Privacy Policy

1. Scope and controller

This Policy describes how TableHQ LLC(“Bookmarked,” “we,” “us,” or “our”) handles personal information through Bookmarked FYI. It covers curator accounts, subscriptions and Billing, private Studio data, and public profile and collection pages. X and Stripe handle information under their own policies when you use their services.

2. Information we collect

X identity and account information

When you sign in with X, we receive the stable X user ID and current screen name needed to create your Bookmarked account and handle claim. The server-side OAuth exchange validates the returned X access token and secret but does not expose them outside the OAuth module, store them in our database, or retain them in your session. We do not request or import your private X Bookmarks.

Private library and public collections

We store the public X post URLs and IDs you paste, fallback titles, curator notes, Inbox membership, profile name and biography, collection titles and descriptions, ordering, colors, publication state, and revision timestamps. Inbox items and private collections are returned only to the signed-in account. A collection becomes public only after you use the publication control.

Subscriptions and payments

We store your organization identifier, Stripe customer and subscription identifiers, selected price, subscription and invoice status, payment-method summary, billing event history, and related timestamps. Stripe collects and processes complete payment-card and billing details. We do not receive or store complete card numbers.

Sessions, security, and technical information

We use a signed, HTTP-only session cookie backed by a server-side session record. A short-lived encrypted cookie value protects the X request-token secret during the OAuth callback. We may process IP address, request time, route, response status, browser or device information, and security events in ordinary server logs and in-memory rate limits to operate and protect the Service.

Communications

If you contact us, we receive your contact details, message, and any information you choose to include. X sign-in does not provide us with your email address, so Bookmarked does not obtain an account email from X.

3. Publication and X embeds

Public profiles and collections can expose your X handle, profile text, collection descriptions, fallback titles, curator notes, arrangement, and the public posts you selected. Search engines and other people may index, share, or copy public pages. Your Inbox and unpublished collections are not included in public loaders.

Public collection cards load X's official widget in the visitor's browser. That connection discloses information such as the visitor's IP address and browser details directly to X, and X may use its own storage or receive information according to its policy. We request X's do-not-track embed option, but we do not control X's processing. Studio does not load the X embed script.

4. Sources of information

We receive information:

• from you when you curate, publish, manage Billing, or contact us;
• from X when you authenticate and from public X URLs you submit;
• from Stripe about customers, subscriptions, invoices, payment methods, and payment status; and
• automatically from your browser and our infrastructure when you use the Service.

5. How we use information

We use information to:

• authenticate curators and maintain current handle claims;
• save private libraries and display collections you publish;
• provide subscription access, payment controls, and Billing;
• respond to support and privacy requests;
• prevent fraud, abuse, and unauthorized access;
• diagnose failures and maintain service reliability; and
• comply with law and enforce our agreements.

We do not sell personal information, share it for cross-context behavioral advertising, use private library content for targeted ads, or make decisions with legal or similarly significant effects based solely on automated processing.

6. Cookies and browser storage

Bookmarked uses essential cookies for sign-in, OAuth security, safe return paths, and subscription plan selection. A theme preference may be stored locally in your browser. You can clear browser storage or block cookies, but doing so can sign you out or prevent account features from working.

Bookmarked does not currently load our audience analytics or session replay. X embeds are third-party content and may use separate browser technologies controlled by X.

7. How we disclose information

We may disclose information to:

• service providers for hosting, databases, security, payments, and technical operations;
• X for the sign-in and embed interactions you request;
• Stripe for subscription and payment processing;
• advisers or authorities when reasonably necessary to comply with law, protect rights and safety, or investigate abuse; and
• a successor in a merger, financing, reorganization, or sale, subject to appropriate confidentiality and notice.

We also disclose information when you intentionally publish it on a public profile or collection.

8. Legal bases

Where data-protection law requires a legal basis, we process account, library, subscription, and billing information to perform our contract with you; security, reliability, support, and limited operational records for our legitimate interests; information needed to satisfy legal obligations; and information based on consent where we specifically request it. You may withdraw consent for future processing at any time, without affecting earlier processing.

9. Retention and deletion

We generally retain account and library information while your account remains open. Canceling a subscription does not automatically delete the account or its data. We retain billing, security, dispute, and backup records for as long as reasonably necessary for their purpose and legal obligations, then delete or de-identify them.

To request account deletion, email us from information reasonably connected to the account. Deletion removes the Bookmarked account, private library, and public collections after verification and any legally required retention; it does not delete posts or copies controlled by X or others.

10. International processing

We and our providers may process information in the United States and other countries whose laws differ from those where you live. Where required, we use a recognized transfer mechanism or another lawful safeguard. Contact us to ask about safeguards applicable to your information.

11. Security

We use reasonable administrative, technical, and organizational measures designed to protect information. No transmission, storage, or authentication system is completely secure, so we cannot guarantee absolute security.

12. Your rights and choices

Depending on where you live, you may have rights to access, correct, delete, restrict, object to, or receive a portable copy of personal information, and to appeal a denied request. You may also complain to your local data-protection authority. You have the right to object to processing based on legitimate interests where applicable.

Submit a request to support@bookmarked.fyi. We may verify your identity and authority before completing it. We will not discriminate against you for exercising a privacy right. Because we do not sell personal information or share it for cross-context behavioral advertising, there is no sale or targeted-ad opt-out to exercise for our own processing.

13. Children

Bookmarked is not directed to children under 13, and we do not knowingly collect their personal information. If you believe a child under 13 provided personal information, contact us so we can investigate and delete it where appropriate.

14. Changes and contact

We may update this Policy as the Service or law changes. We will post the new effective date and provide reasonable notice of material changes. Questions and privacy requests may be sent to support@bookmarked.fyi.