Privacy Policy

Introduction

At Bookmark Maestro, we take your privacy seriously. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Chrome extension and website.

The short version: your bookmarks never leave your device. Everything the extension does to them happens locally in your browser. What we do hold is an account, if you make one, and the ordinary records of running a website — and each of those is described below, along with the companies that handle any of it for us.

Information We Collect

Bookmark Data

Our extension accesses and manages your Chrome bookmarks locally on your device. Your bookmark collection is never transmitted to or stored on our servers.

The Page You Are Looking At

The popup and the side panel read the address and title of the tab in front of you, and nothing else about it, so they can answer one question: is this page already in your bookmarks, and where? That answer is computed against the bookmarks on your device and shown to you. We do not read the contents of the pages you visit, we do not record your browsing history, and neither the address nor anything derived from it is sent anywhere. Close the panel and nothing of it is kept.

Network Requests Made by Features

One feature makes network requests when you run it, and only then:

Link health check — to test whether a bookmark still works, your browser sends a request directly to the bookmarked URL. The sites you check will see this request the same way they would if you visited them. The request goes from your browser to the bookmarked host; nothing is routed through or stored on our servers.

Everything else runs without the network. Site icons — in the extension's lists and embedded in an export — come from Chrome's own icon store on your device. An earlier version fell back to Google's public favicon service for icons Chrome didn't have, which sent those sites' domains to Google; that fallback has been removed, and exporting now contacts nobody. A bookmark whose icon Chrome doesn't have simply exports without one.

Knowing You Already Have the Extension

On our own website and nowhere else, a page on this site may ask the extension directly whether it is there, and the extension answers with the version it is running. It exists so the site can stop offering you an install you already have. What our website learns from this is exactly two things — that this browser has Bookmark Maestro, and which version — and while you are signed in, that fact is attached to your account like any other visit. The extension runs no code on any web page, ours included: it answers a question when asked and does nothing otherwise. It reads nothing from the page, sends nothing to us from inside your browser, and reaches none of your bookmarks, settings or account data.

Account Information

If you create an account we store your email address, your name and profile picture when your sign-in provider supplies them, and the record of how you sign in. Signing in with Google or GitHub stores that provider's account identifier and the tokens it issues us; signing in by email stores a single-use link token that expires. We never receive or store your password for any of these.

The name is yours to change: the Profile page in your account edits it, and clearing the box stores no name at all. Nobody else ever sees it — it appears in your own account menu, here and in the extension, and at the top of the welcome email. The profile picture is not editable and is only ever the one Google or GitHub gave us; there is no uploader.

If you subscribe to Pro, we store a mirror of the subscription — its status, plan, current period and the Stripe customer and subscription identifiers. Card details are never sent to or stored by us: payment happens on Stripe's own checkout page.

If you sign up for the newsletter we store your email address, which form you used, the IP address you consented from (so we can show consent was given), your confirmation status, and the tokens that make the confirmation and unsubscribe links work. Sign-up is double opt-in — the address is not on the list until you click the link in the confirmation email — and every message carries a one-click unsubscribe.

Worth saying plainly, because it is the one thing a subscriber would not guess: the newsletter occasionally carries an introduction to another product we build, not only news about this one. It is the same list, the same unsubscribe link, and no more than a handful of such mails a year. We record which campaigns went to your address so nobody is sent the same one twice; unsubscribing ends all of it.

The address itself is never sold, rented or handed to another company's mailing list — the only companies that touch it are the ones that deliver the mail for us, named below.

Contact Form and Uninstall Survey

A message sent through the contact form is emailed to our support inbox and back to you as a receipt; it is not written to our database. The one-question survey shown after you uninstall the extension is anonymous by design — it asks no email address, and the reason you pick plus anything you type is emailed to the same inbox with no identifier attached.

A Record of the Emails We Have Sent You

So that a mail meant to be sent once is sent once, we keep a small row per message we initiate: your address, which mail it was, when it went, whether it was accepted, and its own unsubscribe token. That covers the newsletter campaigns above and the single review request we ever send an account. The mail service also tells us when a message bounced or was reported as spam, which we keep so we stop mailing an address that does not want or cannot receive us. We do not track whether you opened an email or which links you clicked — our messages carry no tracking pixel.

