Privacy Policy

This policy explains what STX Apps Co., Ltd. (“STX Apps”, “we”, “us”) collects when you use Bracemark, why, and what happens to it. It covers bracemark.com, app.bracemark.com, the Bracemark applications for iOS, Android, Chrome, and Firefox, and the services behind them.

STX Apps Co., Ltd. is the controller of the personal data described here — the company that decides what is collected and why. We are a Thai company serving people all over the world, so this policy is written to satisfy Thailand’s Personal Data Protection Act, the EU and UK GDPR, and the privacy laws of the US states, whichever applies to you. The last few sections say what each of those adds.

The short version

• We cannot read your saved links. They are encrypted on your device with a key your password unlocks, and the password never reaches us.
• We do not ask for your email address, and there is no advertising, no analytics product, no tracker, and no data sold or shared for marketing.
• We make money one way: the optional subscription.
• You can export your library, and delete it — or the whole account — from inside the app. What outlives a deletion is listed under How long we keep it.

What we collect

Your account

Creating an account stores three things: the username you chose, a public key used to verify that a sign-in request really comes from you, and one encrypted key blob for each way you can open the account (your password, and a recovery code if you made one). The blobs are locked with a key derived from your password or recovery code on your device — they are useless to us and to anyone who obtains them.

We do not collect an email address, a phone number, a name, or any other identifier when you create an account. If you never write to us and never subscribe, the account itself holds nothing that names you — what remains is the ordinary request data described under Technical and security data below, which we do not join to your account.

Signing in creates a session record — a hashed token, the account it belongs to, and timestamps — so your device stays signed in and you can sign other devices out.

Your library

Each saved link, list, tag, and setting is stored as its own encrypted file. For each one we hold the file’s path, its size in bytes, and when it last changed — the minimum needed to sync your devices. We hold no titles, no web addresses, no tags, no notes, and no index over any of it, because none of that exists in a readable form on our side.

If you subscribe

Payments are processed by Paddle for web purchases and by Apple or Google for purchases made inside the apps. They collect and hold your payment details under their own privacy policies; we never receive or store your card number.

What we store is a subscription record: the provider, that provider’s identifier for your subscription and customer, the plan, its status, and the dates it runs between. It is linked to your account so the app knows which features to unlock.

Subscribing is the one thing in Bracemark that attaches a real identity to you, and we would rather state it than let you find it at checkout. Charging a card requires a name, an email address, and payment details, which the provider collects and holds; the record above is the link between that customer and your account. It costs you anonymity, not confidentiality — your library is encrypted exactly as before, so we can tell that an account pays and still cannot read anything in it. The free plan requires no payment, so none of this arises.

Technical and security data

Our infrastructure processes ordinary request data — including your IP address, the time of the request and your user agent — as any web service must in order to answer it. We use it to keep the service running and to apply rate limits against abuse, and we do not use it to build a profile of you or to track you between visits.

That data lives in Cloudflare’s and Amazon Web Services’ own logs, under their retention periods rather than any we set, and we read it to diagnose a fault or an attack. We run no analytics over it, we do not join it to your account, and we keep no separate copy of our own.

Two of the choices that decide what reaches those logs are ours rather than theirs, and we have made both the same way. Neither of the two services we run on Cloudflare is set to forward its request log to another destination, which would put a copy of that stream in someone else’s storage under a retention period of its own. And one of the two, the link-preview service — the one part of Bracemark that is ever handed the address of a page you saved — runs with the log that would record its request line switched off. Both are settings in the configuration files in github.com/stxapps/bracemark-monorepo, with the reasoning written out beside them.

Our API — the service behind sign-in, sync, and billing — runs with that log on, so the address of every request it receives is recorded alongside the request data above. None of those addresses contains your username. A request that has to name an account — checking whether a username is free or the first step of signing in — sends the username in the body of the request instead, and once you are signed in a request identifies you with a session token. The API also writes lines of its own to that log, most of them when something fails. Some include our internal identifier for the account or the payment provider’s identifier for the purchase involved — not your username. We read them to find a fault.

The web app’s own address can carry something you typed. A search is kept in that address, so that it survives a reload and the back button. Loading that address sends the words you searched for to Amazon Web Services, the provider that serves the app’s files, as part of the request data above, and so can any other request the app makes for its own files while that address is open. We keep no copy of them, and the search itself runs on your device.

What Apple and Google tell us

As the publisher of the mobile apps we can see the figures Apple and Google compile for us: installs, which versions are in use, and the crash and performance reports their operating systems collect. They arrive as counts and anonymous reports — they carry no account, and we cannot connect one to a person. Neither app ships an analytics or crash-reporting library of ours.

How link previews are fetched

The browser extension reads the live tab and tries to fill in its title and preview image every time you save. The mobile apps fetch pages themselves: by default they cover links saved on that device, and the All links setting also covers links synced from another device or added by import as they come into view. With All links selected, Generate all works through every pending link. Neither path involves our servers. The browser extension asks for the narrowest permission that does its job: it can read a tab only in the moment you click to save it, and it holds no standing access to your browsing. Its background service talks only to our API; during the save, code in that tab may fetch the preview image named by the page.

