Last updated:
SaltMark is developed and operated by Vitali Rijenco. This notice covers SaltMark Direct, distributed outside the Mac App Store, its license service at licenses.saltmark.xyz, and the website and contact services described below. For Apple purchases and the Store edition, see the Store Privacy Policy.
Application data
SaltMark stores bookmarks in an encrypted vault file on your Mac. Preferences and information needed to reopen recent vaults are stored locally. The app does not send vault contents, passwords or derived unlock secrets to SaltMark. It contains no advertising or tracking analytics and no built-in service for uploading usage activity, diagnostics or device identifiers to SaltMark. SaltMark has no remote access to your vault.
If enabled, Touch ID protects a derived unlock secret in the macOS Keychain; your vault password is not stored there. Supported YubiKey challenge-response operations take place locally. The app writes limited security diagnostics to the Mac's system log; it does not upload those logs itself.
Separately, macOS can send analytics and crash information to Apple according to your system sharing settings. Apple may share relevant reports with app developers if you enable that option. See Apple's Mac analytics controls.
Opening a bookmark passes its URL to your browser or the associated application, which handles the connection to the destination. Copying a link places it on the system clipboard, outside the encrypted vault.
When you ask the Direct edition's Safari extension to save a tab, it passes the tab's URL, title and, when available, eligible icon data already provided by Safari to the local application. The extension does not download remote website icons. This transfer does not pass through a SaltMark server.
Pending Safari save requests are stored in an encrypted local queue outside the vault, protected by a key in macOS Keychain. The app removes queue entries after handoff and rejects requests older than seven days. Expired files may remain until the extension or app next processes the queue.
Supported standalone browser extensions also connect to SaltMark Direct locally and may include optional website icon data. Depending on the browser, these extensions may retrieve icons through the browser's icon service or from an icon's source. An external source receives any network request needed for retrieval.
Direct license activation is checked on your Mac without contacting the license service. A valid key is saved in local app preferences, separate from the encrypted bookmark vault. You can remove that local copy in the app. The key format contains no email address or device identifier. Removing the key from the app does not delete purchase or recovery records held by the online services described below.
Optional backups
Backups are encrypted snapshots, not live synchronization. Automatic backups can also keep encrypted snapshots in local staging while delivery is pending. Folder backups use your chosen location. If you place a vault or backup in a cloud-managed folder, that provider handles its upload and storage. Optional iCloud backups use Apple's iCloud Documents service, associated with your Apple account, under Apple's applicable terms and privacy information. SaltMark does not operate a server that receives these backup files.
Vault files, local settings and user-selected backups remain under your control. SaltMark cannot remotely delete them or recover a lost vault password.
Direct purchases and license records
Before a Direct purchase, the seller, payment provider, their roles and their applicable terms and privacy notices will be identified. In this notice, “payment provider” means a service involved in checkout or payment processing for the relevant purchase, including a reseller or merchant of record where applicable. Current providers and their roles are listed in the Payment providers section below. A test integration is not a completed customer purchase. Product commitments are in the Direct Terms.
The license service receives completed-checkout, refund and dispute notifications and checks relevant orders with the payment provider. It stores selected fields, not complete payment-provider responses or raw webhook bodies:
- Encrypted purchase email and a keyed lookup value used to find its records.
- Order, checkout, transaction, customer and product identifiers.
- Quantity, amount, currency and payment or issuance times.
- Encrypted license key, its identifier and signing-key identifier.
- Event identifiers and fingerprints, processing results and refund/dispute holds.
- One-time purchase-access records, including token hashes, purchase identifiers and access times, retained after access expires to prevent reuse of a return link.
- Temporary verification, recovery-session, request-limit and recovery-progress records.
Payment-provider responses may contain additional information, such as a name or billing country, without those fields being retained in the license database. The service does not collect full card numbers or card security codes. Encrypted and keyed buyer records remain personal data where linkable to a buyer.
These records support payment verification, key issuance, delivery and requested recovery, prevent duplicate issuance or unauthorized access, and help resolve payment problems. Automated payment and security checks can delay delivery or recovery; contact support@saltmark.xyz to request review.
Payment providers
The following list identifies current payment providers, their legal entities and their roles. The provider for your transaction is identified before payment. A listing does not mean that your information is sent to every listed provider.
Creem
- Legal entity: Armitage Labs OÜ, Estonia.
- Commercial role: Merchant of Record and contractual reseller, handling checkout, payment, invoicing and applicable transaction taxes.
- Data role: Controller for its payment and transaction processing; SaltMark is responsible for its own use of the information it receives.
- Status: Current test integration and intended provider for launch; customer purchases are not yet available.
- Documents: Privacy Notice and Buyer Terms.
Email verification and recovery
Initial key delivery uses the signed purchase return link and payment verification; it does not require a separate email-verification step. Email recovery is a separate flow for accessing keys again.
