# Privacy Policy Last updated: October 6, 2026 ## What is yeet.md? yeet.md is a free Markdown sharing tool operated by David V. Kimball LLC. You can write Markdown, preview it, and share it with a link. No accounts required. ## Data we store ### Published snapshots (server-side) When you click **Publish**, the Markdown content is stored on our servers (Netlify Blobs) and a permalink is returned. Published snapshots are accessible to anyone with the link and persist until manually deleted. If you published anonymously, the snapshot cannot be changed afterwards: each publish creates a brand-new snapshot with a new id. If you published while signed in (see **Signing in with GitHub** below), you can edit that snapshot in place at the same URL, and the page records the date it was edited. ### View counts Each published snapshot tracks a view count that increments when someone loads the page. This count is stored in a separate key from the snapshot content and is not tied to any identifying information. ### Rate limiting (IP addresses) IP addresses are stored in a Netlify Blobs key/value store to enforce a per-IP publish rate limit (100 publishes per IP per hour) and prevent abuse. Each entry contains only the IP address (used as the key), a request count, and a reset timestamp: no other identifying information, no request bodies, and no link to any specific snapshot. Entries are overwritten with a fresh count when the same IP publishes again after their previous one-hour window expires. A small fraction of incoming publishes also trigger an opportunistic sweep that deletes any rate-limit entries whose one-hour window has already expired, so stale IP records do not accumulate indefinitely, though there may be a delay between an entry expiring and being swept. IPs in this store are used solely for abuse prevention and are not analyzed, exported, sold, or shared with third parties. ### Local drafts (browser-only) When you click **Save in browser**, drafts are stored in your browser's localStorage. This data never leaves your device. Clearing your browser data will delete local drafts. ### Offline cache (browser-only) The editor registers a service worker that caches the editor shell and its static assets in your browser's cache storage so the app keeps working offline after your first visit. This cache lives entirely on your device, contains only the app's own front-end files (not your documents), and is cleared when you clear your browser's site data. ## Signing in with GitHub Signing in is **optional**. You can publish, share, and delete snapshots without an account exactly as before. Signing in adds a dashboard of what you have published and the ability to edit or delete those snapshots. What happens when you sign in: - **We use GitHub only to identify you.** The sign-in popup is handled by Netlify's GitHub provider. We request the minimum scope (`read:user`), which allows reading your public profile. We do **not** request access to your repositories, code, private data, or email-sending ability. - **We do not keep your GitHub token.** The token from the popup is sent to our server once, used immediately to ask GitHub who you are, and then discarded. It is never stored on our servers and never written to your browser's storage. - **What we store about you:** your GitHub numeric user id, your GitHub login, and your avatar URL, inside a signed session cookie. Snapshots you publish while signed in additionally record your user id and login so we know they are yours. - **The session cookie** is HttpOnly (JavaScript cannot read it), SameSite=Lax, and cryptographically signed so it cannot be forged. It expires after 30 days. Signing out clears it. - **No third-party tracking.** The cookie exists solely to keep you signed in. There are no analytics or advertising cookies. - **Deleting your account data:** sign out to drop the session, and delete individual snapshots from your dashboard. We hold no other profile record. ## HTTP API yeet.md exposes a small public HTTP API (documented at [yeet.md/api](https://yeet.md/api)) so you can publish and delete snapshots programmatically, for example with `curl` or a script. - **Publishing** sends your Markdown to `POST /api/share` and returns the snapshot id, public URL, and a delete token. No account or authentication is required to publish. - **Deleting** sends the delete token to `DELETE /api/delete/:id` as a bearer token. Snapshots created through the API are stored, served, rate-limited, and governed by exactly the same terms as snapshots published from the website; see **Published snapshots** above. You are responsible for storing any delete token the API returns, as it is the only way to remove that snapshot later. ## Browser extension The yeet.md browser extension (available for Chrome and Firefox) lets you publish Markdown to this site from a small popup or a right-click menu without leaving your current tab. Its data handling is the same as the website's, with one small addition for delete tokens. In particular: - **No automatic page reading.** The extension never reads the content of pages you visit. It only sees text you explicitly paste into its popup or text you have actively highlighted before choosing the right-click "Publish selection" menu item. - **No analytics, no telemetry, no tracking.** The extension does not collect browsing history, clicks, keystrokes, or any other information about how you use it. - **Only one network destination.** The only origin the extension contacts is `https://yeet.md`. It POSTs to `/api/share` when you publish, and it loads the permalink page at `/s/` when you choose to open a published link. No third-party servers, no CDNs at runtime, no fonts or analytics endpoints. - **Delete tokens stored locally.** When you publish a snapshot via the extension, yeet.md returns a delete token alongside the URL. The extension stores that token in its own browser-extension storage (`chrome.storage.local` / `browser.storage.local`) under a single key. A small content script that runs only on `https://yeet.md/s/*` bridges the token into that page's localStorage so the existing Delete button on the permalink page becomes visible to whoever published the snapshot. The token never leaves your device unless you actively click Delete (in which case it is sent to `/api/delete` to authorize the deletion). - **Permissions used.** `contextMenus` (right-click menu items, gated to text selection only), `storage` (delete tokens, as described above), `clipboardWrite` (to copy the published URL to your clipboard after publishing), `notifications` (to confirm a successful right-click publish), and `host_permissions` for `https://yeet.md/*` only (no other origins). The extension does not request the `tabs`, `activeTab`, `history`, `cookies`, or any other broad permission. Once you click Publish in the extension, the resulting snapshot is governed by the same terms as snapshots published from the website; see **Published snapshots** above. ## Obsidian plugin The yeet.md Obsidian plugin publishes the note you are editing to yeet.md from inside Obsidian. It uses the same `/api/share` and `/api/delete` endpoints as the website, and its data handling matches the website's with a few plugin-specific details: - **Only your published note leaves your vault.