Privacy Mode

Privacy Mode encrypts your bookmarks on your device before they reach our servers. We store the encrypted text and can't read it. It is optional, and you can turn it on or off at any time from Settings → Privacy Mode.

Two credentials

• Sign-in (a passkey or an email link) proves who you are to our servers.
• Vault passphrase unlocks your encrypted data. It is used only on your device and never sent to us, so we can't reset it or use it to read your bookmarks.

They are kept separate on purpose. If your sign-in also unlocked your data, our servers would have to take part in making the key, and then we could read your bookmarks.

Setting it up

1. Go to Settings → Privacy Mode (new accounts are asked right after sign-up).
2. Choose a passphrase of at least 12 characters.
3. Save the 24-word recovery kit. Print it or write it down and keep it offline. You must confirm you saved it before you continue.

Bookmarks you saved before turning Privacy Mode on stay unencrypted until you encrypt them. A banner on the web app links to the page that does it; it takes about a minute for most libraries. Collection names are encrypted first, then bookmarks, one page at a time. Keep the tab open while it runs. The browser warns you if you try to leave.

If it stops partway

Closing the tab, losing the connection or the vault locking can stop encrypting, or turning Privacy Mode off, partway. Nothing is lost: every page that was sent is saved whole, and the rest is left as it was. Until you finish, every app shows Finish encrypting your library or Finish turning off Privacy Mode with how many bookmarks and collection names are left.

• On the web, click Finish now. It carries on with only what is left. Not now hides the reminder until you close the browser.
• In the iPhone, iPad and Android apps and the browser extension, Finish on the web opens the web app at the right page. Finishing the job runs on the web for now.
• If the vault locks while it runs, the job pauses. Unlock it and it carries on from where it stopped.
• Only one tab runs the job at a time. A second tab tells you it is already running.

Privacy Mode is optional. While it's off, a banner reminds you about it. If you've decided not to use it, choose Don't remind me on the banner. The choice applies on every device you sign in on, and you can turn the reminder back on in Settings → Privacy Mode.

What is encrypted

Each bookmark's link, title, description, notes, site icon and tags, the names of your collections, and your Start page layout (its widgets, feed addresses and settings). Every collection has its own key, and those keys are protected by your account key, which only your passphrase (or recovery kit) can open.

If a bookmark shows Unverified: stored without encryption, part of it was not encrypted the way your devices save it, so we can't vouch that you wrote it. Open it, check the details and save it to encrypt it again. In the web app, moving it to another collection is blocked until you do.

What our servers can still see

• Your email address, plan, and when you signed in.
• How many bookmarks and collections you have, how collections are nested, which collection each bookmark is in, when bookmarks were added or changed, and whether a bookmark is a favorite or marked to read.
• Site names when your browser loads site icons through our favicon service, and the address of any RSS feed on your Start page each time it loads, because we fetch feeds for you. Our logs keep the site name at most, never the full feed address.
• A link you ask us to look up. With Privacy Mode on, page titles are fetched on your own device instead: by the iOS and Android apps when you share a link to them, and by the browser extension when you add a bookmark in the web app. If that doesn't work (no extension, the extension can't reach the site, or the site doesn't answer), you can click Fetch the page title, and that sends the link to us unencrypted.

Search runs on your device against your decrypted library, so your search terms never reach us.

Unlocking

After you sign in, the vault needs to be unlocked before you can read or save bookmarks. You can:

• Type your passphrase. Every app treats an accented letter the same whether your keyboard sends it as one character or as a letter plus an accent.
• Use a PIN. Once unlocked, set one under Vault lock on the Privacy Mode page. A PIN must be at least 4 characters and only works in the browser where you set it. Five wrong PINs turn PIN unlock off, and you need your passphrase again.
• Use a passkey. Turn on Device unlock in Settings → Security, then choose Unlock with passkey. This needs a browser and passkey that support the WebAuthn PRF extension; the page tells you if yours doesn't.
• Use the browser extension. If the extension is already unlocked, choose Unlock with extension in the web app and approve the request in the extension window.

How long it stays unlocked

Under Vault lock, choose when the vault locks again. The setting applies to the browser you set it in, and the extension has its own copy.

• Every time (always ask)
• After 1 hour, 4 hours, 12 hours, 1 day, 7 days or 30 days of inactivity. 7 days is the default.
• Never (stay unlocked until sign-out)

While unlocked, the key is kept on your device, protected by a separate key the browser will not let any script copy out. Lock now or signing out removes it straight away. Pick a shorter setting on a shared computer.

Changing your passphrase

While unlocked, click Change passphrase on the Privacy Mode page. Your bookmarks are not re-encrypted; only the lock on your account key changes. If the change fails partway, your old passphrase keeps working.

If you forget your passphrase

On the locked Privacy Mode page, choose Recover with recovery kit, enter the 24 words in order, and set a new passphrase. You can print a fresh kit any time from the unlocked Privacy Mode page with Regenerate & print recovery kit; the old words stop working straight away.

If you lose both the passphrase and the recovery kit, your encrypted bookmarks can't be recovered by you or by us.

Turning Privacy Mode off

On the unlocked Privacy Mode page, click Turn off Privacy Mode. Your browser decrypts every bookmark, collection name and your Start page layout and stores them unencrypted on our servers. If any bookmark or the layout can't be decrypted, nothing is changed; reset the Start page layout in Settings → Start page if it is the one that won't open. Your vault key is deleted only once nothing is left encrypted, so stopping partway never locks you out of the rest. Turning it back on later means choosing a new passphrase.