Privacy policy

Your data

Rendr does not collect or keep your data, so the developer has no account or data of yours to hand over or delete. Rendr saves settings, recent documents and bookmarks on your device. A bookmark lets Rendr reopen a file or folder you chose without asking again. Some of these records contain full file and folder paths.

Rendr does not send crash reports, diagnostics or logs, and it does not write document text or full file paths to the system log. Apple may give the developer aggregate crash and diagnostic data from people who chose to share it with app developers. That data comes from Apple, and it may be missing for rare events.

Mac

Documents

Rendr opens Markdown files that you choose in Finder or the Open panel, or that macOS sends to Rendr.app. You can also open them from links in a document, from Open Recent, and with Browse Folder.

Rendr remembers your recent documents. If Reopen documents when Rendr starts is on in Settings > Behavior, Rendr also saves each open window: a bookmark to its document, the window size, zoom, scroll position and outline state. Turning the setting off deletes these saved windows.

Quick Look

Finder's Quick Look previews come from a sandboxed extension inside Rendr. It reads only the file that Quick Look hands it, has no network access, and never loads remote content.

Remote content

Rendr blocks remote images and media by default. Loading them contacts the servers that host them, which then see your IP address. Your Mac may also keep a cached copy.

To load them in one document, choose File > Load Remote Content for This Document. The permission ends when you close the document. To load them in every document you open afterward, turn off Block remote content by default in Settings > Privacy.

Printing and PDF export follow the current document's permission, so they may load the same remote images and media. HTML export never loads remote content.

Documents cannot run scripts. Rendr's content security policy also blocks remote scripts, styles, fonts and frames, and any other network request from a document.

Rendr opens web and email links only after you click them, and macOS opens them in your default browser or mail app. A link to another Markdown file opens in Rendr. A link to any other local file asks first, then opens the file in its default app.

Local images and media

Rendr loads the images and media that a document refers to only from the document's own folder, or from a parent folder that you choose. Access ends when you close the document, unless you choose to remember it, which saves a bookmark.

Browse Folder lists the Markdown files in a folder you choose. You can remember that folder for the document, which also saves a bookmark.

To end folder access for the open document and delete its bookmark, choose File > Revoke Folder Access. To clear saved access for all documents, including closed ones, use Clear Saved File and Folder Permissions in Settings > Privacy.

Custom stylesheet

You can choose one local CSS file in Settings > Appearance and let Rendr remember it with a bookmark. Rendr reads at most 256 KiB and never downloads the file. It rejects anything that could load a resource, such as @import and url(), along with malformed CSS and HTML characters that could break out of the stylesheet. You can turn off, reveal, replace or remove the stylesheet at any time.

Export

Rendr saves exports only to locations you choose.

Source editor

You can choose a source editor in Settings > Behavior. Rendr starts it only when you choose Edit Source in Editor or Reveal in Editor.

For a command-line editor, Rendr saves a bookmark to the editor program, along with its path and file identity, so it can tell if the program has changed. It passes exactly three arguments: the Markdown file path, the line and the column. Rendr never runs a shell, a command string or AppleScript, and it does not search PATH. The macOS sandbox may still block a command-line editor.

For Xcode, Rendr saves no permission. It asks macOS to open the document in Xcode, with no arguments.

Copy Source Location works without any editor.

Open in Terminal

Open in Terminal opens the folder that contains the current document in Terminal, Ghostty or Kitty. Rendr saves only which terminal you chose. It sends no commands, document text, files, line or column numbers, arguments or environment settings. Your terminal settings control windows, tabs and shell startup. Rendr never opens a terminal on its own.

If Rendr has no access to the folder, it asks you to choose it. Rendr then remembers the folder with a read-only bookmark that lasts after a restart, and uses it only for Open in Terminal. Rendr gives up the access as soon as the folder opens. The bookmark gives the preview no access to images or folder browsing. If a saved folder stops working, Rendr asks you to choose it again.

To forget these folders and keep your terminal choice, use Clear Saved Terminal Folder Approvals in Settings > Behavior. Clear Saved File and Folder Permissions in Settings > Privacy forgets them too. Choosing None as the terminal keeps the saved folders.

Your controls

• File > Revoke Folder Access ends folder access for the open document and deletes its bookmark.
• Clear Saved File and Folder Permissions in Settings > Privacy forgets all saved folders, including terminal folders, and removes the custom stylesheet and source editor. Open documents and saved windows stay.
• Settings > Appearance turns off, replaces or removes the custom stylesheet.
• Settings > Behavior replaces or removes the source editor. Turning off Reopen documents when Rendr starts there deletes saved windows.
• Settings > Privacy sets whether remote images and media are blocked by default.

iPhone and iPad

Rendr for iPhone and iPad comes with the same App Store purchase and follows the same rules: no analytics, accounts, tracking, diagnostic upload or document upload. It has no custom stylesheet and no setting that loads remote content by default.

Documents

Rendr opens the Markdown file you choose in Files or open from another app. If the file is in iCloud Drive and not yet on your device, iOS downloads it first.

The system saves a bookmark for each window so Rendr can reopen that window's last document. This saved state holds no document text and no remote-content permission. A reopened document goes through the same checks as one opened from Files. If the bookmark no longer works, Rendr clears it and asks you to open the file again. Closing a window discards its saved state. Close Document deletes the bookmark, so Rendr does not reopen the document.

Local images and media

Choosing a file does not give Rendr access to the files next to it. To load local images and media, choose Grant Folder Access and pick a folder that contains the document. Rendr reads only the files that documents in that folder refer to, and remembers the folder with a bookmark.

Settings > Permissions lists saved folders. You can revoke one, or use Revoke Saved Folder Access to clear them all. Revoking a folder removes its images and media from the open previews that use it. If saved access stops working, choose the folder again.

Remote content

Rendr blocks remote images and media every time a document opens. To load them in the current document, tap Load Remote Content in the preview or use the Permissions menu. Loading them contacts the servers that host them, which then see your IP address. Block Remote Content removes them right away and stops pending preview work. Rendr never saves this permission, so closing or reopening the document resets it.

Documents cannot run scripts, and remote scripts, styles, fonts, frames and other network requests stay blocked. Web and email links open in another app only after you tap them. Quick Look previews never load remote content.

Share, export and print

Sharing, PDF export and printing follow the current document's remote-content permission. Standalone HTML never loads remote content and embeds only the local images and media you gave Rendr access to.

Rendr builds export files in temporary storage before you choose where to save or share them, and deletes them when you finish or cancel. Switching away from Rendr, closing or replacing the document, or revoking a permission cancels an export in progress. Rendr cannot take back files you already saved or shared, or print jobs you already sent.

Contact

Thorsten Rhau develops Rendr. For privacy questions or support, email rendr-support@rhau.se. You write any email yourself, and Rendr attaches no document text, file paths, logs or diagnostics.