Privacy Policy

urlmark keeps your bookmarks on your own devices. There is no account, no cloud storage, and nothing to sign up for. This page explains what that means in practice — what stays on your device, what happens if you choose to sync between your own devices, and the little our server ever sees.

Controller

Henri Podolski
Fanningerstraße 55
10365 Berlin, Germany

E-mail address: urlmark@webjected.com

Imprint: urlmark.webjected.com/en/imprint

The urlmark app

What we don't collect

• No account and no sign-up of any kind.
• No analytics, tracking, or crash-reporting SDKs.
• No copy of your bookmarks. We never receive them, so there is nothing for us to store, read, or hand over.

Where your bookmarks live

Everything you save — the URL, the title, the extracted summary, and any tags you add — is stored in a single file in the app's private storage area on your device, managed by your operating system. It stays there. If you uninstall the app, it is deleted along with it.

Fetching a page you save

When you paste or share a URL into urlmark, the app makes one outbound request to that URL's own server, to fetch the page and pull out a title and short summary for you. It is the same request your browser would make if you opened the link yourself. The destination website may log it according to its own practices; urlmark has no visibility into or control over that. Nothing about this request goes to us.

Syncing between your own devices (optional)

Your bookmarks never leave your devices. If you want the same bookmarks on your phone and your laptop, urlmark can copy them directly from one device to the other. This is off until you set it up, it only ever involves devices you have put in the same group yourself, and it only runs when you ask it to.

How you set it up. In Settings you pick a group name and a password, and enter the same two on every device that should share bookmarks. That pair is the entire key to your group: devices without it cannot find your devices, cannot join your group, and cannot read anything your devices send each other. We never receive your group name or your password — the app only ever sends our server a one-way hash of them, which cannot be turned back into either.

What gets transferred. When you tap "Sync now", your devices open a direct, encrypted connection to each other and exchange their saved bookmarks over it. Nothing is uploaded to us, and nothing is stored on our side.

What our server does. Two devices on different networks cannot find each other on their own, so urlmark runs a small relay that introduces them: it passes each device the other's connection details, so they can connect directly. On restrictive networks where a direct connection isn't possible, the relay also forwards the connection's traffic — but that traffic is encrypted between your two devices, so the relay carries it without being able to read it.

While that introduction happens, our relay sees:

• a random identifier the app generates for each device, not tied to your hardware or to you;
• the one-way hash of your group name and password, never either of them in readable form;
• basic connection metadata, such as IP address and timing;
• the connection-setup messages your devices exchange, encrypted with a key derived from your password — which our server does not have.

It never sees your bookmarks: not their titles, URLs, tags, summaries, or images. None of the above is written to a database or kept as a log of your syncing. It lives in the server's memory only for as long as your devices need to find each other, and is discarded after that.

Choosing a password. Use the app's "Generate strong password" button rather than something memorable you have used elsewhere. Since your password is what keeps your group private, and we only ever see a hash of it, a weak or reused password is the one realistic way this could be undermined.

App permissions

urlmark's Android app asks for internet access — for fetching the pages you save, and for syncing if you turn it on — and for the ability to receive links shared to it from other apps.

Two further permissions come bundled with the WebRTC engine that powers syncing, and Android grants them silently, without a prompt: legacy Bluetooth access and access to audio settings. urlmark uses neither. It only ever opens a data connection, never audio or video, and never touches Bluetooth. They appear because they ship with that engine, not because the app needs them.

urlmark does not request access to your contacts, location, camera, microphone, or files.

This website

This site (urlmark.webjected.com) has no accounts, no cookies, and no analytics or advertising scripts of any kind. The sync relay described above runs on the same server; what it processes is set out in that section. Like virtually every web server, the infrastructure hosting this site automatically records basic technical access data for each request — IP address, timestamp, requested page, and browser/user-agent string — for security and operational stability. This is standard server-log information, is not used for tracking or profiling, and is deleted after a short retention period (typically within 30 days).

Legal basis: legitimate interest in the secure and reliable operation of our services (Art. 6(1)(f) GDPR).

Your rights

Under the GDPR, you have the right to: access the data concerning you; request its rectification or erasure; request restriction of processing; object to processing; and receive your data in a portable format, in each case in accordance with the legal requirements. You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence.

Because your bookmarks stay on your own devices and we have no copy of them, most of these rights are already satisfied by design — you can view, edit, or delete anything you have saved directly in the app at any time, or uninstall it to remove everything at once.

Changes to this policy

If urlmark's data practices ever change, this page will be updated before the change reaches the app, and the change will be noted in the app's release notes.

Status: July 27, 2026