Privacy Policy

This policy explains what data Bookmarx ("we", "us") collects when you use bookmarx.co, why we collect it, who we share it with, and the choices you have. The short version: we collect what is needed to sync and organize your X bookmarks, we do not sell your data, and you can ask us to delete everything.

1. Data we collect

Account data

• From Google sign-in: your name, email address, and profile picture.
• From connecting X: your X user ID, username, and OAuth tokens with read-only access to your bookmarks. We cannot post, follow, or change anything on your X account.

Content data

• The posts you have bookmarked on X: text, author name and handle, avatar, media attachments, links, and engagement metrics.
• Content the Service creates for you: AI summaries, tags, collections, insights, embeddings, your interest profile ("archetype"), generated decks, and your chats with the AI assistant.

Payment data

• Your plan, purchase history, and credit balances. Card details are collected and processed by our payment provider, Dodo Payments; we never see or store your full card number.

Usage and device data

• Product analytics on our production site via Heap (pages viewed, features used), error reports via Sentry, and standard server logs (IP address, browser type, timestamps).
• Pseudonymous session interaction recordings and heatmaps on our production site via Microsoft Clarity. Clarity reconstructs page content and interactions such as mouse movements, clicks, scrolling, navigation, and input events so we can find usability problems. Values entered in input boxes and dropdowns are masked, although other on-page text may be visible.
• Advertising measurement on our production site via the X (Twitter) pixel. When you arrive from one of our X ads, the pixel reports the visit so we can tell which ads worked. It may also let us show follow-up ads to people who have visited the site.
• If you enable notifications: a push subscription endpoint for your browser or device.

2. How we use data

• Sync and display your bookmarks and keep them up to date.
• Generate summaries, tags, collections, digests, decks, and assistant answers. This is the core of the product.
• Send transactional email (billing, account) and, if enabled, scheduled digest emails. Every digest has an unsubscribe link.
• Send push notifications you have opted into.
• Process payments, prevent abuse, and enforce usage limits.
• Understand product usage and fix errors.

We do not sell your personal data, and we do not use your content for advertising.

3. AI processing

To generate summaries, insights, and decks, we send the content of your bookmarks to OpenAI's API. Under OpenAI's API terms, that data is not used to train their models. AI outputs are stored in your account so they only need to be generated once.

4. Who we share data with

We share data only with processors that run the Service:

• Supabase — database hosting (your account and content data)
• Vercel — application hosting and logs
• Railway — background processing (sync and AI jobs)
• OpenAI — AI processing as described above
• Dodo Payments — billing and payment processing
• Resend — sending email
• Heap — product analytics
• Microsoft Clarity — session replay and heatmaps; see the Microsoft Privacy Statement
• Sentry — error monitoring
• Google and X — sign-in and bookmark sync, under their own policies
• X (Twitter) Ads — advertising measurement and audiences, via the X pixel on our production site
• Browser push services (Apple, Google, Mozilla) if you enable notifications

We may also disclose data if required by law, or as part of a merger or acquisition, in which case this policy continues to apply to your data.

5. Cookies

We use a small number of first-party cookies: a session cookie to keep you signed in and cookies that carry X authorization during connection. Analytics providers may use first-party, third-party, and similar identifiers to measure product usage. In the European Economic Area, the United Kingdom, and Switzerland we send Microsoft Clarity a denied storage-consent signal, so it operates in limited cookieless mode rather than linking activity across pages; elsewhere Clarity is allowed analytics storage and may set its own first-party cookies. We deny Clarity advertising storage everywhere. We do not sell personal data or use your bookmark content for advertising.

6. Data retention

• Your data is kept while your account exists. Cancelling a paid plan does not delete anything.
• Disconnecting X stops future syncing; already-imported bookmarks remain in your account until you delete them.
• When you request account deletion, we delete your personal data from production systems within 30 days, except records we must keep for legal or accounting reasons (for example invoices).

7. Your rights and choices

• Access, correction, export, deletion: email support@bookmarx.co and we will act on your request within 30 days.
• Digests: configurable and can be turned off in Settings; every digest email has a one-click unsubscribe.
• Push notifications: can be disabled in Settings or in your browser at any time.
• X connection: can be revoked from Settings or from your X account's connected apps.
• Depending on where you live (for example the EU/UK under GDPR or California under the CCPA), you may have additional rights, such as objecting to processing or lodging a complaint with a supervisory authority. We honor these requests regardless of where you live.

8. Security

Data is encrypted in transit (TLS) and at rest by our hosting providers. X tokens are stored server-side, sessions use signed tokens, and database access is restricted with row-level security. No system is perfectly secure; if a breach affects your data we will notify you as required by law.

9. International transfers

Our processors operate primarily in the United States. Where data is transferred across borders, we rely on our processors' safeguards, such as standard contractual clauses, to protect it.

10. Children

The Service is not directed to children under 13, and we do not knowingly collect their data. If you believe a child has created an account, contact us and we will delete it.

11. Changes to this policy

If we make material changes we will notify you by email or in the app before they take effect. The effective date above always reflects the current version.

12. Contact

Privacy questions or requests: support@bookmarx.co