What PokeMarks stores
Everything is written to storage.local, an area of your own browser profile that only this extension can read:

The bookmarks you save - URL, title, description, notes, category, favourite flag and manual position.
Usage counters for each bookmark: when it was added, when it was last opened, and how many times.
Your settings: theme, team, artwork level, sort order, card animation, how links open, whether the search bar and filter row are shown, and whether Pokémon are chosen manually.
A small cache of measured image brightness values, keyed by dex number.
Downloaded artwork is kept in the browser's Cache Storage so the extension works offline. Your chosen theme and team are also mirrored into localStorage as rendering hints, so a new tab paints in the right colours before anything else loads.

What PokeMarks sends
PokeMarks makes exactly one kind of outbound request, and it does not contain your data:

Pokémon artwork from raw.githubusercontent.com (the PokéAPI sprites repository). The request is for a numbered PNG such as 25.png. It happens once per Pokémon, and never again once the image is cached.
A dex number cannot be reversed into a URL - many different sites map to the same Pokémon, and the mapping runs one way. That one host is told nothing but a number, and it is not contacted at all if you set Pokémon artwork to Off.

What PokeMarks deliberately does not do
No bookmark URL, title or note is ever transmitted to any server, including ours. There is no "ours".
No third-party favicon service is used. In Chrome, icons come from Chrome's own favicon cache; in Firefox, which offers no such service, PokeMarks draws a letter instead of requesting an icon at all.
No analytics, telemetry, crash reporting, session recording or A/B testing.
No advertising, ad network, tracking pixel or affiliate link.
No content scripts run on the pages you visit.
Your data is never sold, shared, rented or used to train anything.
Permissions, and why each one exists
storage - to keep your bookmarks and settings on this device.
activeTab - to read the title and address of the tab you are on, only at the moment you press Save.
contextMenus - to add "Save to PokeMarks" to the right-click menu.
bookmarks - to read your existing browser bookmarks when you choose to import them. Nothing is read unless you press that button, and PokeMarks never modifies them.
favicon - to display site icons from Chrome's local cache instead of fetching them from the internet. Chrome only: the Firefox build does not request this permission, because Firefox has nothing to grant.
PokeMarks requests no host permissions and no access to <all_urls>. It cannot read, modify or observe the pages you browse.

Your data is yours
Export everything to a JSON file at any time from Settings → Data. Clear all data from the same place - it removes every stored bookmark, every setting and every cached image immediately and permanently. Uninstalling the extension also removes everything, because there is nowhere else for it to live.

Children
PokeMarks collects no personal information from anyone, of any age. It requires no account and asks for no identifying details.

Changes
If a future version changes what is stored or sent, this page will be updated and the change will be noted in the release notes before the version ships. A change that would send your bookmark data anywhere would be a different product, not a new version of this one.