The Free Tools on This Website

Two pages on this site work on files and links you provide — the bookmarks recovery tool, which compares Chrome's Bookmarks file with its Bookmarks.bak backup, and the URL cleaner. Both run entirely in your browser tab: the file is read with your browser's own file API, compared in the page, and the download is built in the page. Nothing is uploaded, nothing is stored, and no request is made — the recovery tool works with the network unplugged. We never see your bookmark file, and we never see the links you paste.

Server Logs

Our API records one line per request so we can operate and debug the service. Each line holds the time, the method and path, the response status and duration, a request identifier, your IP address and browser user-agent string, the referring page, and — if you were signed in — your user id and email address. These logs are kept for 90 days and then deleted automatically. They are not used to build a profile of you or shared with anyone.

Extension Permissions

Chrome asks you to grant the extension a short list of permissions. Here is every one of them and what it is actually for:

Bookmarks — read and change your bookmarks. This is the product; everything the extension finds, sorts, cleans or repairs is done through this permission, on your device.
Tabs — open the links and folders you ask it to open, manage its own tab, and read the address and title of the tab in front of you for the “is this page saved?” answer described above.
Favicons — draw site icons from the ones Chrome has already stored on your device. This lookup never reaches the network.
Storage — keep your preferences, your cached sign-in, and the local data described under “Data Storage and Security” below, on this device.
Side panel — provide the side-panel surface itself. It grants no access to anything.
Access to all websites — the broadest-sounding one, and it exists for a single feature: the link health check has to be able to request a bookmarked address, and a bookmark can point anywhere, so there is no narrower list to ask for. It is used when you run that check, and for nothing else. The extension does not read, alter or watch the pages you browse, and injects no code into any site at all — ours included.

How We Use Your Information

To provide and maintain our extension's functionality
To process and manage Pro feature subscriptions
To provide customer support
To notify you about changes to our service or policies
To detect, prevent and address technical issues

Our grounds for processing, in GDPR terms, are the contract with you (your account and your subscription, including the emails that go with them — sign-in links, receipts, renewal and payment notices), your consent (the newsletter — withdrawable at any time, without affecting what was done before), and our legitimate interest in keeping the service secure and working (server logs, the aggregate visit counts described below, abuse and rate limiting). Very occasionally we email an existing customer about the product itself — a review request or a product update — on that same legitimate-interest ground, and every one of those carries an unsubscribe link that we honour permanently.

Where Data Lives, and Who Handles It

Our servers, database and logs run in Germany, in the EU — on Hetzner Cloud, in their Falkenstein data centre. That is where your account, your subscription mirror and the server logs above are stored.

A handful of other companies process data on our behalf, under their own safeguards and data-processing terms. Transfers to the US-based ones rely on the European Commission's Standard Contractual Clauses and, where the company is certified, the EU–US Data Privacy Framework:

Cloudflare (US) — every request between your browser and our servers travels through Cloudflare, which provides our DNS and the encrypted tunnel that is our only public entrance. It therefore sees the connection itself: your IP address, the address you asked for, and the response.
Amazon Web Services — Amazon SES (US, us-east-1) — our own mail service hands the last hop of every email to SES, which processes the recipient address and the message body in order to deliver it. That covers sign-in links, receipts, subscription notices, contact-form and uninstall-survey messages, and the newsletter.
Stripe (US/IE) — takes payments and holds the payment details we never see.
Google (US) — provides OAuth sign-in, if you choose to sign in that way. Analytics is no longer on this list: we removed Google Analytics in August 2026 and host our own (see below).
GitHub (US) — provides OAuth sign-in, if you choose to sign in that way.

Two things that might look like third parties and are not: the webfonts this site is set in are served from our own domain, not from Google's, so loading a page sends nothing to Google; and the extension itself opens a connection to nothing except our sign-in endpoint and the hosts you point it at (see “Network Requests Made by Features” above) — and what it tells our own site about itself, it tells only when our site asks.

