Terms of Service & Privacy Policy

What we store

bookmark++ only holds what it needs to answer questions about the things you save:

• Your account email, and the name (and, for Google and X, the profile image) returned when you sign in with Google, Apple or X. If you use Apple's Hide My Email, we only ever see Apple's relay address.
• The URLs you save, and what we keep from them: the link, title, caption, author @handle, article text, the transcript of what is said in a video, the text on each slide, and one small cover image (about 480 pixels) to show the item back to you. We never keep video or audio files: the audio is transcribed and then dropped. We do not keep full-size images, and we do not keep like, view or comment counts.
• What you import or sync from a connected account or an export file: the link to each saved item, the date you saved it, and, where the platform provides it, the post text and author. See Connected accounts for exactly what each platform gives us.
• Photos and screenshots you add, stored as you shared them, and the text the model reads from them (OCR) plus a short caption, so you can search them.
• Your questions in Ask, the answers, and which of your saves each answer cites, so you can see past answers again.
• Your AI consent: the date you agreed, on the one-time screen shown before your first save or question, that your content may be sent to the AI providers listed under Who processes it.
• What the model produced from that content: a summary, key points, tags, the category it was filed under, and the search index (a numeric embedding). We do not keep names of people picked out by the model.
• Connection tokens for accounts you connect, encrypted at rest, used only to read your saved items on your behalf.
• Usage counters: how many saves and questions you used each month and in total, and what those operations cost us. Monthly counters are deleted after 12 months; the total is kept while you have an account.

We do not store payment card details. We do not run advertising or third-party analytics trackers on the app.

Connected accounts

The only account you can connect today is X: you can sign in with it, and bookmark sync from it is paused. Every connection is authorised by you through the platform's own login screen (OAuth). We never see your password, and we never post, like, follow, message, or change anything on your behalf. We read your saved items and nothing else.

Where a platform sync is not available for your account, you can upload the platform's own data export instead. The data we keep from an export is the same as from a sync: the link, the date, and whatever text the file contains.

What we do with it

Your library is used to run the product for you: to fetch and understand what you save, to search it, and to answer your questions with citations back to your own items. Answers are generated from your library only.

We do not sell your data, and we do not share it with anyone except the processors listed below.

We do not train models on your content. Not our own, not anyone else's. Every request we send through OpenRouter carries its data_collection: "deny" setting, so it is only routed to model providers that do not train on it. Content received from a connected platform is used only to build your personal library and is never used to train, fine-tune, or evaluate a machine-learning model, aggregated with other users' data, or redistributed.

Who processes it

Running the product means handing pieces of your data to a small set of vendors, each for one job:

• Convex: the database, file storage and backend software the app runs on. We run it on our own server.
• Our server provider: rents us that server, where your library is stored.
• Cloudflare: serves this site and the app, and sits in front of our traffic.
• Cloudflare R2: keeps an encrypted nightly backup of the database and file storage. Each backup is deleted after 30 days.
• OpenRouter: routes content to the language models that summarise, read and answer. Every request is sent with OpenRouter's zero data retention setting (zdr: true, plus data_collection: "deny"), so it only reaches endpoints that keep nothing once they have answered and never train on it; when no such endpoint is free, the request waits and is retried rather than sent elsewhere. Through it the content reaches these model providers: Zhipu AI's GLM and DeepSeek models, run by zero-retention hosts, for summaries, filing, reading images and answers; Google (Gemini, on Vertex AI) for short video clips; OpenAI's Whisper, run by zero-retention hosts, for turning speech into text.
• Jina AI (part of Elastic): turns your items and questions into the embeddings that power search, in 100+ languages. It processes them under Elastic's data processing terms.
• ScrapeCreators: fetches public posts from social platforms when you save a link.
• Resend: sends the sign-in codes to your email address.
• Expo push service: delivers the "save ready" notification to your phone when you turn notifications on. It carries the save's title and collection name.
• Cloudflare DNS (1.1.1.1): before we fetch a link you saved, or check whether it still exists, we look up its hostname through Cloudflare's public DNS. Only the hostname is sent, never your account.
• Google: only if you choose to sign in with Google.
• X: only if you sign in with X. Bookmark sync is paused, so today X only confirms who you are.
• Langfuse, which we run ourselves: records usage metadata for each request to a language model (which model, how many tokens, what it cost) so we can keep track of costs. It never receives the content of your items or questions.
• Apple: sells Pro in the iPhone app and handles that payment; also Sign in with Apple, if you choose it.
• RevenueCat: keeps track of App Store subscriptions for us, by your account id; it never sees your library.
• Creem: sells Pro on the web as our reseller and merchant of record, and handles that payment, tax and invoices. It gets your email address, your account id and the plan you buy, never your library.

Some of these vendors operate outside the EEA. Where personal data leaves the EEA or UK we rely on the vendor's standard contractual clauses.

Retention & deletion

Deleting an item removes its cover image, text, and embedding. Deleting your account removes every item, every connection, and your email. Both are self-serve from inside the app, and both can also be requested by email. How to delete your account, with or without the app: bookmarkpp.com/delete-account.

