Privacy policy.

// overview

Mudlark stores everything locally on your Mac. Your notes never leave your device unless you explicitly export them. There’s no usage tracking and no advertising. The closest thing to analytics is crash reporting, which is anonymous, off by default, and described under diagnostics below. The network requests Mudlark makes on its own are app update checks and periodic license rechecks (both direct download only), link preview fetches for URLs in your notes, automatic downloads of media you reference by URL, and crash report uploads once you’ve opted in. Update checks, link previews, media downloads, and crash reports each have their own toggle, and the Disable background network activity switch in Settings › General › Network & Privacy stops all of them at once, license rechecks included. User-initiated network actions aren’t covered by that switch: exports to third-party services, OAuth, license activation, and manual update checks.

// information we collect

If you purchase a license through LemonSqueezy, your license key and a hardware model identifier (e.g. Mac16,1, not your machine’s name) are sent to LemonSqueezy’s API to activate the license. LemonSqueezy returns an instance ID that we store on your Mac. Later rechecks send only the license key and that instance ID.

Mudlark rechecks the license at app launch when the last successful check is more than 7 days old. There’s no background timer. If you keep the app running for weeks, it won’t phone home. If a recheck can’t reach LemonSqueezy, the cached license stays in force, so offline or flaky networks don’t lock you out. A license is only cleared locally if the server explicitly returns a “not valid” response.

Turning on Disable background network activity in Settings › General › Network & Privacy suppresses these background rechecks too. The cached license remains in force until you turn the switch back off. Manual activation and deactivation are unaffected.

This only applies to the direct download. The App Store version uses Apple’s own purchase system and does not contact LemonSqueezy.

// diagnostics

Mudlark can send anonymous crash and hang reports to Sentry so we can fix bugs we wouldn’t otherwise see. When enabled, reports include stack traces, app metadata, and breadcrumbs that record which subsystem you were in (note open, note switch, vault, sync engine, database, license, automation, export, media cache) when something went wrong, plus non-fatal error events from a handful of known failure points.

Reports never contain note content. Before anything leaves your device, a scrubber removes note text, titles, selections, and clipboard contents from any payload, redacts file paths inside your Mudlark container, redacts the query strings of mudlark:// URLs, and truncates string values to 256 bytes. We don’t collect performance traces, advertising identifiers, or anything tied to your hardware or account.

Each install is tagged with an anonymous install ID so recurring crashes from one machine can be grouped together. The ID isn’t linked to your license, your hardware, or any account, and it rotates every time you turn crash reporting off and back on.

Crash reporting is off by default. To enable it, open Settings › General › Network & Privacy and switch on Send anonymous crash reports. Toggling takes effect immediately, with no relaunch required. The toggle works the same way on both the App Store and direct download builds. Sentry processes the reports on our behalf. Privacy policy

// information we don’t collect

No usage tracking. No advertising or marketing identifiers. We don’t measure which features you use, how often you open the app, or what you write. The only diagnostic data is the opt-in crash reporting described above. Your note content is never sent anywhere unless you export it yourself.

// data stored on your device

• Notes: kept as plain .mudlark files in your vault. By default the vault lives inside Mudlark’s sandbox container. Pointing Settings › Data at an external folder relocates it somewhere you can sync however you like. A SQLite cache alongside the vault speeds up search and remembers UI state. It’s derived from the files and rebuilt automatically if it goes missing. We don’t run our own cloud.
• Preferences: stored in macOS UserDefaults.
• Credentials: Notion API tokens, Craft API keys and endpoints, Todoist OAuth tokens, Ulysses access tokens, your license key, and instance ID are kept in the macOS Keychain.

// network connections

Every connection the app makes, and what each one sends:

• LemonSqueezy: at activation, license key + hardware model identifier are sent. At subsequent rechecks, license key + instance ID. Direct download only. Privacy policy
• Notion: when you export to Notion, your note content (including any embedded images) is sent to the Notion API using your own API token. Privacy policy
• Craft: when you export to Craft via its API, your note content and images are sent to an endpoint you configure, authenticated with your own API key. Privacy policy
• Todoist: when you export tasks to Todoist, Mudlark connects via OAuth and sends task content to the Todoist API. Privacy policy
• Sentry: when crash reporting is enabled, anonymous crash reports, hang reports, and breadcrumbs are sent for diagnostics when the app crashes or hits a known error. No note content is included. Off by default. Opt in via Settings. Privacy policy
• Sparkle updates: the direct download version checks mudlark.io/appcast.xml for new versions. No personal data is included in this request. The App Store version uses Apple’s update mechanism instead.
• Sites you link or embed: with link previews or remote media enabled, Mudlark contacts the URLs in your notes to fetch preview metadata and media files. Details in the next section.

// link previews & remote media

When a URL sits on its own line in a note, Mudlark fetches that page’s metadata once to render a preview card (title, site icon, thumbnail). The request goes directly from your Mac to the destination site, so that site can see your IP address. Results are cached locally, and addresses that point at private or local networks are refused. Turn this off with Show link previews in Settings › General › Network & Privacy.

Media you reference by URL (an @ line or inline notation) is downloaded from that URL and cached locally so it can render in your notes. Turn this off with Load remote images & videos in the same place.

// local exports

Mudlark can export notes to apps on your Mac, including Bear, Ulysses, Obsidian, iA Writer, Things, Apple Notes, Apple Reminders, and Apple Shortcuts, via URL schemes, EventKit, or the system clipboard. This transfers your note content directly to the target app on your device. No data leaves your Mac during these exports.

// clipboard

Mudlark reads text, images, and file references from the clipboard for Quick Capture, and writes to it when exporting to Apple Notes or Apple Shortcuts. Clipboard content stays on your device.

// automation from other apps

Other apps and scripts can drive Mudlark through mudlark:// URLs and Shortcuts (App Intents) actions. Both directions are opt-in: a fresh install has Allow read actions from other apps (open, search, list, get) and Allow write actions from other apps (create, update, delete, move, export) both off, and a top-level Disable all automation kill-switch can cut every action at once. The toggles apply uniformly to the URL scheme and App Intents. Enable the ones you want in Settings › General › Automation.

// data retention & deletion

Deleting a note moves its .mudlark file to the macOS Trash. From there, recovery and permanent removal follow your Mac’s Trash settings. Mudlark doesn’t run its own retention timer. Where your notes live depends on whether you’ve moved the vault: by default they sit inside Mudlark’s sandbox container (~/Library/Containers/com.higl.Mudlark/), and if you’ve pointed the vault at an external folder, they live there.

Uninstalling Mudlark doesn’t touch a vault you’ve stored in an external folder. Delete it yourself if you want it gone. Even the default sandbox container often survives a drag-to-Trash uninstall on macOS. Remove ~/Library/Containers/com.higl.Mudlark/ manually (or use a tool like AppCleaner) to clear preferences and the internal vault. Keychain entries (API tokens, license key) persist after uninstallation and can be removed via Keychain Access.

// changes to this policy

If we update this policy, we’ll revise the effective date at the top of this page.

// contact

Questions? Email [email protected].