Security & privacy

Privacy is a core design goal of mnera.io. By building on the Solid protocol, the app is architecturally prevented from accessing your bookmark data without your permission.

What mnera.io can access

• Your WebID — a public URL that identifies you on the Solid web
• The single bookmarks file at /bookmarks/resource.ttl in your pod
• Only content you explicitly save through the app

What mnera.io cannot access

• Other files in your pod
• Your browsing history or any other browser data
• Any content outside the bookmarks resource

What mnera.io stores on its servers

Bookmark data — mnera.io never copies or stores your bookmarks. All bookmark reads and writes go directly from your browser to your Solid pod. The mnera.io server only serves the app's code.

mnera.io account data — if you create a free mnera.io account, mnera.io stores your email address, a hashed password, and your UI preferences (theme, language, font size, sort order) in a secure database. This data is separate from your bookmarks and is not linked to your Solid pod identity unless you explicitly link them. You can delete your mnera.io account at any time from the account settings page.

No analytics

mnera.io does not include analytics trackers, advertising scripts, or telemetry. There are no third-party cookies set by mnera.io.

Private image proxy (Pro)

By default a bookmark's cover image and its favicon are loaded by your browser directly from the original web host. That host sees your IP address every time you view a bookmark list. Pro accounts can route these images through the mnera.io server instead: covers and favicons travel mnera → you, so third-party hosts never see your IP, User-Agent, or Referer. The toggle is in Account settings → Privacy and is on by default for Pro users.

Data in transit

All requests between your browser, mnera.io, and your Solid pod are made over HTTPS. Solid access tokens are DPoP-bound, making them useless if intercepted.

Revoking access

You can revoke mnera.io's access to your pod at any time through your identity provider's settings. After revocation, the app cannot read or write your bookmarks until you sign in again and re-approve.