We don't collect anything about you.
This is the whole policy, not a summary of one. It is short because there is very little to say: MarkSync has no accounts, no cookies, no analytics, and nothing to sell — because there is no data to sell.
The short version
- No accounts. Nothing to sign up for. We never ask for your name, email address or phone number.
- No cookies, no analytics. This website sets no cookies, runs no analytics or tracking scripts, and contains no advertising or third-party trackers.
- No profiles. We do not build a profile of you, we do not fingerprint your browser, and we have nothing to sell or share with anyone.
- Your bookmarks stay yours. They are encrypted on your device, with your password, before they are ever sent anywhere. Nobody else can read them — not us, not the sync service.
- Open source. You do not have to take our word for any of this. Read the code, or run the whole thing yourself.
Who we are and what this covers
MarkSync is a free and open-source project, run by volunteers, that syncs your bookmarks across browsers and devices. It is a maintained fork of xBrowserSync and is licensed under the GPL-3.0.
This policy covers this website, marksync.org. It also explains, in section 06, how the MarkSync browser extension and web app handle your data, and where the responsibility of the independent sync services begins.
It does not cover third-party websites we link to, or the public sync services run by other people. Those are operated by others and have their own policies — see section 07.
What this website collects about you
Nothing. This site is a set of static pages. There is no account to create, no form to fill in, no newsletter to join, and no comment box. We do not ask you for personal data, and we have no database in which to put any.
Concretely, this website does not use:
- Analytics of any kind — no Google Analytics, no self-hosted analytics, no "privacy-friendly" analytics either;
- Advertising, ad networks, retargeting or conversion pixels;
- Social media embeds, share widgets or "like" buttons;
- Session recording, heatmaps or A/B testing tools;
- Browser fingerprinting of any sort.
Because we never collect it, there is no personal data for us to sell, share, rent, or hand over — including to advertisers, data brokers, or anyone else.
Cookies and local storage
This website sets no cookies whatsoever, and stores nothing in your browser's local storage or session storage. That is also why you have not been shown a cookie banner: there is nothing to consent to.
The MarkSync app itself is a separate matter — it stores your settings and your bookmark data on your own device so that it can work. That data stays on your device and is described in section 06.
Hosting and server logs
Like every website, this one is served by a hosting provider, and delivering a page to you technically requires your device's IP address to be processed. Our host may keep short-lived connection logs (IP address, timestamp, requested file, user agent) for the purpose of serving traffic and protecting the site against abuse and attacks.
We do not use those logs to identify, track or profile visitors; we do not combine them with anything else; and we do not add any analytics layer on top of them. This processing is limited to what is technically necessary to deliver the website to you, which is our legitimate interest in running it at all (Art. 6(1)(f) GDPR).
Requests this site makes to other people's servers
We would rather tell you about these than pretend they do not exist. When a request goes to another company's server, that company necessarily sees your IP address and user agent, exactly as any website you visit would.
| What | Who | When |
|---|---|---|
| Web fonts (Archivo, IBM Plex Mono) | Google Fonts (fonts.googleapis.com, fonts.gstatic.com) |
On every page load. Google receives your IP address as part of serving the font files. Google states that Fonts requests do not set cookies and are not used for advertising. |
| Live status of public sync services | Each sync service listed on the home page, at its own /info endpoint |
Only on the home page, and only if JavaScript is enabled. Your browser asks each service directly, so nothing about that check reaches us — but each of those services does see the request. |
Nothing else is loaded from a third party. Links to GitHub, the Chrome Web Store, Mozilla Add-ons or the web app are ordinary links: nothing is sent until you actually click one.
The MarkSync app and your bookmarks
The browser extension and the web app are the parts that actually handle your bookmarks. They are designed so that nobody but you can read them.
Encrypted on your device
Your bookmarks are encrypted on your device, using a password only you know, before anything leaves it. What gets sent to a sync service is an encrypted blob it cannot open. Decryption likewise happens on your device.
Anonymous by design
You are not identified by an account but by a sync ID — an anonymous identifier for your encrypted data. It is not derived from your name, email address, or anything else about you, and it contains no personal information. Together with your password, it is what lets you reach your bookmarks from another browser or device.
The other side of that promise: because we hold no account and no copy of your password, we cannot reset it and we cannot recover your data if you forget it. Please back up regularly.
No telemetry
The app sends no usage statistics, no crash reports and no telemetry to us. Its settings and its local copy of your bookmarks live on your own device, and are removed when you uninstall it or clear its data.
Sync services are run by other people
MarkSync does not run a sync service. Your encrypted data is stored on whichever service you choose: the official xBrowserSync service, one of the public services offered by volunteers, or one you host yourself.
Each of those operators is independently responsible for their own server, and sets their own retention period, size limits and policies. We neither vet nor control them. Whichever you pick, your data still arrives already encrypted — but the operator will, of necessity, see the connection to their server.
If you would rather not rely on anyone else at all, you can run the MarkSync API yourself. That is precisely the point of the project.
Your rights
If you are in the EU or UK, the GDPR gives you the right to access, correct, delete, restrict, port and object to the processing of your personal data.
These rights are difficult for us to act on for a simple reason: we hold nothing that identifies you. We cannot look you up, because there is nothing to look up. If you believe otherwise, contact us (section 11) and we will help however we can. You also have the right to lodge a complaint with your local data protection authority.
For data held by a sync service, address your request to that service's operator. For data on your own device, uninstalling the app or clearing its data removes it.
Children
MarkSync is not directed at children, and we knowingly collect no personal data from anyone at all — children included.
Changes to this policy
If this policy changes, the updated version will be published on this page with a new date at the top. Because the site is open source, every revision is also visible in the project's public history, so you can see exactly what changed and when.
Contact
Questions about this policy, or about how MarkSync handles data, are best asked in the open where the answer helps everyone: open an issue on GitHub.