The default rule is that when users of a published app creates bookmarks, the bookmark is only available to the user that created it unless the user publishes the bookmark as a community bookmark. I'm not sure exactly what combination of security rules assure this, but the default qlik sense rules can be seen here: https://help.qlik.com/en-US/sense-admin/Subsystems/DeployAdministerQSE/Content/Sense_DeployAdministe... /this is for qlik sense enterprise, if you're on saas there should be a similar page for that.