Privacy

Applies to the Indexarius Chrome extension. Last updated 21 October 2026.

Indexarius runs on your computer. There is no Indexarius server, no account, and no analytics. This page lists everything the extension stores and every situation in which it uses the network, so that you do not have to take that on trust.

What is stored, and where

• Your bookmarks' addresses, titles, the category Indexarius assigned, any details it found (for example a film's year and rating), your tags and notes, and the folder each bookmark was filed into.
• What the on-device model made of each bookmark: a list of numbers that places it among the others, a few keywords, and the topic it belongs to if you grouped one. Topics are found from these on this computer.
• All of it lives in a database inside the extension's own storage in Chrome (IndexedDB). It leaves this computer only in the cases listed under “When the network is used” below, and as folder names if you turn on filing (see “Folders”).
• Keys and sign-ins stay on this computer: Simkl's sign-in tokens are kept in the same database and sent only to Simkl. The encryption key is kept locked by your passphrase in Chrome's extension storage; while you have it unlocked, a copy sits in Chrome's session storage, which lives in memory and is gone when Chrome closes.
• If you turn on Sync with your other computers, your tags, ratings, watched dates, the “seen it before” mark and the categories you chose yourself are copied (nothing else you wrote, such as notes) into Chrome's sync storage, as are the categories you made (their names, descriptions and icons) and the built-in categories you turned off. Chrome sends that to Google under your Google account and to your other computers signed in to the same Chrome profile, as it does with your bookmarks. Each entry is labelled with a one-way fingerprint of the bookmark's address (part of a SHA-256 hash), not the address itself; someone who already has the address can still match it. Each entry also carries when it last changed; a bookmark you remove leaves a short marker (its fingerprint and the time) so your other computers remove it too, and one item records which copy is current. If Chrome sync is off, the copy stays on this computer.
• When a bookmark was categorized like one you categorized by hand, which one, so its details can say why. Bookmarks you categorized by hand teach on this computer; with Sync with your other computers on, the category you chose travels with the bookmark and teaches there too. Private bookmarks never teach.
• Settings live in the same database, and the switches for which services may look up details in Chrome's extension storage, on the same device.
• If you turn on encryption, private bookmarks (see below) are stored encrypted (AES-256-GCM) with a key derived from your passphrase. The passphrase is never stored. There is no recovery without it.
• Removing the extension removes all of this from this computer. If you turned on sync, press Remove synced copy in Settings first to delete the copy in Chrome sync.

