Privacy
Markup has no backend. There is nowhere for a screenshot to be sent, because there is no server to send it to.
What happens to your screenshot
When you paste or drop an image, Markup decodes it and draws it onto a canvas inside the page. Your annotations are drawn onto the same canvas. Pressing copy flattens the canvas to a PNG and hands it to your operating system's clipboard.
All of that happens on your machine. The image is held in memory for as long as the page is open and is gone when you close or reload it. Nothing is written to disk by the page, and nothing is transmitted.
What the site stores
One entry in local storage:
| Key | Value | Why |
|---|---|---|
markup-theme | light or dark | Remembers the theme you picked, so the page does not flip back on your next visit. |
It is written only if you use the theme toggle, it stays on your device, and clearing site data removes it. Delete it and the page goes back to following your system setting.
What the site does not do
- No accounts, no sign-in, no email address.
- No cookies.
- No analytics, telemetry, error reporting or session recording.
- No third-party scripts, fonts or embeds. The page loads only its own files, so it makes no requests to any other host.
- No network requests at all once the page has loaded.
Clipboard permission
On the web, copying uses the browser's clipboard API, which may ask your permission the first time. That permission lets the page write the finished image out. If the browser refuses the write, the page falls back to downloading the PNG instead, which is also entirely local.
The macOS app writes to the system pasteboard directly and never asks. Either way the image goes straight from the canvas to your clipboard and nowhere else.
Hosting
The site is static files served over HTTPS. Whoever hosts it can see ordinary web server request logs, meaning the fact that a page was requested. Those logs contain no screenshots, because screenshots are never part of a request.
The macOS app ships those same files inside its bundle and loads them from disk, so it makes no requests at all — there is not even a server log.
Changes
If this ever stops being true, this page changes first. Last updated 23 August 2026.