Browsers do not allow one web page to fetch another site, so the web app has an opt-in Plus setting that lets our link-preview service do it. It is off unless you turn it on. When it is on, newly saved links and older pending links are sent as they come into view while you browse; Generate all sends every pending link. The service receives the address, fetches the page, returns the title and preview image, and keeps no page data: it stores no URLs, writes none to its logs, holds no key, and is not told which account asked. Its rate limiter briefly holds the requesting IP address so that a single source cannot abuse it. The same service is described from the other side — for the people who run the sites it fetches — on its own page, including the caps it holds itself to and how to turn it away.

If you contact us

When you email support we receive your message, your email address, and whatever you choose to put in it. We keep the correspondence so we can follow up. We use it to answer you, and to learn what is unclear or broken: a question more than one person asks becomes a help page or a fix.

What we keep for that second use is the question in our own words — not your name, your email address, your username, or what you wrote word for word. We never publish your message or quote you without asking first.

An AI model may help us read support email and draft replies. The company that runs the model processes your message on our behalf, as our other providers do. A person at Bracemark reads every message and writes or approves every reply we send.

Your library can hold whatever you want it to, and we cannot see it — that is the point. A support email is different: it reaches our mailbox, and any model that helps us answer it, in readable form. Please leave out anything you would rather we did not hold. And never send us your password or your recovery code: nobody at Bracemark will ever ask you for either, and either one would open your library.

Cookies and on-device storage

Bracemark sets no cookies of its own, and loads no third-party code except in one place, described below; the fonts come from us rather than from a font provider. There is no cookie banner on this website because there is nothing to ask you about — we set nothing that needs your consent.

That one place: opening Settings → Subscription loads Paddle’s script, so it can look up the price in your local currency, and again to run the checkout if you go on to subscribe. Paddle sets its own cookies to do that, under its privacy policy — they are the only cookies you will get from Bracemark. Nothing else in Bracemark loads code from another origin.

The app stores data in your browser or device — your library, your session, and your preferences — using local storage and IndexedDB. That is what makes it work offline. It stays on your device, is not readable by us, and is cleared when you sign out or clear your browser data.

How we use what we collect

• To provide the service: authenticate you, sync your encrypted files, unlock the plan you paid for.
• To keep it running and safe: diagnose faults, prevent abuse, enforce rate limits.
• To answer you when you write to us, and to turn the questions people ask into help pages and fixes — keeping the question, not who asked it.
• To meet legal, tax, and accounting obligations.

We do not use your information for advertising, we do not sell or rent it, and we do not share it for anyone else’s marketing. There is no automated decision-making that produces legal effects for you.

Our legal bases

Where the GDPR, the UK GDPR, or Thailand’s PDPA applies, we have to name the legal basis for each use rather than just describe it. Ours are:

• Performing our contract with you — the account record, the session that keeps you signed in, the encrypted files we sync between your devices, and the subscription record that unlocks what you paid for.
• Our legitimate interests — keeping the service up and abuse off it: answering requests, applying rate limits, diagnosing faults. The interest is running a service that works; the data involved is what any web server handles to reply at all. The same interest covers working out, from the questions people send us, which parts of Bracemark need fixing or explaining better.
• Your consent — the one optional thing, the Plus setting that lets our link-preview service fetch a page for you. It is off until you turn it on, and turning it off again withdraws that consent for everything after.
• A legal obligation — the payment and tax records that accounting law requires us to keep.

Who else processes it

We use a small number of providers to run the service. They act on our instructions and receive only what their function requires.

• Cloudflare — hosts the API and the link-preview service. It stores the encrypted files and the account records.
• Amazon Web Services — serves this website and the web app as static files.
• Paddle — sells and processes web subscriptions as merchant of record, including tax.
• Apple and Google — distribute the mobile apps and process any subscription bought inside them.
• Namecheap (Private Email) — hosts the mailbox that receives your support email.
• An AI model provider — runs the model that helps us read support email and draft replies to it.

Beyond these, we disclose information only where we are legally required to — in response to a valid legal request — or where it is necessary to protect our rights or someone’s safety. What we can disclose is bounded by what we hold: encrypted files we cannot decrypt, and the account record described above. If we are ever part of a merger or sale of assets, this policy travels with the data and you will be told before it moves.

Where your data is

We are established in Thailand and the providers above operate globally, so your encrypted files and account records are stored and processed in countries other than the one you live in, including the United States. Which countries depends on which provider, and what each of them holds is the line beside its name above. The backup copies we keep outside Cloudflare are held by us, not by a provider.