A recovery request looks for records associated with the email entered. If no suitable local record exists, the service may send that email to the relevant payment provider to find a customer record before sending a verification message. After mailbox verification, it can check eligible purchases and create a missing key-issuance record. Recovery requires the relevant purchase information and mailbox verification.
Cloudflare provides the license-service infrastructure: Workers runs the service, D1 stores its records, and Email Service delivers verification messages. Cloudflare processes those records and email-delivery metadata to provide and secure these services. Recovery codes and links expire ten minutes after the request; successful verification grants access for one hour. Verification messages contain a code and link, not the license key. These are service messages, not marketing subscriptions. The requesting IP address is used for abuse prevention and request limits.
License-page cookies and browser storage
The following cookies contain opaque tokens rather than your email or key. They are limited to licenses.saltmark.xyz, sent over HTTPS and unavailable to page JavaScript. They concern website visits, not cookies placed by the native Store or Direct app.
__Host-saltmark-license: verified-purchase key access; one hour.__Host-recovery-session: access after email verification; one hour.__Host-recovery-form: protection against forged recovery submissions; one hour, refreshed when recovery forms or key-list pages are served.__Host-recovery-request: associate code entry with the browser; ten minutes.__Host-recovery-link: carry an emailed link into confirmation; ten minutes.__Host-saltmark-return: temporary purchase-check result when used; ten minutes.saltmark-themein session storage: the theme selected on license pages; browser tab session.
Blocking access/security cookies prevents the associated flow from working. Logging out ends the recovery session. Token expiry does not delete purchase records. A payment provider's checkout has its own cookie information. Cloudflare security cookies are described in the shared website section below.
Retention and deletion
Records linking an email, purchase and key are retained while the associated recovery service is provided, unless a deletion request is fulfilled earlier. Purchase, event and hold records are not automatically deleted when a code or browser session expires. Other payment, event and hold records are retained only while needed to finish or investigate processing, resolve disputes, prevent duplicate issuance or meet applicable legal obligations. This does not make every operational record permanent for the lifetime of a key.
Deleting recovery data does not necessarily delete limited accounting or transaction records that may lawfully need to be retained for tax, audit or dispute purposes. Any such retention must have an applicable lawful basis and be limited to the necessary information and period. A payment provider's contractual requirement does not by itself override your personal-data rights or authorize keeping all recovery records.
Expired verification secrets and recovery progress are cleared by scheduled cleanup. Challenge records become eligible for deletion one day after code expiry once no active session remains; request counters after one day of inactivity. Cleanup runs periodically, so token expiry and record deletion are not simultaneous.
The license Worker's application logs use fixed event/error messages. Invocation logs and traces are disabled and query strings are redacted. Cloudflare can attach operational metadata. Stored Worker logs have a maximum seven-day retention on the paid plan, as described in the Workers Logs documentation. D1 Time Travel can retain earlier database states for up to 30 days on that plan; see the D1 recovery documentation. These windows are separate from email-delivery and security records.
Cloudflare's Email Service event and analytics datasets retain delivery information for 31 days. This can include sender and recipient addresses, subject, message identifier, timestamps, delivery status and error details, used to deliver messages, diagnose failures and prevent abuse. See its email analytics documentation. Sent-message content previews are disabled for our verification-email sending domain. This does not disable delivery metadata or the processing needed to send the message.
Email Service may also retain a recipient address and related suppression information to prevent delivery after failures or spam complaints. Temporary failures normally result in a 24-hour suppression; some permanent failures result in seven days, while complaints, invalid addresses or persistent failures can produce entries without scheduled expiry. Such entries are reviewed separately when handling a request; removing a suppression can permit future sending. See Cloudflare's suppression rules.
To request deletion, write to support@saltmark.xyz from your purchase or test email. We verify mailbox control; if access has been lost, contact us for proportionate alternative verification. The request timing and rights below apply. We explain any lawful retention exception and its duration.
Save your key first. Once its recovery records are deleted, the service cannot restore that key; preserving your copy becomes your responsibility. Deletion does not disable a saved offline key or request a refund. Active database deletion does not immediately remove backup history. Fulfilled deletion requests must be reapplied before restored data returns to normal use.
Payment providers independently control certain payment and transaction records under their own privacy notices. For those records, contact the relevant provider using the notice in the Payment providers section. Neither request automatically deletes the other controller's records. SaltMark remains responsible for the information it controls and for handling requests concerning that information. SaltMark handles its request without requiring proof of the payment provider's deletion and cooperates where required. We cannot set another controller's legal retention obligations. For data processed on SaltMark's behalf, contact SaltMark; using a processor does not transfer our responsibility for handling your request.
