Keep Plaintext Out of Server Custody
Shares are encrypted in the browser before data reaches the server.
Privacy Notes
Privacy is the core design goal.
At PrivShare, privacy is the design goal. The zero-knowledge architecture means we cannot access share plaintext or decryption keys; shares are encrypted in your browser before anything is uploaded.
Last updated:
TL;DR: Shares are encrypted in your browser, retrieval is denied after expiration or burn-after-reading, and the server stores ciphertext and approved operational metadata only. Owner analytics store safe share-event metadata only. Billing and production compliance certifications are not implemented yet.
Privacy Model
Three properties enforced by the current implementation
Short-Lived Storage
Burn-after-reading, expiration, revocation, and owner deletion make shares unavailable. Lifecycle cleanup removes eligible encrypted records after approved grace windows once scheduled.
Minimal Data Use
Data resale and marketing use are not implemented. Owner analytics are limited to safe share-event metadata and follow the project's sensitive-data rules.
What We Collect (And Don't)
Transparency about data practices is non-negotiable
Information We Collect
- Encrypted content blobsCiphertext only, encrypted in your browser before upload
- Account email (registered users)For authentication and notifications only
- Account session metadataBetter Auth may store IP address and user-agent values for session management
- Recipient email (optional)Sent to Resend only for opted-in keyless share-link delivery
- Share metadataCreation time, expiration settings (not content)
- Basic analyticsSafe owner events such as share creation, authorized retrieval, lifecycle transitions, and text/env version actions.
What We Never Collect
- Unencrypted content, shares are encrypted before upload
- Encryption keys, keys stay client-side in the URL fragment or your password
- Passwords you share, the server stores ciphertext only
- IP addresses for tracking, raw user agents, recipient identity, and read/viewed receipts are not stored in share analytics; auth session metadata is listed above
Data Retention & Deletion
Your data has a defined lifespan by design
Shared Content
Burn and expiration make shares unavailable. Lifecycle cleanup removes eligible encrypted records and S3 ciphertext after the approved grace windows once scheduled.
Account Data
Accounts store your email, authentication records, and owned-share operational metadata. Deleting your account revokes owned shares before removing Better Auth account and session rows.
Auth Sessions
Account sessions expire after 14 days. Session lists expose only opaque IDs, browser/device labels, and dates; raw IP addresses, raw user agents, and bearer tokens stay server-side. Expired-row cleanup cadence and backup/DR retention remain owner-side checks.
Server Logs
Production server logging policy is not implemented yet. Project rules prohibit logging share content, passwords, private keys, request bodies, and other sensitive user-provided data.
Analytics Data
Owner analytics events are deleted with their share and with the owner account. They store safe event type, timestamp, share ID, share kind, lifecycle transition, and version number where applicable.
Cookies & Local Storage
Minimal Cookie Usage
PrivShare uses cookies sparingly and only for essential functionality:
- Session cookies, to keep you logged in when you use an account
- No third-party tracking cookies, we do not use advertising or cross-site tracking
Important Notice
Under the zero-knowledge architecture, there are some things the service cannot do:
- Recover share plaintext if you lose access to the decryption key
- Decrypt share content without the browser-held key
- Reconstruct deleted share plaintext
These properties apply to the implemented share workflows. Production compliance certifications and audits remain future work.
Changes to This Policy
We may update this privacy policy from time to time. If we make significant changes, we'll notify you through the site. We encourage you to review this page periodically.
Continued use of PrivShare after changes constitutes acceptance of the updated policy.
Contact Us
If you have questions about this privacy policy or our data practices, we're here to help:
Contact form