Reference

Privacy, storage, and recovery

Markover keeps ordinary review work on your Mac. This page explains the account boundary, stored data, deliberate network actions, backups, reinstall, deletion, and reset without requiring implementation knowledge.

Local means your macOS account

Markover stores reviews and runs its loopback API inside the current macOS account. Each account—including accounts active through Fast User Switching—runs an independent Markover instance with separate data, endpoint records, and credentials.

The application-data directory is restricted to its owner on supported macOS systems. A process running as another ordinary account can connect to loopback but cannot read Markover's protected capability, so the API denies it.

The trust boundary is the OS account. Other processes running as you, system administrators, and root can ordinarily read your files or credentials and remain inside this boundary. Markover does not claim to isolate data from them.

How the local API is protected

Markover's command-line tool and desktop app communicate through a loopback service available only on your Mac. Each running service uses a fresh secret stored inside the protected data area for your account. Review operations require that secret.

This prevents another ordinary macOS account from using your service credential. It does not create isolation from another process running as you, an administrator, or root. Rejected-request logging is off by default and, when enabled, omits credentials, request contents, queries, and review content.

Contributors and interested readers can inspect the optional technical security and protocol reference. You do not need those mechanics to use Markover.

What Markover stores

A review can contain the complete Markdown source, parsed document structure, annotations, source-edit proposals, attachment files and metadata, review state, and timestamps. Proposed source edits stay in the review; Markover does not apply them to the original Markdown source.

When available, provenance can include source and repository paths, a sanitized Git remote, branch, commit, pull-request number, and agent-thread details such as IDs, working directory, parent or fork information, and the selected local session-log path.

Local does not mean safe to publish. Review JSON, attachments, and otherwise legitimate command output can contain private content and identifying paths or IDs. Inspect or sanitize them before sharing.

Where data lives

Persistent reviews, attachments, settings, and temporary local-service records live under:

~/Library/Application Support/Markover/

Managed reviews use one directory per review under reviews/<review-id>/. The downloaded application cache is separate:

~/Library/Caches/Markover/

Removing the cache forces a later launcher command to download Markover again. It does not remove persistent reviews or settings. Removing Application Support is destructive user-data deletion, not a reinstall step.

Local provenance discovery

Markover may run read-only Git commands beside the reviewed source. The portable review retains the sanitized remote URL, branch, and commit reported at opening time; URL credentials, query strings, fragments, and local repository roots stay out of the handoff. App-private workspace state may retain a local project-grouping key.

If an agent supplies a unique handoff key but no explicit thread ID, Markover can search a bounded set of recent local Codex session records for an exact match. It retains the matched requesting-session ID with the thread-host metadata the agent supplied, not a copy or path of the scanned logs.

This search is enabled by default. Turn off Discover agent thread from local session logs in Markover's Privacy settings to skip it on subsequent open commands. Explicit thread IDs and Git provenance remain available.

When an agent retrieves a review

An authenticated get returns the review source, annotations, attachments metadata, provenance, and agent guidance to the requesting local agent. Markover itself does not upload that handoff.

After another agent or tool receives the data, its storage, logging, sharing, and network behavior are outside Markover's control. Apply that recipient's privacy policy and trust model as well as Markover's.

Durability and recovery

While Markover is responsive and local storage is healthy, managed review changes are durably saved within a two-second window by default. After an app-process crash or restart, Markover restores reviews still being edited and reviews already inflight with an agent. Attachment bytes are saved before a review can durably refer to them.

A persistent autosave warning means a save failed or took too long, so the two-second bound is suspended while Markover retries or waits for storage to recover. If a normal quit cannot finish saving within five seconds, Markover lets you retry the quit, cancel it, or quit anyway. Choosing Quit Anyway can discard changes that have not become durable.

The crash window has limits. It does not cover power loss, operating-system or hardware failure, or unhealthy or unusually slow storage. Keep backups of important review data even when no warning is visible.

Advanced: change the autosave window

The setting is intentionally not in Markover's Settings window. Quit Markover, open ~/Library/Application Support/Markover/settings.json, set autosaveMaximumDelayMs to a whole number from 100 through 60000 milliseconds, then restart Markover. Changing it changes the stated maximum-loss window as well as the save timing.

When the internet may be used

Ordinary review handling has no telemetry, analytics, cloud synchronization, or automatic upload of review content.

Installing or updating through the launcher can download packages and release files from npm or GitHub.
Inline Markdown image syntax is inert by default. Only an embedded data: image can open through its explicit preview control. Relative paths, local file paths, and HTTP(S) URLs remain unavailable; choosing their controls makes no network request.

Launcher installation and updates are user-triggered connections, so Markover does not claim that it never connects to the internet.

Retention and deletion

Managed reviews and attachments remain until you remove them. To remove the active managed review, choose Review → Move Review to Trash…; the same action is available from review tabs and the Documents list. Markover moves its complete managed-review directory, including attachments, to the macOS Trash without changing or deleting the original Markdown document.

Removing an attachment from a managed review also moves its owned image file to the Trash after the updated review is safely saved. Review → Clean Up Unused Attachments… reports the number and size of generated attachment files no longer referenced by any valid managed review, then asks before moving them to the Trash.

Back up a managed review first when it matters. Managed-review data remains recoverable from the Trash until you empty it. Open Markdown… creates a managed review, so locally opened documents and their screenshot attachments use the same storage, recovery, and cleanup lifecycle.

Redownload or reinstall without deleting reviews

Quit Markover.
In Finder, choose Go → Go to Folder… and open ~/Library/Caches/Markover/.
Move that Markover cache directory to the Trash.
Run the normal launcher command again. It downloads and verifies the matching app.

Your Application Support data, including reviews, attachments, and settings, remains in place.

Delete one review

Select the managed review in Markover.
Choose Review → Move Review to Trash…, or use the same command from its tab or Documents-list context menu.
Read the confirmation carefully. A review currently with an agent receives a stronger warning.
Confirm to move Markover's complete stored managed review to the macOS Trash.

Your original Markdown document is separate. Moving a review to the Trash does not change or delete the source file. The review and its attachments stop being recoverable after you empty the Trash.

Completely reset or uninstall Markover

Quit Markover.
Back up the complete Application Support directory if any review, attachment, or setting may be needed later.
Move ~/Library/Application Support/Markover/ to the Trash.
Move ~/Library/Caches/Markover/ to the Trash.
If you manually downloaded or copied Markover.app, locate every copy you installed—commonly in Applications or Downloads—and move it to the Trash.

This removes all local reviews, attachments, settings, service state, launcher-cached app versions, and manually installed app copies for your account. Shared npm cache data is outside Markover's owned roots and is intentionally not part of this reset.

Backups and early-preview compatibility

Unreleased prototype review shapes may change without compatibility support. Once a review schema ships in a release, a later breaking release converts supported older schemas automatically on load. Before conversion, Markover preserves a byte-for-byte backup of the original review directory and replaces the active copy only after the converted review validates.

An app that encounters an unknown future version leaves its JSON and attachments untouched and points to the official compatibility catalog for a release that can open it.

Before changing versions, rolling back, or manually deleting data, quit Markover and copy the complete ~/Library/Application Support/Markover/ directory to a safe location. Keep Markover's migration backup if you may need to downgrade.

Get help without oversharing

Use GitHub Discussions for usage questions and general support. Use the bug report form for a reproducible defect and private vulnerability reporting for a suspected security issue.

Share only the smallest sanitized diagnostic needed. Remove credentials, private review content, repository details, usernames, local paths, and identifying IDs.