Questions, including the ones with awkward answers.

Your password is put through Argon2id on your device to derive a key, and that key unlocks the one your library is encrypted with. Every link, list, tag, and setting is its own encrypted file; encryption happens before anything is uploaded, and decryption only ever happens on a device of yours. The password itself never reaches us — not when you create the account, and not when you sign in.

The username you chose, a public key that lets us check a sign-in signature, a session record for each device you are signed in on, and a set of encrypted files — each with a path, a size, and the time it last changed. If you subscribe, a subscription record too. Not one title, address, tag, or note is kept in readable form, and there is no search index over any of it. The opt-in preview service is handed an address to fetch and stores none. The full inventory is in the privacy policy.

It identifies you to the payment provider, yes — it needs a name, an email address, and a way to charge you, and it holds those under its own privacy policy. What reaches us is its identifier for your subscription, stored against your account so the app knows which features to unlock. That is the whole of it, and none of it touches the encryption: we can tell that an account pays, and still cannot read one link inside it. The free plan asks for no card, so it never crosses that line at all.

We run no analytics, ship no advertising SDK, fingerprint nothing, and set no cookies of our own, anywhere in Bracemark. One screen loads code that isn’t ours: opening Settings → Subscription must load Paddle’s script, to show your price in your own currency and to run the checkout if you subscribe. That script is the only third-party code in Bracemark, and the cookies it sets are the only cookies. Even the fonts come from us rather than from a font provider. Bracemark does keep data in your browser, but it is your library, kept there so it works offline.

We can only hand over what we hold. An order served on us reaches your encrypted files and the metadata that rides with them — a path, a size, the time each last changed — together with the account record: the username you chose, the public key your sign-ins are checked against, the sessions that keep your devices signed in, and a subscription record if you pay. It doesn’t reach a link, a title, a tag, or a note, and there is no key on our side to compel, because one was never there. An order also doesn’t have to come to us at all: Cloudflare stores the encrypted files and the account databases, Amazon Web Services serves this website and the app, and Paddle holds the payment details we never see — each can be served for its own part, and the privacy policy lists every provider, what it holds, and every field we hold ourselves. One more thing worth saying plainly: we hold no email address for you, so we have no private channel to warn anyone through, and the only notice we can give is the notice we give on this website.

The browser extension reads the live tab and tries to fill in its title and preview image every time you save. The mobile apps fetch pages themselves: by default they cover links saved on that device, and the All links setting also covers synced and imported links as they come into view. With All links selected, Generate all works through every pending link. Those paths are free and involve no server of ours. In the web app, the browser blocks one page from fetching another site. Turn on server previews on Plus and new saves, older links, synced links, and imports fill in as you browse; Generate all covers the rest. The server that fetches them holds no key and receives no account identity. It stores no URL or page content; its rate limiter briefly holds the requesting IP address to stop one source abusing it.

Yes — the whole thing is public at github.com/stxapps/bracemark-monorepo, under the AGPL-3.0: the apps, the browser extension, the two servers behind them, and the key derivation, in one repository. You can read where the key comes from, where encryption happens, and what each of those servers is given. One caveat we would rather state than have you assume: reading the source proves what the code does, not that the bundle your browser downloaded was built from it. That needs reproducible builds, and we don’t publish them yet.

Please tell us before you tell anyone else: security@bracemark.com. Include what you did and what happened; you will get a human reply.

Not today, and we would rather say so than let the licence imply otherwise. The builds we ship — web, mobile, and the browser extension — have our API’s address compiled in when they are built, so there is no setting that points one somewhere else, and the mobile and browser extension builds reach you through stores that only we can publish to. Behind that, our API isn’t a container you can run: it is a Cloudflare Worker wired to Cloudflare’s own databases and object storage, and its subscriptions run through our Paddle account. The AGPL-3.0 doesn’t stop you building your own from the repository, and the code being public is what makes that possible — but it isn’t a path we document, and not one we can help you debug.

A username and a password. That is all we ask for — no email address, no phone number, no card. We suggest the password for you: seven random words, long enough to survive an offline attack in a way most typed passwords aren’t. You can choose your own instead. See Create an account for the recovery step.

Because there is nothing we could honestly do with one. There is no password reset to send, since we hold no key that could unlock your library. Nothing else needs it either — receipts come from our payment provider. An address we never collect is one that can never leak.

A second way into your account: a random code we offer you when you create your account, shown once. It opens the same library your password does, so it is what you use if the password is gone. Keep it somewhere different from your password — printed and filed, or in a safe — because if both are lost at once, there is no way back into your account and nothing in it can be recovered. You can generate or replace the code later in Settings, as long as you can still sign in.

