Privacy Policy

Who runs this

ShareThings is run by Praful Kharpuriye, an individual in Nagpur, India. See Contact for how to reach us and for our grievance officer.

What we store when you create a share

• The files you upload, and the file type your browser reported.
• Each file's name and size.
• Any text you add, and any link addresses and link titles.
• The optional title of the share.
• A random link address, and the times the share was created and expires.
• A short code of letters and numbers. It makes a short link that also opens the share.
• While the share is live, a retry key and a keyed one-way fingerprint of what you submitted. They are only used to recognise a retried upload.

There are no accounts. We do not ask for your name or email address, and we do not store who created a share. Anyone who has the link can open the share, so treat the link like a password.

Every share also has a short code and a short link. Short links are easier to guess than the long link. Use the long link for anything private.

Your IP address

To limit abuse we count requests per client. For that we turn your IP address into a keyed one-way hash (an HMAC) and store the hash with the counter, not the address. We use it for rate limiting and daily download allowances. The same address gives the same hash while our secret key stays the same, so the hash is pseudonymous, not anonymous. Counters are deleted automatically: hourly counters within a few hours, and daily download counters within about 27 hours. We count tries of short codes that do not exist the same way: too many tries of codes that do not exist from one connection are refused for a while.

Logs

• Our own application logs record errors by type and code. They do not contain share content, link addresses, file names or IP addresses.
• Our hosting providers (below) keep their own request logs. These normally include your IP address, your browser details and the address requested, which contains the share's link address. We do not control how long they keep them.
• When you download or preview a file, your browser fetches it directly from our storage provider, which sees your IP address.

Cookies and tracking

The site does not set cookies. If you use the dark mode switch in the header to choose a theme different from your device's, that choice is saved in your browser's local storage only, so the next page opens in the same theme. It is never sent to us. Nothing is saved until you use the switch, switching back to your device's theme removes it, and we store nothing else there. The site loads no advertising scripts, and its fonts are served from our own site.

We use Vercel Web Analytics to count visits to our pages. It does not use cookies. Vercel's documentation says that it tells visitors apart by a hash made from the request, not by cookies, and discards that visitor session after 24 hours. With each page view your browser sends Vercel the address of the page, the site that sent you (if any), and your browser, device and operating system. Vercel also records an approximate location, such as your country.

The address of a share page is never sent. Before an address is sent, your browser replaces it with a generic label (/[share] for a share page, /[other] for any page that is not one of the pages listed here), and removes anything after a ? or #. Only our home page, these legal pages and the report form keep their own address. This does not change what Vercel sees when it serves you a page (see Logs above).

On our home page only, we also use Microsoft Clarity, a second analytics service, to see how that page is used. It records clicks, scrolling and a masked replay of the home page, and sends them to Microsoft, which also sees your IP address and browser details. We run it in a mode that sets no cookies: before Clarity starts, your browser tells it that storage for analytics and for ads is refused. Microsoft's documentation says that Clarity then sets no cookies and gives each page view its own ID. There is nothing to accept or decline.

Clarity never runs on share pages, code pages, the report form, these legal pages, or error and not-found pages, and it stops as soon as you move from the home page to another page. Nothing you type or stage on the home page is recorded: the files, file names, text, links and codes you enter, and the link and code of a new share, are masked in your browser, which replaces them with dots before anything is sent. At most, Clarity sees roughly how long they are.

Search engines

Share pages ask search engines not to index them. Our home page and these legal pages can be indexed.

Reports

Anyone can report a share with the report form (every share page links to it) or by email to abuse@sharethings.lol. A report from the form contains:

• the share's link address, which we keep even after the share is gone so that we can still find the report;
• the reason you chose, and the description you wrote (up to 1000 characters);
• your email address, only if you give one;
• a keyed one-way hash of your IP address, used only to tell different reporters apart.

It does not contain the content of the share. Only the operator reads reports; our providers store them like everything else on this page.

If the same share is reported by three different connections in a period of one hour, it is hidden automatically, and that is written to the moderation log below. This is a rule of the service, not a judgement about the content.

• Your email address is deleted as soon as the report is resolved.
• A resolved report, including the hash of your IP address, is deleted 90 days after it was resolved.
• A report about a share that no longer exists, or that expired more than 7 days ago, is closed automatically, and its email address is deleted, the next time our cleanup runs. It is then deleted 90 days later like any resolved report. A report about a share that is still live is kept until it is resolved.
• When we remove a share, or a share is hidden automatically, we write the share's link address, the reason category, the date and who did it (a person or the system) to a moderation log. The log holds no share content and nothing about the reporter. Each entry is deleted after one year.

When your content is deleted

• A share stops working exactly 24 hours after it is created.
• Its files, text, link addresses and file names are then deleted by an hourly cleanup, normally within about an hour. We cannot promise this to the minute: if the hourly cleanup is delayed, deletion is delayed. A daily cleanup, and a small cleanup after new shares are created, also run as a back-up.
• A small record (the link address, the short code, internal identifiers and timestamps) stays for about 7 more days, so about 8 days after creation in total, and is then deleted. The share's title, its retry key and the fingerprint of what was submitted are removed when the share expires.
• A share's short code is kept with that small record, and is not given to another share until the record is deleted.
• Shares that were never completed are cleared within hours: their text and file names normally go about 5 to 7 hours after they were started.
• Anyone who opens an expired, revoked or never-existing link sees the same page, so the page does not show that a link ever existed.
• We may delete content sooner if it breaks our Acceptable Use policy.
• Our providers keep their own logs under their own rules (see above), and we cannot speak for how they handle deleted data internally.

What we do not do

We have no accounts, we show no ads, and we do not sell your data.

Who processes data for us

• Vercel: hosts the website and sees requests to it, including IP addresses and the text and link details you submit. It also runs our daily cleanup and provides Vercel Web Analytics, which counts visits to our pages (see Cookies and tracking).
• Microsoft: provides Microsoft Clarity, which records how our home page is used, on the home page only (see Cookies and tracking).
• Supabase (region: Mumbai, India): stores the database and the uploaded files.
• GitHub: runs the hourly cleanup schedule. It receives no share content.
• ImprovMX: forwards email sent to addresses at sharethings.lol, so it sees those emails.
• Domain registrar: GoDaddy

Links you open

A link in a share takes you to someone else's website. It is opened without telling that site which share you came from, but that site will see your IP address and follows its own privacy policy.

Your requests

To have a share deleted early, or to ask a privacy question, email abuse@sharethings.lol and include the share's link address or short code, because it is the only way we can find it. This is the one address we use for privacy questions, abuse and copyright reports, and complaints (see Contact), so please say in the subject line which it is.

Under 18

ShareThings is for people aged 18 and over. Do not use it if you are younger.

Changes

If we change this policy we will change the date at the top and describe material changes on this page.