Leggi in italiano

Privacy policy

Last updated: 28 October 2026

Windyn is a browser extension that keeps your bookmarks and syncs them across your browsers, together with this website. This policy explains which personal data Windyn handles, why, and what you can do about it.

Who is responsible

The controller of your personal data is . For anything about your data, write to .

Without an account (guest mode)

In guest mode Windyn keeps your bookmarks in a file, inside a folder of your computer that you choose. Nothing is sent to us: we don’t receive your bookmarks, and we don’t know you use Windyn.

With an account

To sync your bookmarks, Windyn keeps them on our servers. We handle:

• Account data: your email address and password. The password is stored only as a one-way cryptographic hash, never in readable form. If you sign in with Google, we also receive from Google your Google account ID, your email address and, if your Google profile has them, your name and the address of your profile picture. We also keep the language of Windyn’s interface, to write our emails in it.
• Your bookmarks: folders, titles, web addresses, notes, their order and the dates you created, changed or deleted them. Deleted items stay in the trash for 30 days, then they are erased.
• Openings from Windyn: how many times, and when last, you opened each bookmark from Windyn, for the “Most visited” list. Windyn doesn’t see the rest of your browsing.
• Sharing: the folders you share, the people you share them with and their roles, invitation links and public links. When you look for someone by email to share a folder with them, addresses without an account are recorded for one hour, only to stop abuse.
• Activity on bookmarks: for each bookmark we record who created it and who made each change, with the title and address they gave it, and who opened it and when. In a folder you share, this lets you follow what the others do (openings by people who follow its public link stay anonymous to you), and lets us act on whoever wrote a bookmark if it is reported. When you report a bookmark while signed in, we keep which account sent the report, only to stop abuse.
• Security data: the IP address and the browser (user agent) of your sessions, and a record of sign-in events. Our servers also log the requests they receive (IP address, time, address requested); these logs rotate and are overwritten after a short time.

We don’t use your data for advertising, we don’t sell it, and we use no analytics or tracking, neither in the extension nor on this website, which sets no cookies.

What the extension reads in your browser

• The title and address of the current tab, only when you choose to save it (the toolbar button, “Add current tab” or “Save to Windyn…” in the right-click menu), together with any text you have selected then, which becomes the note.
• Your browser’s own bookmarks, only if you choose to import them or to keep Windyn’s browser folders in them: the browser asks for your permission first. Windyn changes only its browser folders there; with an account, what they hold is synced like your other bookmarks. They leave the browser when you sign out or stop guest mode. If you remove Windyn while some are still there, your browser opens a page of this website about them, so that you can delete them. With an account the page lists them, asking our servers with a random code that Windyn gave your browser for this: we keep the code with your account, and it stops working a day after the page first opens. In guest mode we don’t know them, and the page only explains how to delete them.
• In Chrome, Edge, Opera, Brave and Vivaldi the icons of your bookmarks come from the browser’s own cache. In Firefox, and on the pages of shared folders on this website, your browser asks each saved site for its icon (its /favicon.ico) directly: that site sees your IP address, as when you visit it. No other service is involved.

The extension keeps a copy of your bookmarks and your settings in your browser’s storage, so that it also works offline. Signing out removes the copy of your bookmarks from that browser.

Why, and on what legal basis

• To provide the service you asked for: account, sync, sharing, public links and account emails (Art. 6(1)(b) GDPR, performance of a contract).
• To keep the service secure and stop abuse: security data, the anti-bot check, limits on email searches, handling of reports (Art. 6(1)(f) GDPR, our legitimate interest in a safe service).
• To comply with legal obligations, such as answering requests from the authorities (Art. 6(1)(c) GDPR).

We only send the emails the service needs: the codes to confirm your address, to choose a new password and to change your email. No newsletters.

Who else sees your data

• People you share with: the members of a folder see its content and the email addresses of its owner and of the other members, and you see theirs. Whoever opens an invitation link, until it expires, sees the name of the folder and your email address. Whoever has a public link sees the titles and addresses in that folder, never notes or openings. Whoever follows it from Windyn doesn’t see your email address, and you don’t see theirs.
• Our providers, who process data on our behalf under a data processing agreement: for the servers, and for the account emails.
• Google, only if you choose to sign in with Google. Google handles that sign-in under its own privacy policy; it may involve a transfer of data to the United States, covered by the EU-US Data Privacy Framework.
• Cloudflare, for the anti-bot check (Turnstile) shown when you create an account, sign in with a password, ask for a new password or for a new code, or report a bookmark from a public page. To tell people from bots, Cloudflare receives your IP address and technical data about your browser and device, and doesn’t use them for advertising. Cloudflare, Inc. is based in the United States: the transfer is covered by the EU-US Data Privacy Framework.
• Add-on stores (Chrome Web Store, Firefox Add-ons, Microsoft Edge Add-ons, Opera add-ons), which handle installs and updates under their own policies.
• Google Web Risk, only when a bookmark is reported: we send that bookmark’s address to Google to check it against known malware and phishing lists. Not the page’s content, and never for a report about child sexual abuse material. Google, LLC is in the United States, covered by the EU-US Data Privacy Framework.
• Authorities, when the law requires it.

If a provider is outside the European Economic Area, the transfer relies on an adequacy decision of the European Commission or on the standard contractual clauses.

How long we keep it

• Account and bookmarks: until you delete them, or delete your account.
• Trash: 30 days.
• Email addresses looked up without an account: 1 hour.
• Security data and server logs: as long as security needs them, then they are overwritten.
• Database backups: no more than 30 days.

When you delete your account, its data is erased at once, and from the backups as they expire.

Your rights

You can ask to access your data, correct it, erase it, restrict or object to its processing, and receive it in a portable format. You can do much of this yourself in Windyn: edit your bookmarks, export them (menu → Export bookmarks…, as HTML or JSON) and delete your account (Settings → Delete account). For anything else, write to : we answer within one month.

You also have the right to lodge a complaint with a supervisory authority: in Italy the Garante per la protezione dei dati personali (garanteprivacy.it), or the authority of the country where you live or work.

Children

Windyn is not meant for children under 14. Don’t create an account if you are younger, or younger than the age your country requires to use online services on your own.

Security

Connections to our servers are encrypted (HTTPS), and passwords are stored as hashes. When you choose a password, our server checks that it hasn’t appeared in known data breaches, with the Have I Been Pwned service: it sends only the first 5 characters of a hash of the password, never the password itself or your email. Each request is checked against your account and the folders shared with you, and notes never appear in public links. If a breach puts your data at risk, we notify the supervisory authority and, when the law requires it, you.

Google and Chrome Web Store policies

Windyn’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Windyn’s use of the data it handles complies with the Chrome Web Store User Data Policy, including the Limited Use requirements: the data serves only the features described here, never advertising, it is never sold, and nobody reads it, except with your consent (for example when you ask for help), for security reasons or to comply with the law.

Changes

If we change this policy, we update the date at the top; for important changes we tell you in Windyn or by email before they apply.

This policy is available in English and Italian; if they differ, the Italian version prevails.