Trust & Safety

Privacy Policy

Last updated: August 17, 2026 • We respect your data.

ClipMark ("we", "our", or "us") is a YouTube bookmark manager. This policy explains what data we collect, how we use it, and your rights regarding that data.

1. Data We Collect

When you use ClipMark, we may collect the following:

  • Bookmarks — timestamps, descriptions, and tags you create for YouTube videos.
  • Video metadata — video IDs and titles for videos you bookmark.
  • Account data — your name, email address, and profile photo from Google, obtained only when you sign in with Google OAuth.
  • Auth tokens — OAuth access and refresh tokens, stored encrypted in your browser's Chrome storage and our secure database.
  • Usage data — view counts for shared collections (no personal identifying data).
  • Feedback you submit — the rating and answers you send from the feedback form, plus the name and email address only if you choose to fill them in. Both are optional; leaving them blank keeps the submission anonymous.
  • Uninstall feedback — if you remove the extension, Chrome opens our uninstall page. Answering is entirely optional. If you do, we store the reason you picked, anything you write, the version of the extension you had, and an email address only if you choose to leave one — used solely to reply to you and to decide what to fix. Nothing that identifies you is added automatically, and no account or sign-in is involved.

We do not collect browsing history, track pages outside of YouTube, or use third-party advertising trackers.

2. How We Store Your Data

  • Local storage — bookmarks are stored in Chrome's chrome.storage.sync, which is encrypted and managed by Google.
  • Cloud storage — if you sign in, bookmarks and account data are stored in Supabase (PostgreSQL), hosted on secured infrastructure with row-level security policies.
  • Shared collections — when you explicitly share a collection, it is stored in our database and accessible to anyone with the link.

3. Third-Party Services

ClipMark uses the following third-party services:

  • Google OAuth — for sign-in. Governed by Google's Privacy Policy.
  • Supabase — our database provider. Data is stored in the United States. See Supabase's Privacy Policy.
  • On-device AI (Gemini Nano) — AI features like note drafting are processed entirely within your browser using Chrome's built-in models. Your data never leaves your device for AI processing, ensuring maximum privacy and zero data retention by external AI providers.
  • Dodo Payments — our payment processor and Merchant of Record, meaning Dodo is the seller of record for Pro purchases and handles billing and tax remittance. Payment details are handled entirely by Dodo Payments and are never stored on our servers.
  • Vercel — our web hosting provider. See Vercel's Privacy Policy.
  • Vercel Web Analytics — aggregate visitor counts for this website (pages viewed, referrer, country, device type). It sets no cookies and stores nothing on your device; repeat visits within a day are recognised by a hash derived from the incoming request, which is discarded after 24 hours, so it cannot follow you across sites or from one day to the next. Because nothing is stored on or read from your device, there is no cookie consent to give here — see §6 for what that does and does not mean. It does not run inside the extension and never sees your bookmarks.

4. How We Use Your Data

  • To provide and sync your bookmarks across devices.
  • To enable shareable public collection pages.
  • To provide AI-powered features (Pro tier only).
  • To manage your subscription and verify Pro access.
  • To communicate important account-related updates (no marketing emails without consent).
  • To read the feedback you send us, and to reply to it if you left an email address. A feedback email address is not added to any mailing list.

We do not sell your data to third parties. We do not use your data for advertising.

5. Your Rights

You have the right to:

  • Access — request a copy of the data we hold about you.
  • Delete — delete your account and all associated data. You can do this from the dashboard settings, or by contacting us.
  • Export — export all your bookmarks at any time from the ClipMark dashboard (JSON, CSV, or Markdown).
  • Correction — request correction of inaccurate data.

If you are located in the EU/EEA, you also have rights under the EU GDPR. If you are in the United Kingdom, you have the equivalent rights under the UK GDPR and the Data Protection Act 2018. In both cases that includes the right to data portability, the right to object to or restrict processing, and the right to lodge a complaint with a supervisory authority — in the UK that is the Information Commissioner's Office (ICO). Australian users have rights under the Privacy Act 1988 and may complain to the OAIC.

Who is responsible, and on what basis. ClipMark is the data controller for the data described in this policy; reach us at privacy@clipmark.mithahara.com. We process your bookmarks and account data to perform the contract you enter into by using ClipMark; we rely on legitimate interests for keeping the service secure and for the aggregate, cookieless site measurement described above; and we rely on consent for the optional attribution cookies in §6 and wherever you volunteer something optional, such as an email address on a feedback or uninstall form. You can withdraw that consent at any time — through the cookie preferences control for §6, or by asking us to delete anything you volunteered. Data is stored in the United States (see §3).

6. Cookies

ClipMark sets a small number of cookies. None of them are advertising cookies, none are third-party cookies, and none are used to build a profile of you. They fall into two groups, and the difference decides whether we ask you first.

Strictly necessary — always on

These deliver the service you asked for. Without them the site cannot work, so they do not require consent and the banner does not offer to turn them off.

  • Sign-in cookies — set by Supabase when you sign in, to keep you signed in. Without them the dashboard cannot know who you are.
  • clipmark_consent — remembers your answer to the cookie banner for six months, so we neither ask you on every page nor act on an answer you did not give. It stores only your choice and the date you made it.

Optional — only with your consent

These are for us, not for you: they credit whoever sent you to ClipMark. Nothing about the product stops working without them. We set them only if you choose "Accept optional" on the cookie banner, and never before.

  • clipmark_ref — set for 30 days when you arrive through an affiliate link (a /r/<code> URL). It stores only that affiliate's code so the referrer is credited if you later upgrade, and it is set only on the first such visit — a later affiliate link will not overwrite it. It is httpOnly and SameSite=Lax, so it is not readable by page scripts and is not sent to other sites. It contains no identifier for you.
  • clipmark_user_ref — the same thing for a referral link shared by another ClipMark user (a /ref/<code> URL): 30 days, first click wins, the referrer's code and nothing else.

If you arrive through one of those links and have not answered the banner yet, the code travels in the page address only. We store nothing on your device unless and until you accept — and if you decline, or simply never answer, no attribution cookie is ever set.

Not cookies at all

  • Theme preference — stored in your browser's local storage, not a cookie, and never sent to us.
  • Visitor statistics — Vercel Web Analytics (§3) stores nothing on your device and reads nothing from it. It counts unique visitors using a hash derived from the incoming request, which is discarded after 24 hours and cannot be used to follow you across sites or from one day to the next. That means there is no cookie here to consent to — but it is not nothing: we still receive the aggregate figures listed in §3, and we rely on legitimate interests for them (§5). If you object, tell us at privacy@clipmark.mithahara.com.

Changing your mind

Withdrawing consent is as easy as giving it. Use here or the same link in the footer of every page — the banner reopens and your new answer replaces the old one immediately. Choosing "Reject optional" also deletes any attribution cookie you already had. You can additionally block or delete any of these cookies through your browser settings at any time.

7. Data Retention

We retain your data for as long as your account is active. If you delete your account, we will delete your personal data within 30 days, except where retention is required by law. Shared collection pages are deleted immediately upon account deletion.

8. Children's Privacy

ClipMark is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe we have inadvertently collected such data, please contact us immediately.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by updating the date at the top of this page. Your continued use of ClipMark after any changes constitutes acceptance of the updated policy.

10. Contact

If you have questions or requests regarding your data, please contact us at:
privacy@clipmark.mithahara.com