When the network is used

• Downloading the on-device model, once. EmbeddingGemma, about 200 MB, from Hugging Face (huggingface.co, which hands the files out from its own content servers under hf.co), kept in the browser cache. Every setup downloads it, whichever way you choose to categorize, because it also spots private bookmarks, finds keywords and groups topics. The request carries no information about you or your bookmarks.
• Other categorization models, only if you choose one in Settings, Model. The decision model (Laya) is a further download of about 520 MB from Hugging Face (huggingface.co/nvkudva/laya-web-q8). Gemini Nano is Chrome's own model: if Chrome does not have it yet, Chrome downloads it from Google itself. Either way your bookmarks are categorized on this computer and nothing about them is sent.
• Your own model, only if you set one in Settings, Model. You can point Indexarius at a server that speaks the OpenAI API: one on your own computer (Ollama, LM Studio, llama.cpp) or a service (OpenAI, OpenRouter and others), with a key if it needs one, which stays on this computer and is sent only to that server. What goes there is decided by you and handled by whoever runs it. A chat model there, used to choose categories, is sent for each bookmark it categorizes: the title, the site's name (never the full address), up to 600 characters of the page's description if page reading is on, your list of categories with their descriptions, and up to three titles from the same site that you categorized by hand. An embedding model there, used in place of the one on your computer, is sent the title, site and description of every bookmark once when you choose it, then of each new one, along with words picked from them and your categories' descriptions. Bookmarks that are private, or not yet checked, are categorized on your computer instead unless you turn on “Send private bookmarks too”, and then only to the chat model. Tags, notes and ratings are never sent. Nothing goes there until you enter both an address and a model.
• Reading a bookmarked page. To find a page's description, Indexarius fetches the bookmarked page: each bookmark you already have when you install it, each new one, one whose title or address you change, every one when you press Categorize everything again, and any that a check at startup finds uncategorized. It is a plain request without your cookies or sign-ins, so a page behind a login gives what a stranger would see. The request goes to that site only, and to wherever that site redirects it if that is a public address; nothing about it is sent to any other service. You can turn this off in setup or in Settings, Privacy, “Read bookmarked pages”; Indexarius then categorizes by title and address alone, which is less accurate. A page on your own computer or local network (localhost, a router, an intranet address) is never fetched, and Chrome refuses a redirect to one at every step, before anything is sent.
• Looking up details, one switch per service in Settings, Data and sync, all off by default. Wikidata for films and series (www.wikidata.org to search by title, query.wikidata.org for the IMDb and TMDb ids and year), Open Library for books (openlibrary.org), GitHub for repositories (api.github.com), and Wikipedia for Wikipedia pages of any kind (the page's own language, such as en.wikipedia.org), which then asks Wikidata (query.wikidata.org) what the page is about and, for a film or series, its IMDb and TMDb ids. Each is sent only what finds the bookmark: the film’s IMDb id or title, the book’s title, the repository’s name, the Wikipedia page’s name, or the Wikidata item that page names (such as Q42); never your name or anything else. What comes back stays on this computer; the addresses of posters and covers in it are kept, not downloaded.
• Sweep, while you have it open. Sweep shows each bookmark's page beside its details, so that you can keep it or move it to Trash. The page loads from its own site as if you opened it, except that it is shown without your cookies or sign-ins and cannot open windows or move Sweep elsewhere. A private bookmark's page loads only when you press Show the page. To say whether a page is gone, Sweep asks the address of the bookmark it shows for its status, a plain request without your cookies that reads no more than the answer; under Pages that don’t load it asks every public bookmark's address not asked in the last week (a day, for one that did not load). Private bookmarks are never asked. The answers stay on this computer.
• Site icons, without the network. The icon beside each bookmark is read from Chrome's own icon cache, the one Chrome fills when you visit a site. Indexarius never asks a site or an icon service for it.
• Simkl sync, off until you connect. If you connect Simkl (api.simkl.com), your film and series bookmarks are sent to Simkl by their IMDb or TMDb id only (never the title; one with neither is not sent), with watched dates and ratings, and those you bookmarked but have not watched are added to your Simkl plan-to-watch list. Simkl's watched list is read to mark them watched here. Nothing is ever removed on Simkl. Nothing goes to Simkl until you connect, and disconnecting stops it.
• Sync with your other computers, off by default. If you turn it on, Chrome carries your tags, ratings, watched dates, chosen categories and the categories you made to your other computers through Google's sync servers, under your Google account. Indexarius sends nothing itself; Chrome does the sending, as it does for your bookmarks. Turning it off on a computer stops it there; Remove synced copy stops it everywhere and deletes the copy.
• Feedback, when you press Send. What you write in Settings, Send feedback goes to Sentry in the EU (ingest.de.sentry.io), where the developer reads it: the kind of feedback you chose, your text, the email address you give for a reply, the Indexarius version, the Chrome version, which categorization engine was active and how many bookmarks you have. No addresses or titles of bookmarks. The form shows all of it before you send, and nothing is sent until you press Send, whether or not crash reports are on.
• Crash reports, off by default. If you turn them on, each error is sent to Sentry in the EU (ingest.de.sentry.io) with its stack trace, the Indexarius version, which part of the extension it happened in (popup, background, setup, Settings or Sweep) and which categorization engine was active. The error's own text is not sent, since it could mention a bookmark's address or title: only what kind of error it was and where in Indexarius's code it happened. Nothing you did before the error is included. Sentry, like any server, sees the IP address a report comes from; each report asks it not to keep that address, but Sentry still records the rough location it points to (country and city). Turning the setting off stops them.