Data Storage and Security

Your bookmark data is stored and managed locally on your device through Chrome's bookmark system. We apply industry-standard security measures to the account information we hold, whichever plan you are on, and all communication with our servers is encrypted using SSL/TLS protocols.

Deleted bookmarks stay on your device for up to 30 days. While the extension's History is on (it is by default), a bookmark you delete in this browser is kept — title, address and folder — in the extension's own local storage on that device, so it can be listed and put back. It is never uploaded. Beside the trash, and for its sake, the extension keeps one copy of the tree's shape in that same local storage — each bookmark's id, folder, position, title and address — so that a deletion made while Chrome was closed can still be found the next time it starts. That copy holds nothing your bookmarks do not, it is never uploaded either, and turning History off deletes it. It is yours to control: Forget drops one deletion, Forget all empties the store, the switch on the History page turns keeping off, and everything in it expires after 30 days — sooner if the store fills, since it is capped at 20 MB of deleted bookmarks and 8 MB of recorded edits, oldest dropped first. Removing the extension or the Chrome profile removes it too.

Everything else the extension remembers is local to that browser profile too, and none of it is ever uploaded: the results of link tests it has already run (so a re-check is not a re-scan), a weekly snapshot of your library's health score so the trend chart has a past, your view preferences and theme, and — if you sign in — a cached copy of your session: your email address, name, picture and whether the subscription is active. That cache is what lets the extension open instantly and keep working while you are offline; it is refreshed against our server, expires on its own if it cannot be, and signing out erases it. Removing the extension removes all of it.

We keep your account for as long as it exists; delete it and the data goes with it, as described next. Server logs age out after 90 days regardless. A newsletter address stays on the list until you unsubscribe.

Your Data Rights

You have the right to:

Access your account information
Update your account details
Delete your account
Opt-out of marketing communications
Request information about your data usage

Two of these are buttons rather than requests: signed in, the GDPR page in your account will export everything we hold about you as one JSON file, or delete the account outright. Both run immediately, with no queue and no recovery window. The export covers your account details, how you sign in, your subscription records, your newsletter entry, and which product emails you have been sent; deleting removes all of it, the newsletter row included, and cancels any subscription. Stripe retains what payment regulations require it to retain.

If you are in the EU/EEA or the UK, these are your GDPR rights to access, portability and erasure; the rest — rectification, restriction, objection, and withdrawing consent — work by writing to the address below, as does the right to complain to your local supervisory authority. If you have no account, the unsubscribe link in any newsletter handles the newsletter, and one line to us handles anything else.

Cookies and Analytics

On our website we use Umami, an analytics tool we host ourselves, to understand in aggregate how visitors find and use the site so we can improve it. It sets no cookies at all, stores nothing in your browser, and does not fingerprint you — so there is no banner asking you to agree to it, and nothing to opt out of. It records which pages are read, roughly where in the world the visit came from, what kind of device and browser language it was, and which calls-to-action are pressed. Never who you are.

To count two page views as one visitor without identifying anyone, it derives a one-way hash of your IP address and browser string that is regenerated every day. Nothing can be read back out of it, it cannot be matched to your account, and because it changes daily it cannot follow you from one day to the next. The raw IP address is not stored with the visit.

Because we run it on our own servers, your visit is not handed to an analytics company at all — the request does not even leave our own domain. We used Google Analytics until August 2026 and removed it, along with the cookie banner that existed to gate it. We use no advertising cookies, and our browser extension itself sets no analytics or tracking cookies.

Signing in sets a session cookie. It is what keeps you signed in — on the website and, by the same cookie, in the extension — and it is strictly necessary. It is now the only cookie this site sets, which is why there is no longer a cookie banner to accept.

Children's Privacy

Bookmark Maestro is not directed at children under 16, and we do not knowingly collect their personal data. If you believe a child has given us information, write to us and we will delete it.

Changes to This Privacy Policy

We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date.

Contact Us

If you have any questions about this Privacy Policy, please contact us at:

Email: [email protected]