Privacy Policy

Last updated: October 17, 2026

This Privacy Policy explains how Pinport (“we”, “us”, “our”) collects, uses, and protects your personal data when you use our website, browser extensions, and mobile apps, including when you connect AI assistants and other applications to your account (collectively the “Service”).

1. Data Controller

binked UG (haftungsbeschränkt)
Zugmantelstr. 34b
65510 Idstein
Germany
Represented by the Managing Director: Kevin Simon Schmidt
Register court: Amtsgericht Wiesbaden, HRB 36874
Email: contact@pinport.app

2. Data We Collect

2.1. Account Information

When you create an account, we may collect:

  • Email address
  • Name or display name (for example from Google or Apple)
  • Authentication metadata provided by Firebase Auth
  • Hashed password if you register with email and password

2.2. User Content

When you use the Service, we process the data you store in it, including:

  • Bookmarks (URLs, titles, descriptions)
  • Tags
  • Notes and other organizational metadata

This data is used only to provide and improve the Service and to allow you to organize and search your bookmarks.

2.3. Technical Data

When you access the Service, certain technical data is collected automatically, for example:

  • IP address (which may be anonymized or truncated, depending on the tool)
  • Browser type and version
  • Operating system and device information
  • Server logs (such as request URLs, timestamps, and error logs)

2.4. Cookies, Local Storage, and Analytics

The Service may use:

  • Functional cookies or local storage to maintain sessions and UI preferences
  • Google Analytics (GA4) cookies to measure aggregated usage of the Service. These cookies are only set after you provide explicit consent via our cookie banner. You can withdraw consent at any time by clearing site data in your browser.

Google Analytics uses cookies and similar technologies to collect information about how visitors use the Service (such as pages viewed, approximate location, device and browser information). IP addresses are anonymized before processing. We do not load Google Analytics until you accept analytics cookies.

No marketing tracking pixels (for example Meta, Google Ads, LinkedIn, or similar) are used.

2.5. Browser Extensions

The Pinport extension processes your account identifier, email address, access status, and authentication tokens to connect to your account. It sends the bookmarks you choose to save or import, including URLs, titles, notes, and tags, to Pinport. Search queries entered in the extension or after activating its address-bar shortcut are sent to Pinport to return results and suggestions.

Saving a page uses its URL and title. Optional tab access is requested when you use Save page from the side panel. Optional bookmark access is requested when you start a browser import; the extension reads your bookmark tree to prepare a preview and uploads the import only after you confirm it. Folder names become tags. Your original browser bookmarks are not changed or deleted. The extension does not continuously monitor your browsing history or read the contents of unrelated webpages.

The extension stores your theme preference, temporary connection state, and unfinished editor draft locally. Drafts are cleared when saved, cancelled, or the extension is signed out. Firebase Auth maintains the extension's session in local browser storage. The extension does not read your website sign-in cookies; signing out of the website and extension are separate actions.

To provide semantic search, Pinport sends bookmark titles, URLs, notes, tags, and search queries to Google's Gemini service to generate search representations. To display bookmark icons, the extension requests favicons from DuckDuckGo using the saved website's domain name. These icon requests expose your IP address and the requested domain to DuckDuckGo, but do not include your Pinport account details, notes, tags, or the full bookmark URL. Service requests also involve the technical data described above. The packaged extension does not include analytics or advertising tracking scripts.

Pinport's use of information received from Google APIs adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements. Data obtained through the extension is used only to provide or improve its bookmark-management features. It is not sold, used for personalized advertising, or used to determine creditworthiness or for lending. Transfers to service providers are limited to what is necessary for these features and other uses permitted by that policy.

2.6. Saved Pages, Search, and Topics

To make your bookmarks searchable and to sort them into topics, the Service processes them as follows. This happens on our servers; Google, Jina AI, and the Internet Archive receive the data described here from us, not from your browser, and do not receive your account details or email address.