Private bookmarks

Bookmarks about health, money matters, legal matters, identity documents, sex or dating, religion or politics, or job hunting are treated as private: never fetched, never looked up, never sent to Simkl or to your own model unless you allow it, never synced, never moved into folders, and left out of exports unless you include them. In the list they show only under Private, and in search results marked with a lock, so a screen you share of any category shows the rest.

• How Indexarius tells, on this computer only. From the bookmark's address and title, before anything is fetched: a list of known sites, words and phrases (in English, Russian, Ukrainian, Latvian, Portuguese, Spanish, German, French, Italian, Polish, Japanese and Chinese), and a guess by the on-device model already on your computer. In other languages it relies on the sites and the guess, so check what it decided. No page is downloaded to decide, and the decision never leaves the computer.
• What is kept. Only that a bookmark is private, what decided it (its site, its words, the model's guess or you) and whether you confirmed it; never which kind of private matter it is.
• With a passphrase. A private bookmark's address, title, site, details, tags and notes are encrypted. While locked it shows as a lock among the rest, under no category, so nothing on screen says what it is.
• You decide. What Indexarius only guessed at waits under Private in the bookmark list, for you to keep private or not. You can mark any bookmark yourself, keep whole sites always private or never private, or turn spotting off, so only what you mark is private.

What is never done

• No data is sent to Indexarius or to anyone on its behalf. There is nowhere to send it.
• No usage statistics or identifiers are collected. Crash reports are sent only if you turn them on.
• No advertising, no tracking, no third-party scripts, including on this website.

Chrome Web Store User Data Policy

The use of information received from Chrome APIs by Indexarius adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements. Your bookmarks and settings are used only to categorize and file your bookmarks; they are never sold, never used for advertising or credit decisions, and never read by people.

Permissions the extension asks for

• Bookmarks: to read your bookmarks; if you turn filing on, to file them into folders and remove the folders filing has emptied; and, when you ask it to, to remove duplicate copies of a bookmark.
• Storage: for settings, the local database and, if you turn it on, syncing your tags and ratings through Chrome sync.
• Offscreen: to run the on-device model in a background page, since Chrome's service workers cannot.
• Downloads: to save exports (an Indexarius backup in JSON, Obsidian notes as a .zip of Markdown, Letterboxd films as CSV) when you ask for them.
• Favicon: to show each site's icon from Chrome's own cache, with no network request.
• Access to websites: to fetch bookmarked pages for their description, which can be on any site; to download the model from Hugging Face; and to reach the services you turn on (Wikidata, Open Library, GitHub, Wikipedia, Simkl, Sentry). Indexarius does not read pages you merely visit, and injects nothing into them.
• Blocking its own requests (declarativeNetRequest): so Chrome refuses any request of the extension's, redirects included, to an address on your computer or local network; and, in the Sweep tab alone while it is open, so a site's two instructions not to be shown inside another page (X-Frame-Options and Content-Security-Policy) are set aside for the page Sweep shows. It does not touch your own browsing.

Folders

Filing is off until you turn it on. Then bookmarks move into folders named from their category and details (for example Films / 2019 / Drama, Books / Author or, for a topic, Cars / Car repair). Those folders are ordinary Chrome bookmarks: if you use Chrome sync for bookmarks, Chrome sends them, names included, to Google and your other devices, as it does with every bookmark. Private bookmarks are never filed.

A bookmark you move to Trash in Sweep goes into a Trash folder in Other bookmarks, which Indexarius makes the first time, and is still an ordinary bookmark there. It is deleted from Chrome when you empty Trash or, while that setting is on (the default), 30 days after it went in; Put back returns it to the folder it came from. With Chrome sync on, the deletion reaches your other computers as any deleted bookmark does.

Exports

Exports are files you save from Settings, Data and sync; Chrome asks where to put each one. By default they leave out private bookmarks; there is a setting to include them.

Changes and contact

If any of this changes, this page changes first and the date above moves. Questions: indexarius@chislin.com.