Your rights

Wherever you are, you can:

• Get a copy of everything we hold on you. Use Export my data in Settings, which produces a JSON file of your library and account, or email us.
• Delete any item, any connected source, or your whole account, from Settings, or by email.
• Withdraw consent for a connected account by disconnecting it, or for AI processing by turning off "Let AI read my saves" in You → AI (new saves then wait, unread), deleting your account, or emailing us. Prior processing stays lawful; future processing stops.
• Correct your account email by contacting us.
• Object or restrict processing where the law gives you that right.
• Ask through the platform. A request that X relays to us on your behalf is honoured the same way as one you send us directly.

Email [email protected] from the address you signed up with. We answer within 30 days, usually within a few days. If you are in the EEA or UK and think we have handled your data unlawfully, you can also complain to your local data protection authority. We would appreciate the chance to fix it first.

Copyright & takedown

bookmark++ is a private library: nothing anyone saves is published or shown to other users, and we keep text, a summary and one small cover image, never video or audio files. If you believe something we hold infringes your copyright, email [email protected] with the link to the original work, the content you are concerned about, and how to reach you. We act promptly, usually within a few days: we remove the material and tell the user it was removed. We close the accounts of people who repeatedly save infringing material after notice.

Who we are

bookmark++ is run by an independent developer based in Serbia, who is the data controller for the service. The way to reach us is email, below.

Privacy questions and requests: [email protected]. Everything else: [email protected].

bookmark++ is for people aged 16 and over. We do not knowingly collect data from anyone younger; tell us and we will delete it.

The short version

bookmark++ is a personal tool for keeping and searching the things you save. Use it for yourself, stay inside the quotas, do not use it to abuse other people or the platforms it reads from, and understand that it is young software offered as-is. Using the service means you accept what follows.

Your account

One account is for one person. You are responsible for what happens under it and for keeping access to the email address it is tied to. You need to be old enough to enter a contract where you live.

Personal use, and fair use

Plans come with counts of saves and questions, shown on the pricing page and inside the app: Free has 100 saves and 100 questions in total, Pro has 1,000 of each every month, starting again on the 1st (UTC). Only questions that get an answer count, and imports count as saves. When a count runs out, saves wait in your library and questions pause until you move to Pro, or on Pro until the 1st. Videos are read up to their first 30 minutes. Pro is for personal use: automated or bulk saving by scripts is not, and we may slow down an account that does it. Pro bought in the iPhone app is billed by Apple to your Apple ID, renews automatically unless you cancel at least 24 hours before the period ends, and is managed and refunded through Apple (Settings → your name → Subscriptions); it applies to your bookmark++ account everywhere you sign in. A historical import from a connected account counts against your saves quota; the app tells you the number before it runs.

Quotas are set for a person using the product normally. Automated bulk saving outside the built-in connectors, reselling access, sharing one account across a group, or otherwise working around the meters is outside fair use, and we may throttle or close accounts that do it.

Connecting accounts

Today you can connect only X, to sign in; bookmark sync from X is paused. When sync is on, connecting X authorises bookmark++ to read your saved items from that platform on your behalf, using the access the platform grants through its own consent screen. You can revoke that at any time from Settings or from the platform.

Your use of a connected platform remains subject to that platform's own terms. We use only the platform's official interfaces, and we will not read anything the platform has not authorised. If a platform withdraws or changes the access it offers, that connector may stop working; we will tell you, and your imported items stay in your library.

You may only connect accounts that belong to you.

Your content

What you save stays yours. You give us only the permission needed to run the service on it: fetching it, storing it, processing it through the vendors listed under Who processes it, and showing it back to you.

You are responsible for having the right to save what you save, and for respecting the terms of the sites it comes from. Do not use bookmark++ to collect content about people who have not consented, or to build a dataset for redistribution.

No abuse

Do not use the service to break the law, to harass anyone, to store or distribute illegal material, to attack our infrastructure or anyone else's, or to attempt to reach data belonging to other users. We may suspend an account immediately for any of these.

Answers are generated

Summaries, categories and answers come from language models reading your saved content. They are useful, and they are sometimes wrong. Check anything that matters against the original item, which every answer links back to. Do not rely on bookmark++ for medical, legal, or financial decisions.

Payment

Pro is billed by Apple when bought in the iPhone app, and by Creem, our reseller and merchant of record, when bought on the web. Web prices include tax. Both renew until cancelled: on iPhone in Settings → your name → Subscriptions, on the web in You → Manage subscription. Cancelling stops the next renewal and keeps your plan until the end of the period you paid for. Prices can change with notice ahead of a renewal.

As-is, and ending things

The service is provided as-is, without warranties of any kind. We do not promise it will be available without interruption, that every source or connector will keep working, or that nothing will be lost. Keep your own copy of anything you cannot afford to lose; Export my data exists for that. To the extent the law allows, our liability is limited to what you paid us in the previous twelve months.

You can stop at any time by deleting your account from Settings. We can end an account for a breach of these terms, or discontinue the service with reasonable notice.

Anything about these terms: [email protected].