  • Saved pages: Our crawler (PinportBot) fetches the web page at the address of a bookmark, respecting the website's robots.txt, and stores its title, readable text, and status, for example whether the link still works. It checks the link again from time to time. The crawler never uses your login or cookies, so it sees only what the website shows to everyone. If a page cannot be fetched directly, we send its address to the reader service of Jina AI, which fetches the page and returns its text to us. Depending on your plan, page text may not be fetched or only partially processed.
  • Summaries: We send the address, title, and the beginning of the readable text of a fetched page to Google's Gemini service to generate a short summary, which we store with the page.
  • Search representations: We send bookmark titles, URLs, notes, and tags, page summaries, sections of page text, and your search queries to Google's Gemini service to generate search representations (lists of numbers that describe the meaning of a text), which we store to find bookmarks by meaning.
  • Topics: To determine what each bookmark is about, we send its title, web address, and note to Google's Gemini service and store the subject it returns (a few words) with the bookmark. To form and name the topics of a list, we send the subjects of its bookmarks with how many bookmarks have each, some of its titles (and, for some topics, their tags), your current search terms, and the names of topics you picked to Google's Gemini service. Where the subjects do not suffice, we group bookmarks using their stored search representations. We store which subjects form which named topic so that topics stay the same across visits, and delete this record 30 days after it was last used. Other topic names are kept briefly in our servers' memory and are not stored permanently.
  • Archived copies: When you look up an archived copy of a link that no longer works, we send its address to the Internet Archive (Wayback Machine).

Your bookmarks may contain personal data of other people, for example in titles or notes, and saved pages may contain such data too. These are processed as described above only to provide these functions to you.

2.7. Connected AI Assistants and Other Apps

You can connect AI assistants and other applications (“connected apps”) to your account through our MCP server (Model Context Protocol). A connection exists only after you have signed in to Pinport and approved it for a specific app; we never connect an app on our own initiative. When you connect an app, we process:

  • Connection data: the name and identifier of the app, the permissions you granted (reading only, or reading and changing bookmarks), the time you approved the connection and gave the consent described in section 7, and the time the app last renewed its access. Authorization codes and access tokens are stored only as cryptographic hashes.
  • Requests from the app: what the app asks us to do on your behalf, such as a search query, a tag or date filter, or the URL, title, note, and tags of a bookmark to save or change, together with the technical data of the request. For apps that run on their provider's servers, the IP address we receive is that of the provider, not of your device.
  • Data sent to the app: the bookmarks that answer its requests (URLs, titles, your notes and tags, and dates), short excerpts of saved pages in search results, and the list of your tags. A connected app has no access to your account details, password, payment data, API keys, or webhooks.

We do not receive your conversation with an AI assistant, only the individual requests it sends to us. A search by meaning that reaches us through a connected app is processed like any other search: the query is sent to Google's Gemini service to generate a search representation. We do not use requests from connected apps for advertising or profiling.

You can see and end every connection at any time under Settings → Integrations. Ending a connection there revokes the app's access immediately. Removing the connection inside the app ends it only if the app reports the removal to us, so end it in Pinport to be certain. Ending a connection does not delete data the app's provider has already received; see section 5.7.

3. How We Use Your Data

We use your data for the following purposes:

  • To provide, operate, and maintain the Service
  • To make your bookmarks searchable by meaning and page content, and to sort them into topics
  • To authenticate you and manage your account
  • To store and sync your bookmarks and related data across devices
  • To give the apps you connect access to your bookmarks, within the permissions you granted
  • To ensure the security and integrity of the Service
  • To analyze aggregated usage patterns to improve the Service
  • To process payments and manage subscriptions via Paddle

We do not sell your personal data.

4. Legal Bases for Processing (EU/EEA)

If you are located in the EU/EEA, we rely on the following legal bases for processing your personal data:

  • Contract: Processing necessary to provide the Service and fulfill our agreement with you (for example account creation, login, storage of your bookmarks), pursuant to Art. 6 (1) (b) GDPR. This includes giving a connected app access to your bookmarks: you request this function by approving the connection, and we provide it for as long as the connection exists.
  • Legitimate interests: Processing for security, fraud prevention, and improvement of the Service, where our interests are not overridden by your rights.
  • Consent: Loading and use of Google Analytics cookies, as well as the storing of and access to information on your terminal device for non-essential purposes, is based on your consent pursuant to Art. 6 (1) (a) GDPR and § 25 (1) TDDDG (German Telecommunications Digital Services Data Protection Act, formerly TTDSG). You can give or withdraw consent at any time via the cookie banner or by clearing site data in your browser. Loading a YouTube video on our home page is likewise based on your consent, given by pressing play (section 5.9).
  • Explicit consent to transfers: Before you connect an app, we ask for your explicit consent to sending the requested data to the provider of that app, which may process it outside the EU/EEA (Art. 49 (1) (a) GDPR; see section 7). Without this consent no connection is made. You can withdraw it at any time with effect for the future by ending the connection.
  • Legal obligation: Processing necessary to comply with legal obligations, such as tax or accounting obligations related to payments via Paddle.

5. Third-Party Services

5.1. Google Cloud

We use Google Cloud for hosting, data storage, and server logs. Data may be stored in data centers located in the United States.

5.2. Firebase Auth

Firebase Auth is used for authentication, including login, account creation, and password resets. Firebase processes your email and authentication-related data to provide this functionality.

