This policy is for this sbm Sync server, the sbm app for Android and the
sbm add-on for Firefox and Chrome.
What the server keeps, and why
Your email address and a bcrypt hash of your password, never the password itself: to sign you in.
When this server checks email addresses, it also sends you an email with a link that confirms your address.
Your bookmark file, the last 50 versions that your devices sent: to sync your devices.
A hash of the sign-in token of each device: to know your devices.
When you subscribe: your Stripe customer ID and the state of your subscription: to bill you.
When you follow feeds: the addresses of the feeds, the items that the server fetched from them, and
the addresses of the feeds that the server found on your bookmarked pages when you asked it to look:
to show you the items, and to send you the new ones by email once a day, unless you turn that off on the feed page.
The server does not sell or share this data, and does not use it for ads.
There are no analytics and no trackers. The only cookie keeps you signed in.
Data goes to and from the server over HTTPS. On the server it is not
encrypted: the operator of the server can read it.
Payments
Stripe takes the payments. This server never sees your card. See the
Stripe privacy policy.
Delete your data
Delete your account on the account page. The
server deletes the account and all versions of your bookmark file at once.
The app and the add-on
They keep your bookmarks on your device. They send them only to the sync
server that you sign in to, and only after you sign in. Without an account,
no data leaves your device.
