Privacy Policy

mynav.top and the MyNav Chrome extension are operated by JinQipan (an individual). For the account and content data described here, JinQipan is the data controller under the EU and UK General Data Protection Regulation, and the personal information handler under China's Personal Information Protection Law.

Contact: [email protected]. This is the single entry point for privacy requests — please write from the address on the account so we can verify ownership.

Payments are handled by Waffo Pancake, which acts as merchant of record. For card details and the tax records that go with a purchase, Waffo is the controller — see its own privacy policy. We receive only your plan, subscription status, renewal date and a subscription identifier.

• Account data. Your email address, an optional display name, and a bcrypt hash of your password. We never store the password itself, and we cannot recover it — a reset only replaces it.
• Your content. Bookmarks (URL, title, icon address), text notes you save, folder names, the order you arranged them in, and your search engine preferences.
• Session data. A random session token, stored only as a SHA-256 hash, plus its expiry, the user agent and the IP address that created it. This is what lets you review active devices and lets us end a session that looks stolen.
• Security data. IP address and email address used for rate limiting, and counters of password reset attempts. Reset codes are stored as hashes and expire in 10 minutes.
• Billing data. Plan, subscription status, renewal date, and the identifier Waffo returns for the subscription. Card numbers never reach us.
• Technical logs. Request paths, status codes and timings kept briefly by our hosting provider so we can diagnose failures.

• No browsing history. The extension reads the tab you are looking at only when you explicitly save it.
• No advertising identifiers and no data brokers. We do not sell, rent or share personal information for cross-context behavioural advertising.
• No content of pages you did not save. When we fetch a title and icon, we do it server-side for the single URL you submitted.
• No marketing email. We send transactional messages only: password resets and billing notices.

We set exactly one cookie, and it is strictly necessary:

• mynav_session — an httpOnly, SameSite=Lax cookie holding your session token. It lasts 30 days, or ends the moment you sign out.

• Browser local storage keeps your language choice and, for visitors, the search engine you last picked. It never contains your bookmarks.
• The extension keeps your long-lived API token in chrome.storage.local, on your machine only.

Because there are no analytics, advertising or third-party cookies, you will not see a cookie banner. If that ever changes, we will ask for consent first and update this page.

The extension asks for the smallest set of permissions that lets it save a page when you tell it to. Chrome shows these warnings at install time, so here is what each one is for:

• storage — keep your API token and a short offline queue so a save is not lost when the network drops.
• contextMenus — add “Save link” and “Save selected text” to the right-click menu.
• activeTab — read the current tab's address, title and selected text, and only after you invoke the extension.
• scripting — read the current selection when you use the keyboard shortcut. It is not a persistent content script.
• bookmarks — read your Chrome bookmark tree, and only when you start an import so we can show a preview first.

The extension does not run on pages you have not acted on, and does not report where you browse. When you save a link, only that URL is sent to our server.

• To run the service — store and display your bookmarks, authenticate you, sync between the web app and the extension. Legal basis: performance of our contract with you.
• To keep accounts secure — rate limiting, revoking every session after a password change, detecting abuse. Legal basis: our legitimate interest in a service that is not trivially taken over.
• To bill you — create and update subscriptions, reflect plan changes, keep invoices available. Legal basis: contract, and legal obligation for tax records.
• To fix the product — error monitoring that records failures and timings without the content of your bookmarks. Legal basis: legitimate interest.

We do not profile you, and we do not make automated decisions that have legal or similarly significant effects on you.

We use a small number of processors. Each is bound by a data processing agreement and may only act on our instructions.

We may also disclose data where the law requires it, or to protect the rights and safety of users, and we will tell you unless we are legally barred from doing so.

Our database and serverless functions run in Ohio, USA, while static content is delivered from a global CDN. Where personal data leaves the EEA or the UK, the transfer relies on Standard Contractual Clauses or an adequacy decision. Note also that transactional email is delivered through Alibaba Cloud Mail, whose servers are located in mainland China: your email address and the body of the message (codes, account notices) therefore pass through servers in China, likewise under Standard Contractual Clauses when sent from the EEA or the UK. Ask us and we will tell you which safeguard applies to a specific provider.

• Account and content — while your account exists.
• Session records — 30 days from creation, or immediately when you sign out.
• Password reset codes — 10 minutes, then deleted. Attempt counters are kept 30 days.
• Billing records — as long as tax law requires, typically 7 to 10 years. These contain payment metadata, never your bookmarks.
• Deleted accounts — removed from the live database immediately and purged from backups within 30 days.

• TLS on every request, with HSTS enabled.
• Passwords hashed with bcrypt at cost 12. Session and extension tokens stored as hashes, so a database leak does not hand anyone a working session.
• Changing your password bumps a session version, which invalidates every device at once — including a device someone else is holding.
• Least-privilege access to production. Secrets live in the hosting provider's encrypted environment, never in the repository.

No system is perfect. If a breach affects your personal data, we will notify you and the competent authority within the deadlines the law sets.

If you are in the EEA, the UK, Switzerland, California, or another jurisdiction with comparable law, you can:

• access a copy of your data — Settings → Data → Export gives you a machine-readable file
• correct your email, display name or password
• delete your account and everything in it
• object to processing based on legitimate interests, or ask us to restrict it
• port your bookmarks to another service using the same export
• complain to your local data protection authority

Write to [email protected] from the address on the account and we answer within 30 days. For deletion we may first ask you to confirm control of that mailbox, so that a borrowed session cannot wipe an account.

We do not sell or share personal information as California law defines those terms, so there is nothing to opt out of.

Settings → Account → Delete account removes your bookmarks, folders, notes, custom search engines and sessions. The live database is cleaned immediately and backups rotate out within 30 days.

If you cannot sign in, write to [email protected] and we will verify ownership another way. A Pro subscription should be cancelled as well — deleting the account does not by itself stop a renewal that Waffo already scheduled.

MyNav is not intended for children under 16. We do not knowingly collect their data. If you believe a child has created an account, contact us and we will remove it.

When this policy changes we update the date at the top. Material changes — a new category of data, or a new processor used for a different purpose — are announced in the app or by email at least 14 days before they take effect.

For privacy, account or billing questions, write to [email protected]. We route each request to the right place.

Data controller: JinQipan (an individual). Place of residence: 中华人民共和国浙江省温州市. This is a small project maintained by an independent developer, so please allow a few business days.