Privacy Policy

Last updated: July 15, 2026

What is yeet.md?

yeet.md is a free Markdown sharing tool operated by David V. Kimball LLC. You can write Markdown, preview it, and share it with a link. No accounts required.

Data we store

Published snapshots (server-side)

When you click Publish, the Markdown content is stored on our servers (Netlify Blobs) and a permalink is returned. Published snapshots are accessible to anyone with the link and persist until manually deleted.

If you published anonymously, the snapshot cannot be changed afterwards: each publish creates a brand-new snapshot with a new id. If you published while signed in (see Signing in with GitHub below), you can edit that snapshot in place at the same URL, and the page records the date it was edited.

View counts

Each published snapshot tracks a view count that increments when someone loads the page. This count is stored in a separate key from the snapshot content and is not tied to any identifying information.

Rate limiting (IP addresses)

IP addresses are stored in a Netlify Blobs key/value store to enforce a per-IP publish rate limit (100 publishes per IP per hour) and prevent abuse. Each entry contains only the IP address (used as the key), a request count, and a reset timestamp: no other identifying information, no request bodies, and no link to any specific snapshot. Entries are overwritten with a fresh count when the same IP publishes again after their previous one-hour window expires. A small fraction of incoming publishes also trigger an opportunistic sweep that deletes any rate-limit entries whose one-hour window has already expired, so stale IP records do not accumulate indefinitely, though there may be a delay between an entry expiring and being swept. IPs in this store are used solely for abuse prevention and are not analyzed, exported, sold, or shared with third parties.

Local drafts (browser-only)

When you click Save in browser, drafts are stored in your browser's localStorage. This data never leaves your device. Clearing your browser data will delete local drafts.

Offline cache (browser-only)

The editor registers a service worker that caches the editor shell and its static assets in your browser's cache storage so the app keeps working offline after your first visit. This cache lives entirely on your device, contains only the app's own front-end files (not your documents), and is cleared when you clear your browser's site data.

Signing in with GitHub

Signing in is optional. You can publish, share, and delete snapshots without an account exactly as before. Signing in adds a dashboard of what you have published and the ability to edit or delete those snapshots.

What happens when you sign in:

• We use GitHub only to identify you. The sign-in popup is handled by Netlify's GitHub provider. We request the minimum scope (read:user), which allows reading your public profile. We do not request access to your repositories, code, private data, or email-sending ability.
• We do not keep your GitHub token. The token from the popup is sent to our server once, used immediately to ask GitHub who you are, and then discarded. It is never stored on our servers and never written to your browser's storage.
• What we store about you: your GitHub numeric user id, your GitHub login, and your avatar URL, inside a signed session cookie. Snapshots you publish while signed in additionally record your user id and login so we know they are yours.
• The session cookie is HttpOnly (JavaScript cannot read it), SameSite=Lax, and cryptographically signed so it cannot be forged. It expires after 30 days. Signing out clears it.
• No third-party tracking. The cookie exists solely to keep you signed in. There are no analytics or advertising cookies.
• Deleting your account data: sign out to drop the session, and delete individual snapshots from your dashboard. We hold no other profile record.

HTTP API

yeet.md exposes a small public HTTP API (documented at yeet.md/api) so you can publish and delete snapshots programmatically, for example with curl or a script.

• Publishing sends your Markdown to POST /api/share and returns the snapshot id, public URL, and a delete token. No account or authentication is required to publish.
• Deleting sends the delete token to DELETE /api/delete/:id as a bearer token.

Snapshots created through the API are stored, served, rate-limited, and governed by exactly the same terms as snapshots published from the website; see Published snapshots above. You are responsible for storing any delete token the API returns, as it is the only way to remove that snapshot later.

Browser extension

The yeet.md browser extension (available for Chrome and Firefox) lets you publish Markdown to this site from a small popup or a right-click menu without leaving your current tab. Its data handling is the same as the website's, with one small addition for delete tokens. In particular:

• No automatic page reading. The extension never reads the content of pages you visit. It only sees text you explicitly paste into its popup or text you have actively highlighted before choosing the right-click "Publish selection" menu item.
• No analytics, no telemetry, no tracking. The extension does not collect browsing history, clicks, keystrokes, or any other information about how you use it.
• Only one network destination. The only origin the extension contacts is https://yeet.md. It POSTs to /api/share when you publish, and it loads the permalink page at /s/<id> when you choose to open a published link. No third-party servers, no CDNs at runtime, no fonts or analytics endpoints.
• Delete tokens stored locally. When you publish a snapshot via the extension, yeet.md returns a delete token alongside the URL. The extension stores that token in its own browser-extension storage (chrome.storage.local / browser.storage.local) under a single key. A small content script that runs only on https://yeet.md/s/* bridges the token into that page's localStorage so the existing Delete button on the permalink page becomes visible to whoever published the snapshot. The token never leaves your device unless you actively click Delete (in which case it is sent to /api/delete to authorize the deletion).
• Permissions used. contextMenus (right-click menu items, gated to text selection only), storage (delete tokens, as described above), clipboardWrite (to copy the published URL to your clipboard after publishing), notifications (to confirm a successful right-click publish), and host_permissions for https://yeet.md/* only (no other origins). The extension does not request the tabs, activeTab, history, cookies, or any other broad permission.