5.3. Paddle (Merchant of Record)

Paddle.com Market Limited and its affiliates ("Paddle") act as the Merchant of Record and authorised reseller for our paid plans. When you subscribe, your purchase agreement is concluded directly with Paddle, and Paddle is the controller of the personal data it collects for that purpose, including payment details, billing address, transaction information, and any required tax information. Paddle processes this data under its own privacy policy and retains it as required for accounting and legal compliance.

For information on how Paddle processes your data, see Paddle's Privacy Notice. We receive only limited transactional data from Paddle (such as subscription status, plan, and identifiers) needed to grant and manage your access to paid features.

The checkout is provided by Paddle and runs in your browser. We load Paddle's checkout script only on pages where you can subscribe or pay, and when you open a payment link from one of Paddle's emails (for example to update a payment method); it is not loaded on the rest of the website. Paddle's script in turn loads a component of Paddle's subscription retention service ("Retain", operated by Paddle's group company ProfitWell). When these scripts load, your browser connects to Paddle's and ProfitWell's servers and transmits your IP address, browser and device information, and the address of the page; Paddle may also store information on your device that it needs to run the checkout and to prevent fraud. This is necessary to provide the checkout you requested (Art. 6 (1) (b) GDPR and § 25 (2) No. 2 TDDDG).

5.4. Google Analytics

We use Google Analytics 4, provided by Google Ireland Limited (with data potentially processed by Google LLC in the United States), to collect aggregated statistics about how the Service is used. Google Analytics sets cookies and may collect data such as your anonymized IP address, device and browser information, referring pages, and pages viewed. IP anonymization is enabled.

Google Analytics is loaded only after you provide consent via our cookie banner. If you decline or do not respond, no Google Analytics cookies are set and no data is sent to Google. You can withdraw consent at any time by clearing site data for this domain in your browser, which will reset your choice and re-display the consent banner on your next visit.

For more information, see Google's privacy policy at https://policies.google.com/privacy.

5.5. Google Gemini, Jina AI, and the Internet Archive

For the functions described in section 2.6, we use the Gemini API of Google, the reader service of Jina AI, and the availability service of the Internet Archive (USA). Google and Jina AI process the data we send them to perform the requested task and return the result to us. Their processing is also governed by their own terms and privacy policies, and data may be processed outside the EU/EEA, including in the United States (see section 7). The legal basis is the performance of our contract with you (Art. 6 (1) (b) GDPR), as these functions are part of the Service.

5.6. Optional Integrations

If you choose to connect external integration services (for example automation tools such as Zapier or Make.com), data is shared with these services only according to your configuration. Their processing of your data is governed by their own privacy policies.

5.7. Providers of Connected Apps

When you connect an AI assistant or another app (see section 2.7), the recipient of your data is the provider of that app, for example Anthropic (Claude) or OpenAI (ChatGPT). You choose the provider; we do not select, recommend, or commission it. We have not engaged the provider, and it does not process data on our behalf or on our instructions. It is responsible for its own processing, which is governed by its own terms and privacy policy.

We have no influence on what the provider does with the data after receiving it, in particular how long it keeps your conversations, whether people review them, and whether it uses them to train AI models. Please check the provider's privacy policy and settings before you connect an app. To have data deleted that a provider has already received, contact that provider.

Your bookmarks may contain personal data of other people, for example in URLs, titles, or your notes. Please connect an app only if you are entitled to share that data with its provider.

5.8. Website Icons (DuckDuckGo)

To show the icon of a saved website next to a bookmark, the website and the browser extension request that icon from the icon service of Duck Duck Go, Inc. (USA), using only the domain name of the saved website. This only happens for bookmarks in your own library: the icons of the example bookmarks on our public pages, and of a few widely used websites, are served by us. Your browser sends these requests directly to DuckDuckGo, which thereby receives your IP address, browser and device information, and the requested domain names. The requests do not include your Pinport account details, notes, tags, or the full address of a bookmark, and we do not store any information on your device for this purpose. The legal basis is our legitimate interest in presenting bookmarks in a recognisable way (Art. 6 (1) (f) GDPR). For how DuckDuckGo handles such requests, see DuckDuckGo's Privacy Policy.

5.9. Videos (YouTube)

Our home page includes a video hosted on YouTube, a service of Google Ireland Limited (with data potentially processed by Google LLC in the United States). Until you press play, the page shows only a preview image served by us, and no data is sent to YouTube. When you press play, your browser loads the video player from YouTube in its privacy-enhanced mode (youtube-nocookie.com). YouTube then receives your IP address, browser and device information, and the address of our page, and may store information on your device (for example cookies or local storage) and process data for its own purposes, including statistics. We have no influence on this processing.

