ai-bookmark

Privacy Policy for AI Bookmarklet

Last updated: August 24, 2026

AI Bookmarklet helps users save, categorize, and search browser bookmarks. This policy describes the hosted backend used by the published extension and the static website at aibookmarklet.com.

Information processed

• Account email address and Firebase user identifier for authentication.
• Email/password sign-in, sign-up, and reset requests. The API relays passwords to Firebase Authentication for verification and does not store passwords.
• For legacy users migrated from the former system, the existing bcrypt password hash is retained in the backend as migration audit data; Firebase handles credential verification.
• Bookmark URLs, titles, descriptions, categories, and tags.
• The extension stores the product JWT session token locally in browser extension storage. Firebase may also persist its client authentication state locally until sign-out.

The extension does not collect analytics, advertising identifiers, browsing history in the background, location, health, or financial data. A page URL and title are sent only when the user explicitly adds or imports a bookmark. The website serves static pages, sets no cookies, and runs no analytics. Its dedicated password-reset and email-action page calls the API only to complete Firebase action codes.

Where data goes

The extension sends authenticated requests to the AI Bookmarklet API at api.aibookmarklet.com. The production service is hosted on Railway and stores account/bookmark data in PostgreSQL. For email/password authentication, the API receives credentials over HTTPS and relays them to Firebase Authentication; it does not persist password material. Firebase Authentication processes email/password, Google, and GitHub credentials for the ai-bookmarklet project. The backend exchanges Firebase ID tokens for the product session JWT and may send a requested URL/page content to OpenRouter to generate categorization or search suggestions.

The extension does not sell data or use it for advertising. Railway, Firebase Authentication, and OpenRouter process data only to provide the requested service.

Retention and deletion

Bookmarks and account data remain until the account is deleted or the service operator removes them. Firebase password-reset messages and provider credentials are managed by Firebase. Users can remove individual bookmarks from the extension; account deletion requests can be submitted through the project support channel.

Security

Authentication uses Firebase Authentication for credential verification and a short-lived Firebase ID token exchange for the product’s 7-day Bearer JWT. Firebase Admin and GitHub client secrets are stored in Railway variables and are not included in extension builds or source-control files.

Contact

For questions or deletion requests, open an issue in the project repository.