Security & privacy

Privacy is a core design goal of mnera.io. By building on the Solid protocol, the app is architecturally prevented from accessing your bookmark data without your permission.

What mnera.io can access

• Your WebID — a public URL that identifies you on the Solid web
• The /bookmarks/ directory in your pod. mnera.io writes one Turtle file per collection there — resource.ttl for the default collection, <slug>.ttl for each named collection you create — plus an index.ttl that lists them.
• Only content you explicitly save through the app

What mnera.io cannot access

• Other files in your pod
• Your browsing history or any other browser data
• Any content outside the /bookmarks/ directory

What mnera.io stores on its servers

Bookmark data — mnera.io never copies or stores your bookmarks. All bookmark reads and writes go directly from your browser to your Solid pod. The mnera.io server only serves the app's code.

mnera.io account data — if you create a free mnera.io account, mnera.io stores your email address, a hashed password, and your UI preferences (theme, language, font size, sort order) in a secure database. This data is separate from your bookmarks and is not linked to your Solid pod identity unless you explicitly link them. You can delete your mnera.io account at any time from the account settings page.

End-to-end encryption (optional)

By default, anyone who can read your /bookmarks/ directory — including the pod host — can read your bookmark titles, URLs, descriptions, and topic tree. If you want to hide that content from the pod host as well as from mnera.io, switch on Encrypt my data on this pod in Account settings.

Encryption happens in your browser before any file leaves your device. The pod stores AES-256-GCM ciphertext; the encryption key is held only by your browser session and is wrapped on the pod inside a small /bookmarks/.keystore file, encrypted under a passphrase only you know. mnera.io never sees your passphrase, and neither does the pod host. Powered by the open-source solid-crypt library.

What to know before turning it on

• If you forget your passphrase, your bookmarks are gone. There is no recovery — that's the point of end-to-end encryption. Keep your passphrase somewhere safe (a password manager works well).
• It applies to the currently signed-in pod only. If you have multiple Solid pods linked to the same mnera.io account, each pod is encrypted (or not) independently, with its own passphrase. Signing into a different pod shows whatever state that pod is in.
• Other Solid apps stop reading these files until they implement solid-crypt too. That includes the mnera.io Chrome extension: if you encrypt your pod, the extension won't be able to read or write bookmarks there until it's updated.
• You'll be asked for the passphrase once per browser session. Each device and each browser unlocks independently.
• You can turn encryption off at any time from the same settings page. Re-enter the passphrase and mnera.io rewrites every bookmark file back to plain Turtle.

Analytics and cookies

mnera.io uses Vercel Analytics for anonymous, aggregate usage data — page views, referrer URLs, device type, browser, OS, and country-level location. No cookies are set by Vercel Analytics, no individual users are identified, and no cross-session tracking is performed.

The site sets one cookie: a strictly-necessary session cookie for your mnera.io account login. There are no third-party advertising cookies, no behavioural profiling, no Google Analytics, no Tag Manager, no behavioural-tracking scripts, and no telemetry beyond what Vercel Analytics collects above. See the legal page for the full data-processing disclosure.

Private image proxy (Pro)

By default a bookmark's cover image and its favicon are loaded by your browser directly from the original web host. That host sees your IP address every time you view a bookmark list. Pro accounts can route these images through the mnera.io server instead: covers and favicons travel mnera → you, so third-party hosts never see your IP, User-Agent, or Referer. The toggle is in Account settings → Privacy and is on by default for Pro users.

Data in transit

All requests between your browser, mnera.io, and your Solid pod are made over HTTPS. Solid access tokens are DPoP-bound, making them useless if intercepted.

Revoking access

You can revoke mnera.io's access to your pod at any time through your identity provider's settings. After revocation, the app cannot read or write your bookmarks until you sign in again and re-approve.