# Privacy: what leaves your machine

Wymark is a local application: your documents never leave your Mac, and the short list of things that do is below, in full.

## Your documents stay where they are

Wymark edits files in place on your disk. There is no account, no sync, no cloud copy, and no telemetry about what you write or how you write it. The version history, the review baselines and your settings live in a local database on your machine. The editor itself is served to the app window by a small web server that Wymark runs on your own machine, bound to `localhost` only; nothing outside your Mac can reach it, and that is the `http://localhost:…` entry you may see in Activity Monitor.

## What is sent, and when

Three things, each on its own terms:

1. **An update check.** Shortly after launch and regularly while the app is open, Wymark fetches a small file from wymark.app that says what the newest version is. The request carries the product name and the version you are running, and nothing else. Turn it off in Settings > Version & updates. Nothing is downloaded until you choose to install an update.
2. **A diagnostic report, only when you send one.** After a crash Wymark asks whether you want to send a report, and Help > Something Went Wrong… lets you send one at any time. A report is your written description, the app version, the macOS version and architecture, your locale, an e-mail address if you choose to give one, and -- if you leave **Include recent logs** ticked -- a zip of Wymark's own log files. **Logs can include text from your open documents.** The dialog shows exactly what will be sent before you send it. Reports are stored privately, kept for about 30 days and then deleted, and can be deleted sooner on request to [bugs@wymark.app](mailto:bugs@wymark.app). A summary without the logs reaches the maintainer's private notification channel; the logs never do.
3. **What your document asks for.** A picture referenced by a web URL is fetched from that site when it is displayed, and a link you `⌘`-click opens in your browser. Both are your document's requests, not Wymark's.

That is the whole list. Spell checking uses the checker built into macOS. Diagrams and drawings render with libraries bundled inside the app, not from a content network. Git is read from your local repository and never written.

## What is written beside your files

- **An images folder.** A picture you paste is saved next to the document -- `report.md` collects into `report-assets/` by default -- and the document references it by relative path. Settings > Images changes the pattern. Nothing is stored inside the database except a copy kept for version history.
- **An AI sidecar, for a document you enable it on.** So that a tool editing your file can see what you are reviewing, the sparkles button in a document's toolbar makes Wymark write a small read-only file beside that document, named after it with `.wymark.json` on the end. It is off for every document until you turn it on, except Wymark's own welcome document, which starts with it on. The file exists only while the document is open, has been on screen, and has the switch on; Wymark deletes it when you turn the switch off, the document closes, or the app quits. Deleting it yourself is always safe, and it does not belong in version control.
- **One line in that document, for as long as the sidecar exists.** An HTML comment at the top of the file, after any front matter, that names the sidecar so a tool reading the document finds it. It is the only text Wymark adds to a document of its own accord, and it is removed together with the sidecar. After a crash the line can outlive the sidecar until you next open that document; it says of itself that the file is then all there is to read. See [AI sidecar](/docs/guide/ai-sidecar).

## Your name travels in the file

Two places carry your name, and both leave with the document when you share it. A comment you write is stamped with the reviewer name Wymark took from your macOS account (the **Your name** field in Settings > Review & comments changes it), as plain text in the marker. A Word export with track changes stamps every revision with that same name, because a diff has no per-change author to offer Word. Neither is authenticated -- it is a label, like a name in Word -- and either can be edited in the file.

## What Wymark does not do

- It does not read files in other apps' private folders in the background. If a document lives inside another application's container, macOS asks before Wymark may read it, and after a refusal Wymark explains the blocked state rather than trying again silently.
- It does not fetch anything to render your document except the pictures your document names.
- It does not generate text or call a language model. Wymark shows you what a tool wrote; which tool, and whether it phones home, is that tool's business and its privacy policy's.

## The website

wymark.app counts visits: page views with the referring page, your browser's user agent and language, the country, and a download event tagged with the version the button handed out. Your address is used to derive the country and a daily anonymous visitor count, and is not what gets recorded. No cookies, no cross-site tracking, and nothing from inside the app, with one thing to name: the links in Wymark's own welcome document go through `wymark.app/i/…`, so following one is counted as a visit that came from the app, with the same facts as a page view and nothing about your documents. The counter is served from wymark.app itself rather than from the analytics provider's domain, so the numbers describe visitors rather than visitors without an ad blocker. Searching the docs happens in your browser, against an index that is part of the site: what you type in the search box is not sent anywhere.

:::persona git
The sidecar is the one file Wymark creates that you might otherwise commit by accident, and it exists only for documents you have enabled it on. Add `*.wymark.json` to your global excludes. The line it adds to the document is in the file while the document is open with the switch on, so a commit made then carries it: turn the switch off, or close the document, before committing if you do not want it in the history.
:::

<details>
<summary>Why the update check goes through wymark.app</summary>

The releases themselves live on GitHub. The app polls an address under wymark.app that forwards there, so that the store can move -- or a future major version can be withheld from a licence that does not cover it -- without every installed copy polling a dead address. If wymark.app is unreachable, the app tries GitHub directly as a second endpoint.

</details>

<details>
<summary>Why crash reports are private and issues are public</summary>

The two are separate tracks on purpose. A report may carry logs, and logs may carry your text, so reports go to private storage with a retention window and never to a public tracker. A bug you can describe in prose goes to GitHub, where it is searchable and others can find it. If you want to attach a crash to a public issue, send the private report first and quote its id in the issue.

</details>