Once you click Publish in the extension, the resulting snapshot is governed by the same terms as snapshots published from the website; see Published snapshots above.

Obsidian plugin

The yeet.md Obsidian plugin publishes the note you are editing to yeet.md from inside Obsidian. It uses the same /api/share and /api/delete endpoints as the website, and its data handling matches the website's with a few plugin-specific details:

• Only your published note leaves your vault. The plugin sends the content of the note you explicitly choose to publish. It does not read, upload, or index the rest of your vault, and it contacts only https://yeet.md.
• Property stripping before publish. You can configure a list of property (frontmatter) fields to remove from the copy that is sent to the server; fields whose names begin with an underscore are always stripped. Your note on disk is never modified; only the outgoing HTTP payload is filtered.
• Delete tokens in your device's secret storage. Each snapshot's delete token is stored in Obsidian's built-in SecretStorage, which is backed by your operating system's keychain on desktop. Tokens are kept in a single secret and are not written to your vault or synced with it, so a shared or synced vault cannot be used to unpublish your snapshots. Because tokens are device-local, a snapshot can only be self-deleted from the device that published it.
• Snapshot records (non-sensitive). So the plugin can show and manage what you have published, it keeps a local record of each snapshot (its id, URL, publish date, a content hash, and the source note path) in the plugin's own data.json. The delete token is the only sensitive value, and it is kept separately in secret storage as described above.
• Client identifier for rate limiting. The plugin sends a per-vault random identifier in an X-Client-Id header so the server can apply rate limits. It is not an authentication credential and is not tied to your identity.
• No analytics, no telemetry, no tracking.

Snapshots published from the plugin are governed by the same terms as snapshots published from the website; see Published snapshots above.

Data we don't collect

• No accounts or personal information
• No analytics or tracking scripts
• No advertising

Deleting your data

• Local drafts: Clear your browser's localStorage, or use the "Remove from list" button in the saved notes panel (which only removes the local copy, not any published snapshots).
• Published snapshots: If you published a snapshot from the same browser, a Delete button will appear on the permalink page. This uses a token stored at the time of publishing: in this site's localStorage (if you published from the website), in browser-extension storage (if you published from the yeet.md extension, which bridges the token to the page automatically), in your OS keychain (if you published from the Obsidian plugin), or wherever you saved it (if you published through the API).

Important: If you clear your browser data, lose your keychain, or switch devices, you may lose the ability to self-delete your published snapshots. If you need a snapshot removed and can no longer delete it yourself, file a report at yeet.md/report with the URL and we will remove it for you.

Site administration

David V. Kimball LLC, as the site operator, has access to an admin dashboard that can view and delete all published snapshots. This access is password-protected and limited to the site operator.

Important disclaimers

• Published snapshots are public. Anyone with the link can view them. Do not publish sensitive or confidential information.
• yeet.md is provided as-is with no warranty of any kind, express or implied.
• We reserve the right to remove any published snapshot at any time without notice.

Liability and use at your own risk

yeet.md is a free tool. By using it, you agree that:

• Use at your own risk. The service is provided as-is and as-available. We make no guarantees about uptime, data persistence, accuracy, or fitness for any purpose.
• You are responsible for the content you share. You must not share content that is illegal, harmful, infringing, defamatory, harassing, or otherwise objectionable. You retain ownership of your content but grant us the right to host and serve it as part of operating the service.
• We are not liable for user-generated content. yeet.md acts as a passive host. We do not pre-screen content. We are not responsible for any content shared by users, nor for any consequences arising from that content.
• We are not liable for misuse by third parties. We are not responsible for any harm caused by malicious actors, prompt injection, social engineering, or any other misuse of content shared on or through the service.
• No liability for damages. To the maximum extent permitted by law, David V. Kimball LLC (the operator of yeet.md), its members, employees, contractors, contributors, and any associated parties shall not be liable for any direct, indirect, incidental, special, consequential, or exemplary damages arising from your use of the service or any content accessed through it.
• Indemnification. You agree to indemnify and hold harmless David V. Kimball LLC and its members, employees, and contractors from any claims, damages, or expenses arising from your use of the service or your violation of these terms.

If you do not agree with these terms, do not use yeet.md.

Contact

For privacy concerns, abuse reports, or DMCA notices, file a report at yeet.md/report.