Back

Privacy Policy

Last Update: November 12, 2025

Welcome to Bookmash! This Privacy Policy explains how we collect, use, and protect your personal information. By using our website, you agree to the terms of this Privacy Policy.

Information We Collect

1. Account Information

When you create an account with Bookmash, we collect:

  • Email Address: Required for authentication via magic link login. This is the only personal identifier we store in our database.
  • Email Verification Status: Timestamp of when your email was verified.

2. Bookmark Data

We do NOT store your bookmarks on our servers. All bookmark data is stored locally in your browser using:

  • Browser localStorage: Cached copy of your bookmarks for fast loading
  • Native Browser Bookmarks API: Our browser extension only accesses your bookmarks through the Browser API to display them in the dashboard. No bookmark data is transmitted to our servers.

3. Billing Information

For payment processing, we collect:

  • Stripe Customer ID: A unique identifier assigned by Stripe when you make a purchase
  • Billing Email: The email address used during checkout
  • Payment Status: Whether you have active paid access to the service

Payment Security: We do NOT store credit card numbers, CVV codes, or other sensitive payment details. All payment processing is handled securely by Stripe, our PCI DSS Level 1 certified payment processor.

Usage Analytics

Our tracking tools are used on the home page only (https://bookma.sh), not in the user’s dashboard. We use privacy-focused analytics to understand how our service is used and improve user experience:

Google Analytics (GA4) – Privacy Mode

  • Advertising features disabled
  • No ad cookies or user profiling for advertising
  • Collects basic analytics: page views, session duration, device type
  • Data is anonymized and aggregated

Umami Analytics – Privacy-First

  • Open-source, GDPR-compliant analytics
  • No cookies used
  • No personal data collected
  • All visitor data is anonymized

Microsoft Clarity

  • Records session replays and heatmaps when active
  • Helps us understand user experience and identify issues
  • Does not record sensitive input fields or payment information

What We Track: Pages visited, time on site, browser type, device type, approximate location (country/city level), and referral source. We do NOT track or share personally identifiable information with these services.

Cookies We Use

Essential Cookies (No Consent Required)

  • Authentication cookies (to keep you signed in)
  • Security cookies (to protect your account)

Analytics Cookies

Used on homepage only (https://bookma.sh):

  • Google Analytics (GA4) – privacy mode, no advertising
  • Umami Analytics – cookieless, privacy-focused
  • Microsoft Clarity – session recordings (when enabled)

Analytics are NOT used in your private dashboard. Your bookmark activity is never tracked or monitored.

How We Use Your Information

  • Authenticate your account via magic link emails
  • Process payments and manage subscriptions via Stripe
  • Verify paid access
  • Send authentication emails
  • Provide customer support
  • Improve our service through aggregated analytics

We do NOT use your data for advertising, marketing, or selling to third parties.

Data Security

We protect your data using HTTPS encryption and passwordless authentication. Your bookmarks are stored exclusively on your device and are never uploaded to or accessible by our servers.

We implement multiple layers of security:

Encryption

  • Data in Transit: Encrypted via HTTPS (TLS/SSL)
  • Secure Sessions: Encrypted tokens (NextAuth.js)
  • Webhook Verification: Cryptographic signatures

Access Control

  • Authentication required
  • User isolation
  • Paid access gates

Authentication Security

  • Passwordless login
  • No password storage
  • Time-limited magic links

Database Security

Our minimal database (emails + payment status) is hosted on MongoDB Atlas:

  • Encrypted data in transit
  • Network isolation & firewall
  • Security updates & monitoring
  • Access logs & audit trails

Third-Party Services

We share minimal information with:

  • Resend: Email delivery (email only)
  • Stripe: Billing & payments
  • Google Analytics: Anonymized usage data
  • Umami Analytics: Anonymized usage data
  • Microsoft Clarity: Anonymized usage data
  • MongoDB Atlas: Database hosting (no bookmarks)

Data Retention

We retain minimal account data while your account is active. You may request deletion at any time.

Important: Bookmarks are stored only in your browser. Deleting your Bookmash account does NOT delete your browser bookmarks.

Your Rights

  • Access your data
  • Correct data
  • Request deletion
  • Withdraw consent
  • Export data
  • Object to automated processing

Contact us at hello@bookma.sh.

Data Deletion

How to Request Deletion

Email hello@bookma.sh with the subject “Delete My Account”. We will process your request within 14 days.

What We Delete

  • Your email address
  • Display name
  • Payment access status
  • All sessions

What We Cannot Delete

Stripe retains transaction records for 7–10 years (legal requirement).

Important Notes

  • Your bookmarks were always stored locally.
  • Deletion is permanent.

Browser Extension Permissions

  • Access bookmarks: Display them in the dashboard
  • Modify bookmarks: CRUD operations
  • Storage: Cache in localStorage

Privacy Note: The extension accesses bookmarks locally only. No data is ever transmitted.

Children’s Privacy

We do not knowingly collect personal information from children. Contact us if you believe otherwise.

Changes to This Policy

We may update this Privacy Policy. The “Last Updated” date reflects the latest version.

Contact Us

Email: hello@bookma.sh
Website: https://bookma.sh

This Privacy Policy is subject to the European General Data Protection Regulation (GDPR – EU Regulation 2016/679).

Bookmash - Bookmarks Manager