Privacy policy

Webpath SRL, TIN 50429590, with its address in Otopeni, Romania, is the controller of personal data processed to provide the FavLock service. In this policy, “FavLock”, “we”, “us”, and “our” refer to Webpath SRL as the operator of the FavLock website and dashboard.

Privacy questions and data-rights requests can be sent to [email protected].

We receive data directly from you, automatically from your use of the service, and—if you choose Google sign-in—from Google.

Please do not place special-category data or other highly sensitive personal information in URLs, support emails, or other fields unless it is genuinely necessary. URLs can contain personal information in their path or query parameters.

• Contract: to create and operate your account, store and sync your library, provide authentication, and deliver features you request.
• Legitimate interests: to secure and maintain FavLock, prevent abuse, troubleshoot, answer support requests, and understand service reliability. We balance these interests against your rights and expectations.
• Legal obligation: to comply with applicable law, respond to valid legal requests, and establish or defend legal claims.
• Consent: where the law requires it for an optional feature. You may withdraw consent at any time without affecting earlier lawful processing.

Account and service data marked as required is necessary to provide FavLock. Without it, we may not be able to create an account or deliver the requested feature.

We do not use your data for targeted advertising and do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.

Because FavLock does not receive the plain-text encryption key, we ordinarily cannot read, search, classify, or moderate the plain-text contents of protected fields. We still store and process the ciphertext and unencrypted operational metadata, and may delete ciphertext or restrict an account to comply with law, enforce the Terms of Service, or protect the service.

Encryption does not cover everything. We and our service providers can process account details, record identifiers, timestamps, relationships between records, task completion state and due dates, favorites, settings, usage counts, and technical logs. To display a site icon, your browser may send a bookmark’s shortened main domain to DuckDuckGo’s favicon service.

If search history is enabled, FavLock keeps up to 10 encrypted recent searches for autocomplete. Cloud mode synchronizes the encrypted history across devices; Local mode stores it only in the current browser; Off disables and removes it. You can clear browser and cloud history from Settings at any time.

When you submit the dashboard’s web-search form, your query or destination is sent directly by your browser to the search engine or website you choose, regardless of the history mode. Their own privacy terms apply.

We disclose personal data only as needed to:

• use Supabase for authentication, database, realtime sync, and related backend infrastructure;
• use Creem as merchant of record for Pro checkout, payment processing, taxes, receipts, refunds, subscription management, and fraud prevention. Creem processes payment data under its own terms and privacy notice;
• use Google when you choose Google sign-in;
• use DuckDuckGo to request bookmark favicons by main domain;
• use hosting, network, email, and security providers that process data for us under appropriate contractual terms;
• comply with law, protect rights and safety, investigate abuse, or respond to a valid request from a competent authority; or
• support a merger, financing, acquisition, or sale of assets, subject to confidentiality and applicable law.

We do not sell or rent personal data. We also do not share it for cross-context behavioural advertising.

Some providers may process data outside your country or the European Economic Area. Where GDPR transfer restrictions apply, we rely on a valid transfer mechanism such as an adequacy decision or the European Commission’s Standard Contractual Clauses, together with supplementary safeguards where required. You may contact us for more information about the mechanism relevant to your data.

We keep account and saved-library data while your account is active or for as long as needed to provide FavLock. When data is deleted, we remove it from active systems in line with our operational processes; residual copies may remain in protected backups until those backups expire.

Manually deleted bookmarks, documents, tasks, saved articles, and highlights remain as encrypted Trash payloads for 7 days on Free or 30 days on Pro. A bookmark's Trash payload includes its attached encrypted highlights so they can be restored together. Delete forever, Empty Trash, expiry, account deletion, and automated plan-overage cleanup bypass recovery and permanently remove the affected active or Trash records, subject only to protected backup expiry.

Security logs and support communications are kept only as long as reasonably necessary for security, troubleshooting, legal compliance, or the handling of the request. We determine retention using the data’s purpose, sensitivity, legal requirements, and the risk of keeping it.

Library synchronization markers contain resource identifiers, resource types, revision numbers, operation types, and timestamps, but no decrypted library content. They are coalesced by resource and retained for seven days so recently used browsers can update their local cache incrementally. A browser returning after that window rebuilds its local cache from the current encrypted library.

Data stored only in your browser remains there until it expires, you use FavLock’s local privacy controls, you sign out where the app clears it, or you clear your browser data.

Search history is limited to the 10 most recent unique values. Selecting Off or using Clear history removes active browser and cloud copies. Encrypted Cloud history otherwise remains with your account until you clear it or delete the account.

The website remembers that you dismissed its storage notice in local storage. The dashboard also uses browser storage, including IndexedDB, for the optional remembered encryption key, decrypted local library cache, encrypted Local-mode search history, sync state, and settings. These technologies are used to provide functions you request, not to track you across unrelated websites. You can remove local data through FavLock’s privacy controls or your browser settings, but doing so may sign you out, lock encrypted data, or reset preferences.

See the Cookie Policy for details about browser storage and how to manage it.

The Chrome extension holds extracted Reader text only in memory-backed session storage so the reading tab can render it. If you choose Save, the extension transfers the text directly to the FavLock dashboard in your browser, where it is sanitized and encrypted before upload to the database. If you do not save it, it is not uploaded. The extension’s temporary capture is cleared after transfer, when its reading tab closes, or when the browser session ends.

The Firefox extension temporarily holds extracted Reader content in browser session storage to display the reading view. If you choose to save the article, the extension encrypts it before uploading it to FavLock. If you do not save it, the article content is not uploaded. The temporary capture is cleared after saving, when the reading tab closes, or when the browser session ends.

Depending on your location and the circumstances, you may have the right to:

• access your personal data and obtain a copy;
• correct inaccurate or incomplete data;
• ask us to erase data;
• restrict how we use data;
• receive data you provided in a portable format;
• object to processing based on legitimate interests;
• withdraw consent where processing relies on consent; and
• lodge a complaint with your local supervisory authority.

Email [email protected] to exercise a right. We may need to verify your identity. We normally respond within one month under the GDPR, although the period may be extended where the law permits. Rights are not absolute and lawful exceptions may apply.

We use technical and organisational safeguards designed to protect personal data, including encrypted transport, access controls, rate limiting, and client-side encryption for protected bookmark, note, task, and saved-article fields. No online service can guarantee absolute security, so keep your account credentials and FavLock encryption key secure and contact us if you suspect unauthorised access.

FavLock is not directed to children under 16, and we do not knowingly collect their personal data. If you believe a child has provided personal data without the authorisation required in their country, contact us so we can investigate and take appropriate action.

We may update this policy when our service or legal obligations change. We will post the revised version here, change the date at the top, and provide additional notice before a material change where required by law.