Privacy Policy

Local files

Ritemark is a free, open-source desktop application for macOS and Windows. Ritemark stores and edits user files locally. Productory does not receive or host a copy of the user’s workspace as part of ordinary editing. Users choose and control any separate file synchronization or backup service.

Desktop analytics

When analytics is enabled, Ritemark uses PostHog’s EU service to collect anonymous product-usage events. Analytics is enabled by default and can be disabled in Ritemark settings. Ritemark stores a random anonymous identifier in local application state. Events may include app version and platform, app-session starts, feature use, selected agent use, and reaction choices. They do not include AI prompts or file contents. If a user explicitly submits written feedback, the text entered by the user is transmitted with that feedback event.

PostHog Privacy Policy

AI-provider processing

AI features are optional. When a user invokes AI, the selected local runtime sends the request and relevant context directly to the selected external provider or service. Supported routes include Anthropic through Claude Code, OpenAI through Codex, and Google, OpenAI, Anthropic, or OpenRouter through OpenCode. The runtime uses the user’s provider account or API key.

Depending on the task, transmitted context may include the user’s prompt, active-file paths or content, selected text and surrounding context, explicit attachments, shared browser context, recent cross-runtime conversation context, and tool results. Where the user’s permission settings allow it, an agent may also read or modify other workspace files or use tools.

Each provider processes data under the terms, privacy policy, retention choices, and account settings applicable to the user. Productory does not receive the user’s API key through an AI proxy.

User control

Ritemark can be used without invoking AI. Before an AI turn, users can review visible context chips, remove supported context items, choose the runtime and model, and select a permission mode. Removing an item from one turn does not prevent an authorized agent from later reading a workspace file with an allowed tool.

Google Docs publishing

Publishing to Google Docs is optional. If you connect a Google account in Ritemark Settings, Ritemark can create a Google Doc from a markdown document and later update the same Doc when you choose Sync. Ritemark only sends to Google Docs; it does not read anything from a Google Doc back into your markdown files.

Ritemark asks Google for one permission, drive.file. With it, Ritemark can open only the Google Docs it creates and a document you pick yourself in Google’s file picker to use as a template. It cannot see or change any other file in your Google Drive.

With that permission, Ritemark:

• reads your Google account’s email address, name, and account ID, to show which account is connected and to make sure each document keeps syncing with the account that created its Google Doc;
• creates a Google Doc in your Google Drive when you choose Create Google Doc, as a new document or as a copy of the template you picked;
• when you choose Sync, reads that Google Doc, to check whether it was changed in Google Docs since the last Sync and to place tables and images, and replaces its text with the current version of your markdown document, asking you first if it was changed;
• reads the name and type of the template you pick.

Images in your document are uploaded to your Google Drive for a few seconds so that Google Docs can copy them into the Doc. During those seconds the uploaded image is shared with anyone who has its link; the link is random and Ritemark does not show or send it anywhere. Ritemark then removes the sharing and deletes the uploaded copy. Images that are already on the web are passed to Google by their address, and Google fetches them from there.

Everything Ritemark exchanges with Google travels directly between your device and Google. No document content, Google data, or sign-in token passes through Productory’s servers, and Productory does not receive them. Ritemark’s usage analytics do not record anything about Google Docs publishing.

Your Google sign-in tokens are stored on your device, encrypted with your operating system’s protection (the Keychain on macOS, Windows data protection on Windows). The link between each markdown file and its Google Doc — the file’s location on your device, the Doc’s ID and title, the connected account, when it was last synced, and a fingerprint of the version last sent — is stored in Ritemark’s local storage on your device, as is the name and ID of the template you picked.

You can stop at any time. Disconnect in Ritemark Settings asks Google to revoke Ritemark’s access and deletes the sign-in tokens, the account details, and the template choice from your device. It never deletes a Google Doc. The links between your files and their Google Docs are kept so that reconnecting the same account continues where you left off; Remove Google Docs link in a document’s Export menu deletes that document’s link. You can also remove Ritemark’s access in your Google Account’s third-party connections.

Ritemark uses Google user data only to provide Google Docs publishing as described here. It does not sell it, use it for advertising, transfer it to others, or use it to train AI models, and Google Docs publishing does not pass it to Ritemark’s AI features. Ritemark’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.