Privacy

The short version

Shush is local-first and end-to-end encrypted. Your bookmarks are encrypted on your device with your vault password before anything ever leaves it. We cannot read your bookmarks, and we never see your vault password — it's mathematically impossible for us to hand it over, recover it, or reset it for you.

Information we collect

This site only handles your account and subscription, never bookmark data:

• Your name, email address, and profile photo, via Google Sign-In (Firebase Authentication) — we never see or store a password, since you're not creating one with us.
• Subscription status and billing metadata (e.g. plan, renewal date), via Stripe.
• Payment details (card numbers, etc.) go straight to Stripe — we never see or store them.
• If you're on Premium, your encrypted bookmark ciphertext — not the decrypted content — so it can sync across your devices.

We don't run analytics, ad-tracking, or any third-party pixels on this site, so there's nothing else being collected in the background.

How we use it

We use the information above only to:

• Authenticate you and keep you signed in.
• Process payments and manage your subscription.
• Sync your encrypted vault across your devices, if you're on Premium.
• Send essential account, billing, or security notices.

We do not use your information for advertising or profiling, and we do not sell it — see Who we share data with.

Permissions we request

The Shush browser extension asks for the minimum access it needs to work:

• Bookmarks — to read and organize the bookmarks you ask it to encrypt.
• Storage — to keep your encrypted vault on your device.

It does not request access to your browsing history, open tabs, or the content of pages you visit, and it can't read bookmarks it wasn't asked to manage.

Security

• Your vault password never leaves your device — encryption and decryption happen locally, so the plaintext of your bookmarks is never transmitted or stored anywhere we operate.
• All traffic to and from this site is encrypted in transit (HTTPS/TLS).
• Account and billing data lives in Firestore behind security rules scoped to your own account — no account can read another's data.
• Payments are handled entirely by Stripe, a PCI-DSS compliant processor; we never receive or store full card numbers.

Who we share data with

We use two processors to run this site: Firebase / Google Cloud for authentication and the encrypted-data database, and Stripe for payment processing. Both only receive what's described above — never your vault password or decrypted bookmark content. We don't sell data, and we don't run ads or ad-tracking on this site.

Data retention

We keep account and billing data for as long as your account is active, plus any period required for tax or accounting records. If you ask us to delete your account, we remove your data within 30 days, except where we're legally required to keep billing records longer.

Your rights (GDPR / CCPA)

Depending on where you live, you may have the right to:

• Access, correct, or request a copy of the data we hold about you.
• Ask us to delete your account and associated data.
• Object to or restrict certain processing, or withdraw consent.
• If you're a California resident: know what personal information we collect, and request its deletion. We don't sell or share personal information as defined by the CCPA/CPRA, so there's no opt-out needed for that.
• If you're in the EU/UK: lodge a complaint with your local data protection authority. Our legal basis for processing is performing our contract with you (running your account and subscription) and our legitimate interest in keeping the service secure.

To exercise any of these, contact us — see Contact.

International transfers

Our processors (Firebase / Google Cloud and Stripe) may process data in the United States and other countries. Both maintain safeguards for international transfers, such as Standard Contractual Clauses, appropriate to their role as our processors.

Children's privacy

Shush isn't directed at children, and we don't knowingly collect personal information from anyone under 13 (or the minimum age required by your local law). If you believe a child has given us information, contact us and we'll delete it.

Google Sign-In vs. your vault password

Signing in here uses Google Sign-In — we never see or manage a password for your account ourselves. Your vault password is a completely separate thing: it encrypts your bookmarks and never leaves your device. If you forget it, there is no recovery — not by us, not by Google, not by anyone.

Deleting your data

To delete your account and any synced data, email us at support@shushbookmarks.com and we'll remove it. Uninstalling the extension deletes your local, un-synced vault immediately — that data was never on our servers to begin with.

Changes

If this policy changes in a way that matters, we'll update the date at the top of this page.

Contact

Questions about this policy or your data? Email support@shushbookmarks.com.