Last updated: 2 September 2026
1. Controller
Nikolaj Andersen, Burkal Kirkevej 46, 6372 Bylderup-Bov, Denmark, andersen.apps@icloud.com, +45 42 32 11 85.
2. Account and saved content
We process your display name, normalized email address, password hash, account status, sessions, CSRF values and hashed API keys. To provide your library, we process the URLs, titles, descriptions, tags, favorites, notes, article copies, images, PDFs and attachments you choose to save.
Your library is not publicly accessible. Other users cannot access it, and stored copies are not shared publicly. We do not routinely inspect library content. We may access it where necessary to respond to your support request, protect the service, investigate misuse or comply with legal obligations.
The legal bases are performance of the service contract under GDPR Article 6(1)(b) and our legitimate interest in secure operation and abuse prevention under Article 6(1)(f).
3. Hosting, logs and cookies
Active data is hosted with OVHcloud on servers in Germany. Technical journal, server, authentication, kernel, firewall and login logs are used only for stability, diagnostics and abuse prevention and are automatically deleted after no more than 14 days. Active application and reverse-proxy log files are additionally limited to 10 MB each.
Necessary session and CSRF cookies protect login and forms. Login and registration CSRF cookies expire after 10 minutes; a signed-in session expires after no more than 30 days. Your analytics choice is stored for up to 180 days.
4. Umami usage statistics
Our self-hosted Umami instance loads only after consent. It processes a shortened page path, time, broad browser, operating-system, device, screen and language categories, and country. An IP address may be used transiently to create an anonymous session and derive country, but Umami does not store it.
We do not send account-related or customer-saved data to Umami: no names, email addresses, account IDs, bookmark IDs, searches, URL parameters, referrers, page titles or saved content. Analytics and session data are automatically deleted after 90 days. The legal basis is consent under Article 6(1)(a). You can withdraw it at any time below or through “Analytics settings” in the footer.
5. Honeybadger error reporting
Only when a technical error occurs, Honeybadger Industries LLC in the United States receives necessary diagnostic metadata such as error type, scrubbed message, stack trace, app version, runtime environment and a normalized page path.
We do not send account-related or customer-saved data: no names, email addresses, account, bookmark or attachment IDs, cookies, sessions, request parameters, headers, searches or saved content. Identifiers in paths are replaced before transmission. Processing is based on our legitimate interest in a secure and stable service. Transfers use Honeybadger's data-processing agreement and EU Standard Contractual Clauses. Error reports are deleted after no more than 15 days and related Insights event data after no more than 7 days.
6. Contact, payment and recipients
Email is handled by the named email provider for requests and contract confirmations.
Payment is still disabled. Lesezeichen stores no card or bank details.
Processors are contractually bound under GDPR Article 28.
7. Retention and Delete your account
Your account and library remain until you delete the account or a mandatory legal period applies. In account settings you can permanently delete your account, sessions, API keys, bookmarks, tags, readable copies, images and attachments. Active data and media files are removed immediately.
Daily database and media backups are deleted automatically after 30 days if a newer, technically verified backup exists. Deletion requests are recorded in a protected ledger outside those backups and automatically reapplied after disaster recovery. Legally required invoice records are kept separately only for the mandatory period.
8. Your rights
Subject to the GDPR, you can request access, correction, deletion, restriction, portability or object to processing. Consent can be withdrawn for the future. Contact andersen.apps@icloud.com. You may complain to Datatilsynet, Carl Jacobsens Vej 35, 2500 Valby, Denmark, or another competent authority.
There is no profiling or automated decision-making with legal or similarly significant effects.