Sign in with your recovery code, then set a new password. If both are gone, we cannot sign you in or decrypt your account for you. A device that is still signed in may let you export your links into a new account; otherwise there is no way to recover them. Lost your password has the steps.

Yes, in Settings. It re-locks your key with the new password rather than re-encrypting your library, so it takes a moment, not an afternoon — and every other device has to sign in again with the new one, which cuts off anyone signed in with the old one. Your own devices keep their copy, and any changes not yet synced, until you do. What it can’t do is unmake a copy: the key itself doesn’t change, so anything someone already decrypted stays readable to them. Changing your password is the right move after a scare; it isn’t a way to undo a break-in that already happened.

Yes, on as many as you like, on every plan. Sign in with the same username and password and the library is derived and decrypted there too.

A password manager is the best answer. A notes app that locks, or paper somewhere only you would look, both work. Don’t keep it on a site you don’t trust: anyone with it has your library.

Free for your first 200 links, with no card. Plus is $48 a year — unlimited links, nested and hidden lists, the app lock, and the structured search editor — and starts with a 14-day free trial. Everything is on the pricing page.

Prices on this site are shown in US dollars, which is our base price. Some countries are priced in their own currency instead — if yours is one of them, that is what you will be charged, at a price we set rather than a live exchange-rate conversion. Either way the web app shows your exact price, in your currency and with any tax, on the upgrade card and again in the checkout before you pay. In the iOS and Android apps, the App Store and Play Store set the local price, and you see it in the store’s own purchase sheet.

Nothing is deleted and nothing is put out of reach. You keep reading, searching, editing, deleting, and exporting the whole library; new links stop saving until you upgrade or delete links permanently to make room. Moving a link to Trash still counts toward the limit. Upgrading lifts the cap straight away. That is also what happens if a trial ends with more than 200 links in your library — they all stay, and stay exportable; you just can’t add new ones until you are back under the cap or on Plus.

The file is read on your device and counted before anything is saved, so you find out up front rather than halfway through. If it holds more new links than your plan has room for, Bracemark tells you both numbers and asks: bring in the ones that fit, or stop and import the whole file once you have room for all of it. Nothing is written until you pick, and the file on your device is never changed. If you take the ones that fit, importing the same file again later brings in the rest — the links already saved are skipped as duplicates. One exception: a Bracemark backup (.zip) is all-or-nothing, because a half-restored backup is worse than none. Import your links explains the choices.

Yes — Plus starts with 14 days free, on the annual plan. Starting it goes through checkout, so it takes a payment method, but nothing is charged if you cancel before the 14 days are up. There is no rush to start: the free plan has no time limit, and the 14 days only begin when you begin them — so you can start the trial whenever you have something for it to do. If you are importing a library of more than 200 links, that is day one — the cap is the first thing you will meet. Otherwise start it when you want one of the Plus features.

Not today — Plus is annual only, and that carries a real cost for you: a year up front is a larger commitment than a month, made before you know whether this fits the way you work. What bounds it: the 14-day trial runs before the first charge, so cancelling before it ends means you are never charged; cancelling after that stops the renewal, and your library stays readable, searchable, and exportable on the free plan either way; and if we stop offering the paid plan for reasons within our control, our Terms commit us to cancelling subscriptions and refunding the unused part of any period already paid for. Refunds in the ordinary case are further down.

Not at the moment. Running the service costs something every year, so a price that only ever gets paid once has to be set carefully. If we offer one it will be as a capped launch deal, announced here first.

Payments on the web go through Paddle, which acts as the merchant of record: it handles any sales tax or VAT, refunds follow Paddle’s refund policy, and we never see your card details. Purchases made in the iOS or Android apps are handled by Apple and Google under their own refund rules. If something has gone wrong, write to support@bracemark.com and we will sort it out — and customers in the EU and UK have a statutory 14-day right of withdrawal on top of anything we offer.

You keep it, and you keep using it. The whole library stays readable, searchable, and exportable on the free plan, and you can still edit, tag, and delete anything in it — which is also how you get back under the free cap if you are above it. What stops is adding new links past that cap and creating new Plus structure; nothing you already made is taken away or stranded, so nested lists stay nested and can always be flattened, and an existing lock still opens with your password and can always be removed. Export is free on every plan, forever — charging you to leave would undo the point of building it this way.

