WebLibrary has no accounts, no sign-in, no tracking and no ads. Your library never leaves your phone. The only thing that reaches our server is the address of a link at the moment you save it — so its title can be read. That address is not stored.
1. Who we are
WebLibrary is developed by OtunLabs (Zonguldak, Türkiye). Questions: destek@weblibrary.app.
2. Where your data lives
The links you save, along with your tags, notes, open history and everything in the private vault, are held only on your device, in the app's own storage. We hold no copy of this data. Because it doesn't exist on our side, we cannot view, export or hand over your account — there is no account to hand over.
If you uninstall the app or use Android's "clear app data", this data is gone for good. That is why the app provides backup tools.
3. What reaches our server
| Sent | Why, and for how long |
|---|---|
| The address of a link you save | To read the page's title, description and logo. The server opens the page, returns that information to you and stores nothing. The address travels in the request body; had it been in the query string it would have appeared in the web server's access logs. |
| Device-to-device transfer package | Only when you choose "Send to another device". The package is encrypted on your device; the decryption key never reaches the server and travels inside the code shown to you. The server cannot see the contents. The package is deleted once the other device downloads it, and in any case after at most 3 days. |
Nothing else reaches our server. Your whole library, your search queries, which link you opened and when, your notes and everything in the private vault stay on your device.
Technical logs of server access
Our application code keeps no access log. However, like any web host, our infrastructure may keep connection-level technical records (IP address, date, request type). Those records do not contain the addresses you visit or save — we deliberately send the address in the request body, because bodies are not logged.
4. What we don't collect
- No account, email, phone number or name is ever requested.
- No location data.
- No access to contacts, photos or files (other than the backup folder you pick).
- No analytics, telemetry, crash reporting or advertising identifiers.
- No third-party trackers or SDKs. The app contains nothing like Google Analytics or the Facebook SDK.
5. Device permissions and why they're asked for
Camera
Only to scan the QR code during a device-to-device transfer. No camera image is stored or sent anywhere; the scanned code is processed directly in the app. If you decline the permission, you can type the code by hand.
Clipboard
When the app comes to the foreground it checks whether the clipboard holds a link and, if so, offers to save it. The clipboard text is not sent anywhere; only whether it is a link is checked. On Android 12 and later the system shows you a notification whenever an app reads the clipboard — that is where it comes from.
Fingerprint / face recognition
To unlock the private vault, optional. Your biometric data never reaches the app; the system only reports "verified". Your vault password is stored encrypted with a key held in your device's secure hardware and never leaves the device.
Folder selection
To write backups, optional. Only the folder you choose is accessed; no access to the rest of your phone is requested.
6. The private vault
Vault entries are encrypted on your device with a key derived from the master password you choose (PBKDF2-SHA256, 310,000 iterations; AES-256-GCM). The password is stored nowhere and never reaches us.
What follows from this: if you forget your master password, nothing in the vault can be recovered. We cannot recover it either — we cannot send a reset link, because we do not know the password and hold no copy of the data.
7. Backups
Backup files are written wherever you choose: a folder on your device, or an app you send them to through the share menu (Drive, Dropbox, email and so on). These files do not go to our server and we cannot access them. A backup you send to a cloud provider is subject to that provider's privacy policy.
Vault entries inside a backup remain encrypted; the master password is not included. The rest of the library (links, tags, notes) is readable in the backup file.
Android's own automatic backup may copy app data to your Google account. That is a service between you and Google, subject to Google's privacy policy; you can turn it off in your device settings.
8. Chrome extension
The optional WebLibrary Chrome extension notices the sites you visit most and your frequent Google searches, and offers to add them to your bookmarks and WebLibrary. To do so it reads Chrome's most-visited list and your bookmarks, and only if you allow it your browsing history for the last 30 days. All of this happens on your computer: the extension makes no network requests, sends none of this data to us or to any third party, and contains no analytics or ads. Only the addresses you choose to add go to WebLibrary. You can turn the history permission off in the extension's settings at any time, and removing the extension deletes all of its data. It doesn't run in incognito windows.
9. A note about card images
Preview images and site logos on the cards in your library load directly from the sites themselves. This means those sites can see your device's IP address when you open your library. No referrer is sent. We could have hidden this by proxying through our server, but that would mean your data passing through us for every card; direct loading was preferred.
10. Children's privacy
The app is not directed at children under 13 and asks no one for their age. Since we collect personal data from no one, we collect none from children either.
11. Your rights
Your rights of access, rectification and erasure under GDPR and Türkiye's KVKK are in practice satisfied automatically, because we hold no data about you. All of your data is with you; you can export and delete it from within the app. See the data deletion page for details.
12. Changes
If this policy changes, the effective date on this page is updated. If the way the app processes data changes materially, you will be told inside the app.