Privacy Policy

Last Update: November 2, 2026

Welcome to Bookmash! This Privacy Policy explains how we collect, use, and protect your personal information. By using our website, you agree to the terms of this Privacy Policy.

Information We Collect

1. Account Information

When you create an account with Bookmash, we collect:

Email Address: Required for authentication via magic link login. This is the only personal identifier we store in our database.
Email Verification Status: Timestamp of when your email was verified.

2. Bookmark Data

By default, we do NOT store your bookmarks on our servers. The only exception is a folder you explicitly choose to publish (see “Published Folders” below). All other bookmark data is stored locally in your browser using:

Browser localStorage: Cached copy of your bookmarks for fast loading
Native Browser Bookmarks API: Our browser extension only accesses your bookmarks through the Browser API to display them in the dashboard. No bookmark data is transmitted to our servers unless you publish a folder.

Bookmark Connection Timestamp: We record a single timestamp on your account the first time your dashboard successfully connects to your browser bookmarks. This is an account activation record, not bookmark activity tracking, and it is the only product-related signal we keep about bookmark usage. Apart from the contents of folders you choose to publish, we never record bookmark URLs, titles, folder names, search terms, bookmark counts, or any other bookmark content or activity.

Published Folders (optional)

If you choose to publish a folder, Bookmash stores a snapshot of it on our servers so the public page can be shown. Nothing is uploaded unless you click Publish or Update.

What is stored: the folder's title, the titles and URLs of its bookmarks, its nested subfolders (with their bookmarks), an item count, and the folder's browser ID and original title, which we use to recognize the folder when you update it. Only http(s) links are included. Browser-internal pages and bookmarklets are skipped. Favicons and other bookmark metadata are not sent. The snapshot is linked to your account so you can manage it.
Who can see it: anyone with the link, without signing in or having the extension. Published pages are set not to be indexed by search engines and are not listed in our sitemap, but they are not password-protected, so anyone you or others share the link with can open it.
No automatic sync: a published snapshot is a point-in-time copy. It changes only when you choose to update it, not when your browser bookmarks change. Publishing never modifies your browser bookmarks.
Unpublish: takes the page offline, but we keep the stored snapshot so you can republish the same link later.
Delete: permanently erases the stored snapshot. We keep only an empty record so the link can never be reused. This cannot be undone.

3. Billing Information

For payment processing, we collect:

Stripe Customer ID: A unique identifier assigned by Stripe when you make a purchase
Billing Email: The email address used during checkout
Payment Status: Whether you have active paid access to the service

Payment Security: We do NOT store credit card numbers, CVV codes, or other sensitive payment details. All payment processing is handled securely by Stripe, our PCI DSS Level 1 certified payment processor.

Usage Analytics

Our tracking tools are used on the home page only (https://bookma.sh), not in the user’s dashboard. We use privacy-focused analytics to understand how our service is used and improve user experience:

Google Analytics (GA4) – Privacy Mode

Advertising features disabled
No ad cookies or user profiling for advertising
Collects basic analytics: page views, session duration, device type
Data is anonymized and aggregated

Umami Analytics – Privacy-First

Open-source, GDPR-compliant analytics
No cookies used
No personal data collected
All visitor data is anonymized

Microsoft Clarity

Records session replays and heatmaps when active
Helps us understand user experience and identify issues
Does not record sensitive input fields or payment information

What We Track: Pages visited, time on site, browser type, device type, approximate location (country/city level), and referral source. We do NOT track or share personally identifiable information with these services.

Cookies We Use

Essential Cookies (No Consent Required)

Authentication cookies (to keep you signed in)
Security cookies (to protect your account)

Analytics Cookies

Used on homepage only (https://bookma.sh):

Google Analytics (GA4) – privacy mode, no advertising
Umami Analytics – cookieless, privacy-focused
Microsoft Clarity – session recordings (when enabled)

Third-party analytics (Google Analytics, Umami, Microsoft Clarity) are NOT used in your private dashboard, and your bookmark activity and search behavior are never tracked or monitored. Bookmark content is only stored if you publish a folder. Separately, we keep one first-party, content-free account timestamp described above under “Bookmark Data” — it doesn’t involve a third-party analytics service, and it doesn’t record what you actually did, only that a bookmark connection succeeded.

How We Use Your Information

Authenticate your account via magic link emails
Process payments and manage subscriptions via Stripe
Verify paid access
Show the public pages of folders you choose to publish
Send authentication emails
Provide customer support
Improve our service through aggregated analytics

We do NOT use your data for advertising, marketing, or selling to third parties.

Data Security

We protect your data using HTTPS encryption and passwordless authentication. Your bookmarks are stored on your device and are not uploaded to our servers, except for folders you explicitly choose to publish.

We implement multiple layers of security:

Encryption

Data in Transit: Encrypted via HTTPS (TLS/SSL)
Secure Sessions: Encrypted tokens (NextAuth.js)
Webhook Verification: Cryptographic signatures

Access Control

Authentication required
User isolation
Paid access gates

Authentication Security

Passwordless login
No password storage
Time-limited magic links

Database Security

Our minimal database (account details, payment status, and any folders you publish) is hosted on MongoDB Atlas:

Encrypted data in transit
Network isolation & firewall
Security updates & monitoring
Access logs & audit trails

Third-Party Services

We share minimal information with:

Resend: Email delivery (email only)
Stripe: Billing & payments
Google Analytics: Anonymized usage data
Umami Analytics: Anonymized usage data
Microsoft Clarity: Anonymized usage data
MongoDB Atlas: Database hosting (no private bookmarks; includes folders you publish)

Data Retention

We retain minimal account data while your account is active. You may request deletion at any time.

Important: Your bookmarks are stored in your browser; only folders you publish are also stored by us. Deleting your Bookmash account does NOT delete your browser bookmarks.

Your Rights

Access your data
Correct data
Request deletion
Withdraw consent
Export data
Object to automated processing

Data Deletion

How to Request Deletion

Email hello@bookma.sh with the subject “Delete My Account”. We will process your request within 14 days.

What We Delete

When we process a deletion request, we manually delete your account and the personal data associated with it:

Your profile and sign-in information (email address, display name, and sessions)
Your access, trial, and activation records
Any attribution data and optional cancellation feedback
Any folders you published, including their stored snapshots

What We Cannot Delete

Stripe retains transaction records for 7–10 years (legal requirement).

For each deleted published folder, we may keep a minimal record that contains no personal data, solely so its public link identifier can never be reused. The folder's content and any information identifying it or you are removed first.

Important Notes

Your bookmarks are stored locally in your browser, apart from any folders you published. You can delete those yourself at any time from “My Published Collections”.
Deletion is permanent.

Browser Extension Permissions

Access bookmarks: Display them in the dashboard
Modify bookmarks: CRUD operations
Storage: Cache in localStorage

Privacy Note: The extension accesses bookmarks locally only and does not transmit them. A folder is sent to our servers only when you click Publish or Update in the dashboard.

Children’s Privacy

We do not knowingly collect personal information from children. Contact us if you believe otherwise.

Changes to This Policy

We may update this Privacy Policy. The “Last Updated” date reflects the latest version.

Contact Us

Email: hello@bookma.sh
Website: https://bookma.sh

This Privacy Policy is subject to the European General Data Protection Regulation (GDPR – EU Regulation 2016/679).