the text of AI messages, or account details. Ritemark does not determine the user’s location: no GeoIP lookup is made and no location is derived from the IP address. If a user explicitly sends written feedback, the text the user entered is sent with it, also when analytics is off, under a one-off identifier. Feedback sent from Home’s first-week card can carry a label saying which question the user was answering.

Ritemark 2.1 adds the following counts. When the user sends a message to an AI in Ritemark, or a Flow runs an AI step, Ritemark counts it with which AI it was (Claude, ChatGPT or OpenCode) and whether it came from a chat or a Flow, never the message, the answer, the model, the file or the project. For each message, Ritemark counts whether an answer came back, whether the user stopped it, or which kind of problem stopped it: a sign-in that ended, a plan that does not include the AI, a limit reached, a model the AI refused, no connection, or another error from the AI provider. The error’s text is never included. When dictation or Transcribe turns the user’s voice into text, Ritemark counts that it happened and whether the recording was made in Ritemark or brought in as a file, never the words or the audio. When a document that began with the user’s voice is changed again on a later day, Ritemark counts that, with how many days later. To know which documents these are, Ritemark keeps a code on the user’s computer that cannot be turned back into a name, and forgets it after 30 days. The document’s name and text never leave the user’s computer. Ritemark also counts which of Home’s first-week requests was used (“what is here”, “what this project is for”, or the sample project’s “draft Module 4”) and with which AI; which kind of starting point in an empty chat was used (a project, an empty project, the sample, a short text, a long text, a table, a Word file or a PDF), whether the user edited it before sending, and with which AI; that a document was made, exported or published in the same session, and whether a first-week request came before it; and which way Send feedback was opened (the status bar, Help, AI information or All commands). None of these counts carries words, file or project names, paths, file counts or addresses. These counts follow the same rules as all other events: nothing is sent before the welcome screens are passed or while analytics is off, and no location is determined.

PostHog Privacy Policy

AI-provider processing

AI features are optional. When a user invokes AI, the selected local runtime sends the request and relevant context directly to the selected external provider or service. Supported routes include Anthropic through Claude Code, OpenAI through Codex, and Google, OpenAI, Anthropic, or OpenRouter through OpenCode. The runtime uses the user’s provider account or API key.

Depending on the task, transmitted context may include the user’s prompt, active-file paths or content, selected text and surrounding context, explicit attachments, shared browser context, recent cross-runtime conversation context, and tool results. Where the user’s permission settings allow it, an agent may also read or modify other workspace files or use tools.

Each provider processes data under the terms, privacy policy, retention choices, and account settings applicable to the user. Productory does not receive the user’s API key through an AI proxy.

User control

Ritemark can be used without invoking AI. Before an AI turn, users can review visible context chips, remove supported context items, choose the runtime and model, and select a permission mode. Removing an item from one turn does not prevent an authorized agent from later reading a workspace file with an allowed tool.

Google Docs publishing

Publishing to Google Docs is optional. If you connect a Google account in Ritemark Settings, Ritemark can create a Google Doc from a markdown document and later update the same Doc when you choose Sync. Ritemark only sends to Google Docs; it does not read anything from a Google Doc back into your markdown files.

Ritemark asks Google for one permission, drive.file. With it, Ritemark can open only the Google Docs it creates and a document you pick yourself in Google’s file picker to use as a template. It cannot see or change any other file in your Google Drive.

With that permission, Ritemark:

• reads your Google account’s email address, name, and account ID, to show which account is connected and to make sure each document keeps syncing with the account that created its Google Doc;
• creates a Google Doc in your Google Drive when you choose Create Google Doc, as a new document or as a copy of the template you picked;
• when you choose Sync, reads that Google Doc, to check whether it was changed in Google Docs since the last Sync and to place tables and images, and replaces its text with the current version of your markdown document, asking you first if it was changed;
• reads the name and type of the template you pick.

Images in your document are uploaded to your Google Drive for a few seconds so that Google Docs can copy them into the Doc. During those seconds the uploaded image is shared with anyone who has its link; the link is random and Ritemark does not show or send it anywhere. Ritemark then removes the sharing and deletes the uploaded copy. Images that are already on the web are passed to Google by their address, and Google fetches them from there.

Everything Ritemark exchanges with Google travels directly between your device and Google. No document content, Google data, or sign-in token passes through Productory’s servers, and Productory does not receive them. Ritemark’s usage analytics do not record anything about Google Docs publishing.

Your Google sign-in tokens are stored on your device, encrypted with your operating system’s protection (the Keychain on macOS, Windows data protection on Windows). The link between each markdown file and its Google Doc — the file’s location on your device, the Doc’s ID and title, the connected account, when it was last synced, and a fingerprint of the version last sent — is stored in Ritemark’s local storage on your device, as is the name and ID of the template you picked.

You can stop at any time. Disconnect in Ritemark Settings asks Google to revoke Ritemark’s access and deletes the sign-in tokens, the account details, and the template choice from your device. It never deletes a Google Doc. The links between your files and their Google Docs are kept so that reconnecting the same account continues where you left off; Remove Google Docs link in a document’s Export menu deletes that document’s link. You can also remove Ritemark’s access in your Google Account’s third-party connections.

Ritemark uses Google user data only to provide Google Docs publishing as described here. It does not sell it, use it for advertising, transfer it to others, or use it to train AI models, and Google Docs publishing does not pass it to Ritemark’s AI features. Ritemark’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.