The video loads only when you press play, next to a notice that this loads it from YouTube. The legal basis is your consent given by pressing play (Art. 6 (1) (a) GDPR and § 25 (1) TDDDG). If you do not want this, do not press play; you can withdraw your consent at any time with effect for the future by closing the page and clearing the site data YouTube stored in your browser. For more information, see Google's privacy policy at https://policies.google.com/privacy.

6. Data Retention

We retain data only for as long as necessary for the purposes described in this policy, unless a longer retention period is required or permitted by law.

  • Account and User Content: retained for as long as your account is active. If you delete your account, we will delete or anonymize your personal data, subject to technical and legal constraints.
  • Saved pages: the text, summary, and search representations of a fetched page are stored per web address and can serve every account that saved the same address. They are not linked to your account and may be kept after you delete your bookmark or account. The search representations and subjects of your bookmarks are part of your User Content and kept like it; those of your search queries are not stored. Records of which subjects form which topic are deleted 30 days after they were last used.
  • Connected apps: connection data is deleted as soon as you end the connection, the app reports that you removed it, or you delete your account. Otherwise, an access token expires after one hour, and a connection that the app has not used for 30 days expires by itself. An authorization code expires after two minutes. Expired entries are removed automatically.
  • Unfinished signups: accounts that have never activated a trial or subscription are automatically deleted after 24 hours, without a reminder email. Deletion may be delayed while we verify an in-progress checkout or payment.
  • System logs: typically retained for up to 90 days, unless needed longer for security or legal reasons.
  • Backups: retained for up to 30 days before being overwritten or deleted.
  • Analytics data (via Google Analytics): retained according to Google's data retention settings (by default up to 14 months) and kept in aggregated form.

7. Data Transfers

Because we use services such as Google Cloud and Firebase, your data may be processed in countries outside the EU/EEA, including the United States. The same applies to the connections your browser makes to Paddle and its group company ProfitWell when you use the checkout (section 5.3), to the services described in section 5.5, to DuckDuckGo for website icons (section 5.8), and to YouTube when you play a video (section 5.9). Where required, we rely on appropriate safeguards for such transfers, such as standard contractual clauses or similar mechanisms provided by the relevant service providers.

The provider of an app you connect (section 5.7) may be located, or process data, outside the EU/EEA, for example in the United States. We transmit data to such a provider only because and for as long as you have connected its app. We do not know in every case where a provider processes data or whether an adequacy decision of the European Commission covers it (for example through certification under the EU-U.S. Data Privacy Framework), and we have not agreed safeguards such as standard contractual clauses with these providers. We therefore ask for your explicit consent on the approval screen before every connection (Art. 49 (1) (a) GDPR). The risk you consent to is that the data may not enjoy a level of protection equivalent to that in the EU; in particular, authorities of the recipient country may be able to access it, and you may have no remedies comparable to those under EU law. You can withdraw your consent at any time with effect for the future by ending the connection under Settings → Integrations; this stops all further transfers. If you do not want such a transfer, do not connect the app.

8. Your Rights (EU/EEA)

If you are located in the EU/EEA, you have the following rights regarding your personal data, subject to applicable law:

  • Right of access: request a copy of the personal data we hold about you.
  • Right to rectification: request correction of inaccurate or incomplete data.
  • Right to erasure: request deletion of your personal data, subject to legal retention obligations.
  • Right to restriction of processing: request that we limit processing of your data in certain circumstances.
  • Right to data portability: request a copy of your data in a structured, commonly used, machine-readable format.
  • Right to object: object to certain processing based on legitimate interests.

You can exercise your rights by contacting us at contact@pinport.app. You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state of your habitual residence, place of work, or place of the alleged infringement.

The supervisory authority responsible for us is:

Der Hessische Beauftragte für Datenschutz und Informationsfreiheit
Postfach 3163
65021 Wiesbaden
Germany
Website: https://datenschutz.hessen.de

8a. Automated Decision-Making

We do not use the personal data we collect for automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

9. Security

We take appropriate technical and organizational measures to protect your data, including encryption in transit (HTTPS) and at rest (for example via Google Cloud’s encryption mechanisms). Access to personal data is limited to authorized individuals who need it to operate and improve the Service.

10. Children

The Service is not intended for children under 16 years of age. We do not knowingly collect personal data from children under 16. If you believe that a child has provided us with personal data, please contact us so that we can take appropriate action.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. The updated version will be indicated by an updated “Last updated” date at the top of this page. If changes are material, we may provide additional notice through the Service or by email.