** The plugin sends the content of the note you explicitly choose to publish. It does not read, upload, or index the rest of your vault, and it contacts only `https://yeet.md`. - **Property stripping before publish.** You can configure a list of property (frontmatter) fields to remove from the copy that is sent to the server; fields whose names begin with an underscore are always stripped. Your note on disk is never modified; only the outgoing HTTP payload is filtered. - **Delete tokens in your device's secret storage.** Each snapshot's delete token is stored in Obsidian's built-in SecretStorage, which is backed by your operating system's keychain on desktop. Tokens are kept in a single secret and are **not** written to your vault or synced with it, so a shared or synced vault cannot be used to unpublish your snapshots. Because tokens are device-local, a snapshot can only be self-deleted from the device that published it. - **Snapshot records (non-sensitive).** So the plugin can show and manage what you have published, it keeps a local record of each snapshot (its id, URL, publish date, a content hash, and the source note path) in the plugin's own `data.json`. The delete token is the only sensitive value, and it is kept separately in secret storage as described above. - **Client identifier for rate limiting.** The plugin sends a per-vault random identifier in an `X-Client-Id` header so the server can apply rate limits. It is not an authentication credential and is not tied to your identity. - **No analytics, no telemetry, no tracking.** Snapshots published from the plugin are governed by the same terms as snapshots published from the website; see **Published snapshots** above. ## Data we don't collect - No accounts or personal information - No analytics or tracking scripts - No advertising ## Deleting your data - **Local drafts:** Clear your browser's localStorage, or use the "Remove from list" button in the saved notes panel (which only removes the local copy, not any published snapshots). - **Published snapshots:** If you published a snapshot from the same browser, a Delete button will appear on the permalink page. This uses a token stored at the time of publishing: in this site's localStorage (if you published from the website), in browser-extension storage (if you published from the yeet.md extension, which bridges the token to the page automatically), in your OS keychain (if you published from the Obsidian plugin), or wherever you saved it (if you published through the API). **Important:** If you clear your browser data, lose your keychain, or switch devices, you may lose the ability to self-delete your published snapshots. If you need a snapshot removed and can no longer delete it yourself, file a report at [yeet.md/report](https://yeet.md/report) with the URL and we will remove it for you. ## Site administration David V. Kimball LLC, as the site operator, has access to an admin dashboard that can view and delete all published snapshots. This access is password-protected and limited to the site operator. ## Important disclaimers - Published snapshots are public. Anyone with the link can view them. Do not publish sensitive or confidential information. - yeet.md is provided as-is with no warranty of any kind, express or implied. - We reserve the right to remove any published snapshot at any time without notice. ## Liability and use at your own risk yeet.md is a free tool. By using it, you agree that: - **Use at your own risk.** The service is provided as-is and as-available. We make no guarantees about uptime, data persistence, accuracy, or fitness for any purpose. - **You are responsible for the content you share.** You must not share content that is illegal, harmful, infringing, defamatory, harassing, or otherwise objectionable. You retain ownership of your content but grant us the right to host and serve it as part of operating the service. - **We are not liable for user-generated content.** yeet.md acts as a passive host. We do not pre-screen content. We are not responsible for any content shared by users, nor for any consequences arising from that content. - **We are not liable for misuse by third parties.** We are not responsible for any harm caused by malicious actors, prompt injection, social engineering, or any other misuse of content shared on or through the service. - **No liability for damages.** To the maximum extent permitted by law, David V. Kimball LLC (the operator of yeet.md), its members, employees, contractors, contributors, and any associated parties shall not be liable for any direct, indirect, incidental, special, consequential, or exemplary damages arising from your use of the service or any content accessed through it. - **Indemnification.** You agree to indemnify and hold harmless David V. Kimball LLC and its members, employees, and contractors from any claims, damages, or expenses arising from your use of the service or your violation of these terms. If you do not agree with these terms, do not use yeet.md. ## Copyright and DMCA yeet.md responds to notices of claimed copyright infringement under the Digital Millennium Copyright Act. If you believe a published snapshot infringes your copyright, file a report at [yeet.md/report](https://yeet.md/report), choose "Copyright / DMCA infringement", and include: 1. Your physical or electronic signature. 2. Identification of the copyrighted work you claim is infringed. 3. The URL of the snapshot you want removed. 4. Your name, address, telephone number, and email address. 5. A statement that you have a good-faith belief the use is not authorized by the copyright owner, its agent, or the law. 6. A statement, under penalty of perjury, that the information in your notice is accurate and that you are the copyright owner or authorized to act for the owner. Our designated agent is David V. Kimball LLC, Attn: Copyright Agent, reachable through [yeet.md/report](https://yeet.md/report) or [davidvkimball.com/contact](https://davidvkimball.com/contact). If your snapshot was removed and you believe that was a mistake or misidentification, you can send a counter-notice through the same report form with your signature, the removed URL, a statement under penalty of perjury that you believe it was removed by mistake, your name, address, and telephone number, and your consent to the jurisdiction of the federal court for your address. We remove the ability to publish for repeat infringers where we can identify them. ## Contact For privacy concerns, abuse reports, or DMCA notices, file a report at [yeet.md/report](https://yeet.md/report).