Neatlink keeps your bookmarks in two places you already control: your browsers, and your own Google Drive. Your bookmarks, folders and favicons are encrypted on your device with AES-GCM-256 before they are uploaded. Neatlink's own server is a small sign-in proxy on Cloudflare that stores no tokens and no bookmark data beyond the encrypted collections you choose to share. This page lists exactly what is stored where, what we ask permission for, and why.
AES-GCM-256, random IV per write, key derived on your device. Never stored, never sent.
Neatlink runs no bookmark storage. The data sits in a hidden app folder in your Google Drive.
The key is derived from your Google account identity. There is nothing on our side that decrypts your data.
Our server exchanges Google's sign-in code for tokens and hands them to your browser. It keeps nothing.
| Data | Where | Encrypted? | Who can read it |
|---|---|---|---|
| Your bookmarks and folders | Each browser's own bookmark store, as always | n/a | You and your browser |
| Bookmarks, folders and favicons | Google Drive, hidden per-app folder (appDataFolder) | Yes, AES-GCM-256 | Neatlink only. Google scopes that hidden folder per application, so no other app, and nobody browsing your Drive, can see or list it |
| HTML backups (weekly, optional) | Google Drive, visible folder "Neatlink Backups" | No, so any browser can import them | You, like any file in your Drive. Switch scheduled backups off in Settings if you prefer not to keep a plain copy |
| Google sign-in tokens | Your browser's extension storage (Keychain on macOS) | On macOS (Keychain) | Your browser profile |
| Shared collections you create | Cloudflare R2 (encrypted) and D1 (title, description, bookmark count, expiry) | Contents yes | Anyone with the link can fetch the encrypted blob; only someone with the key after # in the link can read it |
Browser extensions cannot hold an OAuth client secret, so Google's authorisation code is exchanged for tokens by a Cloudflare Worker at oauth.neatlink.app:
oauth.neatlink.app/auth.oauth.neatlink.app/callback with a one-time code.oauth.neatlink.app/refresh with the refresh token to get a new access token.The Worker has no database for tokens and writes nothing during sign-in; everything else happens between your browser and Google.
Disconnecting Google Drive in Neatlink deletes the tokens from your browser (and the macOS Keychain). There is nothing to delete on our side. To remove Neatlink's authorisation from your Google account entirely, use myaccount.google.com/permissions. To delete the synced data itself, open Google Drive → Settings → Manage apps → Neatlink → Delete hidden app data; the "Neatlink Backups" folder is an ordinary Drive folder you can trash.
https://www.googleapis.com/auth/drive.appdata: the hidden per-app folder for the encrypted sync data.https://www.googleapis.com/auth/drive.file: only files Neatlink itself creates, which is the "Neatlink Backups" folder.openid: your Google user ID, used for key derivation.Neatlink cannot see, list or modify any Drive file it did not create. It does not request your email address, contacts, or full Drive access.
| Permission | Where | Why |
|---|---|---|
| bookmarks | all | Read and mirror your bookmark tree. This is the product. |
| tabs, activeTab | all | Know the page you are bookmarking and open bookmarks in the right tab. |
| storage, alarms | all | Local settings, local cache, scheduled sync. |
| scripting + access to all websites | all | Fetch favicons from the sites you bookmark; detect when you open a neatlink.app/c/ share link so Neatlink can offer one-click import; read and write Neatlink's own settings on neatlink.app. Only a page's icon links are read, never its content. |
| identity | Chrome, Edge | Reserved for Chrome's native sign-in window; not currently exercised. |
| contextMenus | Chrome, Edge, Safari | Right-click actions. |
| sidePanel, favicon | Chrome, Edge | The side panel and Chrome's favicon cache. |
| nativeMessaging | Safari | Talk to the Mac app. |
Firefox asks for the fewest: bookmarks, tabs, activeTab, storage, alarms, scripting and all-sites access. Mozilla also asks every add-on to declare the data it handles; Neatlink declares bookmarks and authentication information, which are the two things above.
Sharing a folder encrypts its contents with a fresh random AES-GCM-256 key and uploads the ciphertext to Cloudflare R2. The key is appended to the link after #, and browsers never send that part to a server, so Neatlink cannot decrypt a shared collection. Stored in plain text for link previews: title, description, bookmark count, expiry, and a hash of the owner's Google user ID. Links expire 30 days after you create them, when the encrypted blob and its metadata are both deleted; you can delete a link earlier from Settings.
The key is part of the link, so treat a share link like a password: anyone you send it to can open the collection. Share pages are excluded from search engines.
The extensions and the Mac app contain no analytics, no crash reporting, no usage pings. The website sets no cookies and runs no analytics.
The extension code you install is readable in your browser's developer tools, and the Mac app is notarized by Apple. If you watch the extension's network traffic you will see googleapis.com (Drive and sign-in), oauth.neatlink.app (the proxy above), the sites you bookmark and google.com/s2/favicons (fetching favicons), and neatlink.app itself. That is the full list.
Email contact@neatlink.app. Neatlink is built by one developer; you will get a reply from the person who wrote the code.