How long we keep it

• Your account and library — until you delete them. Deleting all data wipes the stored files; deleting your account also destroys the encrypted key blobs, and their backup copies follow within 30 days. After that, nothing could open the data even if a copy survived.
• Backups — up to 30 days. Cloudflare keeps a rolling history of our databases, and we keep our own encrypted copies of your files and account records outside Cloudflare. Neither reaches back further than that, so anything you delete is gone from both within the same window.
• Sessions — while the device stays signed in, then for a yearafter it is signed out or its session expires, so a device that connects late can still be told whether to erase its copy.
• Subscription records — for as long as the subscription is live, and afterwards for as long as tax and accounting law requires.
• Support email — until it is no longer useful for supporting you. The questions we paraphrase from it for help pages and fixes carry no name, email address, or username, and we keep those.
• Infrastructure logs — for the short window our providers keep them, after which they age out on their side. We keep no copy.
• Abandoned accounts — we reserve the right to delete data for an account unused for two or more years, rather than hold it indefinitely.

Deleted usernames are retired rather than released, so nobody can register a name and be mistaken for its previous owner.

Your rights

Depending on where you live, you may have rights to access, correct, delete, restrict, or port your personal data, and to object to processing. Most of them you can exercise yourself, immediately, without asking us:

• Access and portability — Settings → Data → Export all data, which gives you your whole library in open formats. A list you have locked is left out of the file until you unlock it.
• Correction — edit anything in the app; it is your data on your device.
• Erasure — Settings → Data deletes your library; Settings → Account deletes the account itself.
• Withdrawing consent — the only thing you consented to is server previews, and Settings → Link previews switches them back off.

For anything else — restricting or objecting to a use, asking us to reconsider a refusal, or complaining about how we have handled your data — write to support@bracemark.com. You also have the right to complain to your local data protection authority. Note that we cannot help you reach the contents of your library: we have no key, so that is a request only you can fulfil.

One consequence of collecting nothing: we have no email address or identity document to check a request against, so your account is the proof. Signing in and using Settings answers an access or erasure request immediately and more completely than we could. If you write to us instead, we may have to ask you to prove control of the account before we act, and we will say so rather than act on a name alone.

If you are in the EEA or the UK

STX Apps Co., Ltd. is the controller, and the legal bases we rely on are listed above. Beyond the rights already described, you may ask us to restrict a use, object to any use we base on a legitimate interest, and withdraw a consent you have given — withdrawing it does not undo what was done while it stood. We make no decisions about you by automated means.

Your data does leave Europe — see Where your data is above. Where a transfer out of the EEA or the UK needs a safeguard, our providers rely on the European Commission’s standard contractual clauses, the UK addendum to them, or an equivalent mechanism. You can complain to the data protection authority where you live — in the UK, the Information Commissioner’s Office — though we would rather you wrote to us first.

If you are in Thailand

We are a Thai company, so the Personal Data Protection Act applies to us directly. It gives you rights of access, correction, erasure, restriction, portability, objection, and withdrawal of consent — the same set described above, exercised the same way. If we have not put something right, you can complain to the Office of the Personal Data Protection Committee.

If you are in the United States

Several states give their residents privacy rights, and the three practices those laws are most concerned with simply do not happen here. We do not sell your personal information, we do not share it for cross-context behavioural advertising, and we do not profile you — not for advertising, and not for any decision that affects you. That has been true for every one of the last twelve months, and there is no revenue model here that would make it stop being true.

Where your state grants them, you have the right to know what we hold, to receive a copy, to correct it, to delete it, and to appeal if we refuse. Ask at support@bracemark.com, or use the in-app tools above, which are faster. Exercising a right never costs you service, features, or a worse price.

Some browsers send a Do Not Track or Global Privacy Control signal. There is nothing here for one to switch off — no tracking, no sale, no sharing — so we treat any such signal as already satisfied. California residents may also ask, under the Shine the Light law, what personal information we disclosed to third parties for those parties’ own direct marketing: the answer is none, and it is none every year.

Security

Your library is encrypted on your device with AES-256-GCM, under a random key that your password unlocks via Argon2id; connections use TLS; and the keys that open your account are stored only in a form that your password or recovery code can unlock. No system is perfectly secure, and we do not claim otherwise — but the design limits what a breach of ours could reveal: your library would be ciphertext, and the account around it holds no name, email address, or payment details. Email you send to support is the exception, and If you contact us above says what it holds.

The code behind all of this is public, at github.com/stxapps/bracemark-monorepo under the AGPL-3.0 — so the claims on this page can be read against the software that makes them, rather than taken on our word. Reading the source shows what the code does; it does not by itself prove which build you were served, which would need reproducible builds we do not publish yet.

If a breach ever affects personal data we hold, we will tell the people affected and the regulators that require telling, within the time the applicable law sets. What such a notice could say is bounded by what we hold: your library would still be ciphertext.

If you believe you have found a vulnerability, please see the support page for how to report it.

Children

Bracemark is not directed at children under 13, and we do not knowingly collect data from them. In the EEA and the UK, where the age of consent for online services is set between 13 and 16 country by country, you need to meet whichever age applies where you live. If you believe a child has created an account, write to us and we will remove it.

Changes to this policy

We may update this policy. The date at the top of the page shows when it last changed, and we will highlight any material change on this website. Continuing to use Bracemark after a change means you accept the updated policy.

Contact

Questions about privacy go to support@bracemark.com, or by post to:

STX Apps Co., Ltd.
ATTN: Bracemark Team
247 Chan 31 Sathon
Bangkok 10120
Thailand