Not today. We rely on a payment provider to handle sales tax and accounting across countries, and we take what it supports. If that changes we will turn it on.

Give it a minute — activation arrives from the payment provider a few seconds after checkout. If it hasn’t landed, open Settings → Subscription and restore your purchase; if it still hasn’t, write to support@bracemark.com with the date and the store you bought it from. See Manage your subscription for the store-specific steps.

A preview takes a moment to arrive. The browser extension tries to fill one in whenever you save a tab. The mobile apps fetch on the device: the default covers links saved there, and setting Link previews to All links also fills in synced and imported links as they come into view. With All links selected, Generate all works through everything still pending. In the web app, the browser won’t let a web page fetch another site, so opt-in server previews on Plus fill in new saves and pending links as you browse, and Generate all there covers the full library. Some pages give nothing up whichever path asks, and no plan changes that: anything behind a login or a paywall, a PDF or another file that isn’t a web page, a site that turns away automated requests, and pages whose text is assembled by JavaScript after they load. We stop retrying those, so they land in the failed count under Link previews in Settings rather than a queue that is still working on them. The link is saved either way, and you can give it a title of your own. See Link previews for the settings.

Yes, on Plus. The free plan gives you flat lists, tags, and pins, which is enough structure for a library of 200 links; nesting starts to matter at the size the paid plan is for. See Lists for the controls.

Yes, on every plan — one short note per link, up to 500 characters, added when you save it or from “Edit note” in the link’s menu. It is encrypted on your device with the link itself, so it is as unreadable to us as the address is. The search box matches titles and addresses; to search your notes, use the “Note contains” field in the Plus search editor. See Search your links for the controls.

Yes. Both the layout and the theme can either sync across your devices or be set per device — switch the setting from “Sync” to “Device” and that machine keeps its own choice.

Each link, list, and tag is stored as its own encrypted file, so two devices working on different things never collide. If the same link is edited in both places before they sync, the later edit is the one that survives and the earlier one is replaced — we hold nothing readable from your links, so there is no merge we could do for you and no older version to restore (see can I undo a change). Anything you change offline queues up and goes out in order the next time you have a network. Titles and preview images fetched in the background live in a separate encrypted file from what you write, so one never overwrites the other. See Sync and devices for the steps to check sync.

Yes — light, dark, follow the system, or switch at times you choose. Ours is a dark grey rather than pure black.

A Plus feature that puts a lock over the app, and lets you hide individual lists from view. It sits on top of the encryption rather than replacing it — encryption protects your library from us and from anyone who gets the files; the lock protects it from whoever is standing behind you. See App and list locks for setup and recovery.

Not today. Sharing means handing someone the ability to decrypt part of your library, which is real key-exchange work rather than a button, and public sharing would drag in moderation duties we would then have to act on. We would rather not ship a shallow version of it.

A deleted link, yes: removing a link puts it in Trash, and it stays there until you delete it permanently. Restore brings it back — to My List, since nothing records which list it came from. An edit is the half we can’t help with. Saving a title, a note, or a set of tags replaces what was there, and we hold nothing readable from your links to have kept the earlier version in, so there is no history to roll back through and nothing we could hand you. An export is the backstop worth having, with one thing to know about it: restoring a backup fills gaps rather than overwriting, so a link you deleted comes back and a link you still have keeps the version on your device. It covers the clean-up you regret rather than the edit, and exporting first costs nothing. Restore a link has the steps.

Both. Import a browser bookmarks export, a Raindrop HTML export, or a plain list of URLs — the file is read on your device and never sent anywhere; the links it holds sync encrypted, like every other link. From Raindrop, the HTML export is the one to use: its CSV turns a collection named “Work / Clients” into a Clients list inside a Work list. If the file holds more links than your plan has room for, you are asked before anything is saved (see what if I import more than 200 links). Export gives you the whole library on every plan: a full backup that restores everything, or one of three formats other apps read — a browser bookmarks file, a CSV carrying the address, list, title, note, tags, and date of every link, and a plain list of URLs. A list you have locked is left out of the file until you unlock it. You can turn a backup you kept into any of those three later with our bookmark converter, which runs in your browser and needs no sign-in. See Import your links and Export your data for the steps and formats.

Settings → Data wipes your library and keeps the account. Settings → Account does that same wipe and then deletes the account itself, along with the keys that could ever have opened it — so there is no need to run both. Neither can be undone, so both ask you to confirm first. Your username stays for good: it is retired rather than released, so nobody can register it later and be mistaken for you. The delete-account page lists everything else that outlives a deletion, and for how long.