A payment provider retaining purchase information may send later events, or a later recovery request may retrieve information again. Receipt alone does not justify retaining or reusing it: SaltMark must handle it consistently with the applicable request and legal obligations. Adding a future payment provider does not automatically transfer earlier buyers' records to it. We will update relevant payment-provider and processing disclosures before using a new route.
Website hosting and security
The main website at saltmark.xyz uses Cloudflare Workers Static Assets. Cloudflare processes IP addresses and request information, such as requested paths, request times, browser information and response status, to deliver pages, diagnose faults and protect the service. These website requests are separate from the native application's local vault processing.
SaltMark does not use advertising trackers or analytics scripts on the main website. Its own page code sets no cookies or persistent browser storage. The interactive bookmark preview keeps demonstration text in temporary browser memory and does not submit it to SaltMark. Refreshing or closing the page clears that text. External links open services with their own policies.
Cloudflare may use security cookies when protection features require them, for example to remember a completed security challenge. Their use depends on the request and enabled protection. See Cloudflare's cookie documentation. License-page storage is listed in the Direct privacy notice.
Operational records are used for delivery, security and troubleshooting, not SaltMark advertising or profiling. Cloudflare Workers Logs has a maximum retention of seven days on the paid Workers plan. For our current website zone, Cloudflare documents a 31-day retention period for the Security Events and Security Analytics datasets. These are separate from Worker application logs; see its security-data retention information. These periods do not cover every internal Cloudflare record. Cloudflare's own processing of network and end-user information is described in its Privacy Policy.
Where provider-managed logs or backup history cannot be selectively erased through our controls, we assess the request, seek provider assistance where needed, and explain any lawful retention or remaining limitations. We do not treat deleting active service records as confirmation that every provider copy has been immediately erased.
Contact correspondence
Contact support@saltmark.xyz about SaltMark purchase or refund problems, Signature activation or recovery, application faults, security or privacy concerns, or your personal-data rights. You may also send feedback or feature requests about SaltMark. See the contact page for the appropriate purchase route.
We receive your email address, any included name, message and attachments to handle that correspondence. We do not use it for advertising or profiling. General technical consulting and help with unrelated products are outside this channel. We do not promise an individual reply to every suggestion or implementation of a requested feature. This does not limit mandatory rights.
In support correspondence, do not send vault passwords, verification codes, encryption keys, YubiKey secrets, a full license key or unencrypted sensitive vault contents. We will not ask for those secrets in email. An order reference is normally sufficient to identify a purchase issue.
Correspondence is hosted by Proton Mail, operated by Proton AG. We retain it while active and for up to 30 days after resolution or our last substantive reply, whichever is later, unless applicable law requires longer retention. Copies in provider backups can remain temporarily after active-mailbox deletion. Proton states that its encrypted offline backups are kept for up to 30 days. See its Mail Privacy Policy.
Providers and international processing
We share information with the providers needed for the services described here and where necessary to comply with law. SaltMark does not sell personal information. SaltMark remains responsible for the processing it controls, including when a provider processes information on its behalf. A provider's terms or privacy notice do not displace our responsibilities or your rights under applicable data-protection law. A provider's independent processing is governed by its own notice and applicable law.
Providers may process information outside your country. Cloudflare operates internationally, including in the United States; its Data Processing Addendum sets out contractual safeguards, including standard contractual clauses for relevant restricted transfers. Proton reports that its Mail servers are in Switzerland, Germany or Norway. Apple's own service processing is explained in its privacy information. These services do not imply that all information stays on your device or within one country.
To request information about the safeguards relevant to SaltMark's processing of your data, contact support@saltmark.xyz.
Purposes and personal-data rights
Where a lawful basis is required, requested services and contractual support rely on performance of the relevant contract. Proportionate service security, troubleshooting and responding to product enquiries rely on legitimate interests. Record keeping required by law relies on the applicable legal obligation. A contract with a service provider is not, by itself, a statutory record-keeping obligation or a separate lawful basis for retaining personal data. Where an optional activity requires consent, that consent must be obtained separately; reading this notice is not consent to unrelated processing.
Depending on applicable law, you may request access, correction, erasure, restriction or portability, object to relevant processing, withdraw consent where processing relies on it, and complain to a competent data-protection authority. To exercise these rights or report a concern about SaltMark's processing of your data, contact support@saltmark.xyz.
We handle personal-data requests without undue delay and within the deadlines required by applicable law. If a legally permitted extension is needed, we will notify you within the applicable deadline and explain the reason. We may request proportionate information to verify your identity. If information must be retained or a request cannot be fulfilled, we explain the reason and applicable complaint options.
Children and changes
SaltMark is a general-purpose productivity product and is not directed to children. We update this notice when relevant practices change. Where the Store application's data practices change, we also reassess its App Privacy disclosures. Changes to a Direct service do not by themselves mean that the Store application has adopted that service.