Plain-language summary. Link Elf stores the account and bookmark information needed to provide your workspace. We do not sell personal data, serve behavioural advertising, or use your bookmark contents for advertising.
1. Who controls your information
Link Elf, the operator of linkelf.app, is responsible for the personal data described in this policy. Privacy questions and requests can be sent to support@linkelf.app.
2. Information we collect
- Account information: your email address, display name, authentication provider, email-verification status, and security settings such as whether multi-factor authentication is enabled.
- Sign-in credentials: your Link Elf password and, when enabled, a one-time multi-factor code are sent to Supabase Auth to verify your sign-in. They are not saved in the extension's local storage.
- Workspace content: boards, categories, bookmarks, bookmark URLs, titles, descriptions, icons, favourites, layout choices, trash items, and public-sharing settings.
- Guest workspace information: a temporary anonymous account identifier and the workspace content you create before registering.
- Technical and security information: session identifiers, IP address and browser/device information processed by our infrastructure providers, security events, rate-limit information, and limited error reports. Link Elf error reports contain an error type, anonymous fingerprint, page path, time, and release identifier—not bookmark contents or passwords.
- Communications: messages you send to support and operational emails such as verification, security, and password-reset messages.
Link Elf never receives your Google password. When you choose Google sign-in, Google provides the basic profile information you approve, normally your name, email address, and profile identifier.
3. How we use information
- Provide, synchronize, restore, and secure your workspace.
- Authenticate you, deliver account emails, support multi-factor authentication, and prevent fraud or abuse.
- Create a read-only public page when you deliberately publish a board.
- Retrieve public website titles, descriptions, and icons when you ask Link Elf to inspect a bookmark URL.
- Provide the browser extension's user-requested page saving and bookmark search features.
- Diagnose failures, maintain availability, respond to support requests, and meet legal obligations.
Browser extension
When you open Save to Link Elf, the extension reads the active page's title and URL to prepare the save form. It uses the browser's temporary active-tab permission; it does not scan your browsing history or monitor pages in the background. The page title and URL are sent to Link Elf only when you choose Save bookmark. The extension also sends the selected category, the site's host name, and display details generated for the bookmark so it can be saved to your workspace.
When you use Open bookmarks, your search text (if entered) and authenticated request are sent to Link Elf so we can find your saved bookmarks. Results include the bookmark details needed to show the matches and their board/category. If you choose a result, the extension opens that saved URL in a new browser tab.
The extension stores its sign-in session and browser preferences locally in extension storage, including your last successful email address, theme, and last-used save category. A short-lived verification proof may also be stored to complete secure sign-in. To verify a browser, the extension opens a protected Link Elf page and returns a one-time proof; it does not copy your website password or website session into the extension.
Chrome Web Store Limited Use disclosure: Link Elf's use and transfer of information received through Chrome extension permissions adheres to the Chrome Web Store User Data Policy, including its Limited Use requirements. Extension data is used only to provide the save and bookmark-search features you request. We do not sell it or use it for advertising.
4. Legal bases
Where the UK GDPR, EU GDPR, or similar law applies, we process account and workspace information because it is necessary to provide the service you request. We process proportionate security, abuse-prevention, and reliability information for our legitimate interests in operating a safe service. We rely on consent where the law requires it, and on legal obligations when we must retain or disclose information.
5. Public boards and third-party links
Boards are private by default. If you publish a board, anyone with its public link can view the board title, description, categories, and bookmarks until you make it private or delete it. Search engines or other people may retain copies after publication. Bookmarks lead to third-party websites governed by their own privacy practices.
When Link Elf retrieves metadata for a bookmark, our server contacts the public website at that URL. The destination site may receive ordinary request information from our hosting infrastructure.
6. Service providers and disclosures
We use specialist providers to operate Link Elf. They process information only for the relevant service, under their own contractual and security obligations:
- Supabase: authentication and database services.
- Vercel: application hosting, delivery, and operational logs.
- Cloudflare Turnstile: bot and abuse prevention.
- Resend: transactional account email delivery.
- Google: optional Google authentication when you choose it.
We may disclose information when required by law, to protect users or the service, or as part of a business reorganization subject to appropriate safeguards. We do not sell or rent personal data.
7. Storage, security, and international transfers
We use encryption in transit, access controls, row-level database isolation, abuse protection, and optional multi-factor authentication. No online service can guarantee absolute security, so you should use a unique password and keep recovery methods secure.
Our providers may process information in countries outside your own. Where required, transfers are protected by recognized safeguards such as adequacy decisions or contractual protections.
8. Retention and deletion
We keep account and workspace data while your account is active. You can remove individual content at any time. You can permanently delete your account from the account panel; this deletes the authentication account and associated workspace data, including public-board records. Export anything you want to keep before deletion.
Limited records may remain temporarily in infrastructure logs, security records, or protected backups according to provider retention cycles, or where retention is legally required. Such residual data is access-restricted and is not used to recreate a deleted account in normal operation.
9. Your choices and rights
Depending on where you live, you may have rights to access, correct, export, erase, restrict, or object to processing of your personal data, and to withdraw consent. Link Elf includes workspace export and account-deletion tools. You can also contact support@linkelf.app. We may need to verify your identity before fulfilling a request.
You may complain to your local data-protection authority. If you are in the European Economic Area, you may contact the supervisory authority in your country of residence, work, or where an alleged infringement occurred.
10. Local storage, cookies, and children
Link Elf uses essential browser storage and authentication cookies or tokens to keep you signed in, remember security choices, and preserve the workspace experience. The browser extension uses its own browser-managed storage for its sign-in session and the preferences described in the Browser extension section. We do not currently use advertising cookies or cross-site behavioural advertising.
Link Elf is not directed to children under 16. If you believe a child has provided personal data without appropriate authorization, contact us so we can investigate and delete it.
11. Changes to this policy
We may update this policy as Link Elf changes. We will update the date above and provide additional notice when a change materially affects your rights or how personal data is used.