Privacy Policy
Last updated: 2026-10-18
The short version
Your bookmark data stays on your computer. Synced content is saved to your chosen data location. A separate folder copy is created only when you click Back up and choose a destination. No account, sync server or bookmark upload to MarkVault is involved.
What the extension stores, and where
While you browse X, the extension reads the responses the page itself loads and stores the bookmarked posts in your browser’s local database (IndexedDB), and — once you choose and authorize a data location — keeps writing post records there as plain text files (JSONL format). You choose the data location once during setup and can change or reauthorize it in Settings. Clicking Back up and choosing a separate location creates an independent folder copy; it does not create a ZIP or upload the data. Restore from backup accepts a backup copy or the original data folder. After restoring, this browser keeps saving to the folder you selected. If you enable automatic media archiving in Settings, it also saves bookmarked images and video cover images in a media folder inside your data folder. If you enable the separate video setting, it also saves video files there. Stored content includes post text, author, timestamps, media URLs, folder membership, the X account handle that captured the bookmark when it is visible in the page, and the raw API response the post came from. In those files, video addresses are stored in an encoded form rather than as readable links; image addresses stay readable. The extension restores them when it reads the files. The encoding is the same for every install and is not tied to your licence, browser or device, so it never stops you moving your archive.
These files are yours. You can open, search, copy, back up or delete them without us being involved in any way.
What we receive
Your bookmarks are not sent to MarkVault. Passive capture and local archiving do not upload bookmark content.
The extension contacts markvault.app to check a paid licence when you activate it, once a day while a licence is activated, or when you choose Recheck now. If a check cannot be made, the current ticket and its seven-day grace period keep working. Temporary failures are retried. Each check sends only the licence code, a random browser-seat identifier and the extension version. We use them only to validate the purchase, enforce the one-browser-seat limit and return a signed entitlement. After you connect a data folder, trial access for AI tools is prepared automatically: the extension sends a random browser-seat identifier and the original trial start time to markvault.app to obtain a signed access file, saved with your archive. Failed requests are retried, and preparing access again never extends the trial. The extension also contacts markvault.app to download share-card templates when the share card is shown; that is a plain request without credentials and sends no personal information and no archive content. After activation it also revalidates your licence automatically as needed. When you share to X, the extension only places the image you just created and a short text into X’s composer; whether to post is up to you. No posting API is called. X uploads the image as it does when you attach an image by hand. We do not receive bookmark content, post text, media, your X handle or X credentials. No product analytics or funnel telemetry is collected.
Diagnostics reports are generated only on your computer. Opening Settings generates a report preview locally, and you can regenerate it yourself. The report is exported only when you choose Copy or Download. It contains status, counts, support codes and timings, and excludes bookmark content, authors, links, account details and folder paths. Nothing is sent automatically; we receive a report only if you attach the file to an email yourself.
Permissions we deliberately do not request
MarkVault does not request the cookies or webRequest permission and does not ask Chrome for direct cookie access. During initial collection, the page’s own request template, including the session context already used by X, is held only in that X tab’s memory and replayed there. Login headers are not written to the archive or sent to MarkVault. Host permissions cover X pages for passive capture and initial collection, X media hosts for media saving you request, background archiving you enable in Settings, and profile pictures (your own in the side panel; the authors you save most on the overview page and its share card, loaded straight from X and never saved), and markvault.app for paid-licence activation and revalidation, trial access for AI tools, and share-card template downloads when the share card is shown.
This website
markvault.app is a static site hosted on Cloudflare Pages. Our host processes standard request logs (IP address, user agent, requested URL) for security and abuse prevention. We do not run analytics, advertising or tracking cookies on this site.
Uninstall page
Chrome may open our parameter-free uninstall page after you remove MarkVault. The URL contains no extension, browser or archive identifier. The page sends nothing automatically. Its optional feedback link only opens your email app; feedback is received only if you choose to send that email.
Payments
Purchases are handled by Paddle, which acts as merchant of record and is the seller for the transaction — this is the name that will appear on your receipt and your card statement. Which Paddle entity you contract with depends on where you buy from: Paddle.com Inc. in the United States, Paddle.com (Canada) Ltd. in Canada, and Paddle.com Market Limited elsewhere. See Paddle’s buyer terms. They collect the billing details necessary to process your payment and to meet tax obligations. We receive order and licence information — we never see your full card details.
To deliver your licence, we send the checkout email address and a message containing the licence code to our transactional email provider, Resend. This is used only for purchase fulfilment.
Mail to support@markvault.app is forwarded to a private inbox and kept only as long as needed to handle your request.
Your rights
Because we hold no archive of yours, deleting your data means deleting your local files — entirely under your control. For correspondence and order records held by us or by Paddle, write to support@markvault.app and we will action access, correction or deletion requests.
The launch waiting list
If you give us your email address to be told when MarkVault launches, that address is held by us and by EmailOctopus, the service that sends the emails. We use it for exactly two things: telling you when MarkVault is available, and occasional short updates about the product. It is never sold, rented, or used for anything else.
You have to confirm by clicking a link before we can email you again. An address that is never confirmed never hears from us.
Every email carries a one-click unsubscribe link. Unsubscribing takes effect immediately and you never have to ask us for it.
This is separate from your bookmark archive. Your bookmarks are never uploaded anywhere, whether or not you join the list — see the top of this page. Joining the list tells us an email address and nothing else about you.
We keep the list until launch plus roughly six months of follow-up, or until you unsubscribe, whichever comes first.
The form is protected by Cloudflare Turnstile, which checks that a submission came from a person rather than a script. It does not track you across sites.
Children
MarkVault is not directed to children under 16.
Changes
If this policy changes materially, the date at the top changes and the change is described in the extension’s release notes.