Legal
Privacy policy
Effective 2026-09-03. sharehtml.org collects as little as a file host can: the file, a keyed hash of your IP address, your country, a hash of your browser's user-agent, and, if you sign in, your OAuth profile.
The IP hash is nulled after 180 days. Pages are kept until you delete them. We do not run analytics on shared pages and never inject anything into them.
1. What we collect
| Data | When | Why |
|---|---|---|
| Page bytes, size, content hash, title | every upload | to serve the page and detect duplicates or re-uploads of removed content |
| IP hash (HMAC-SHA256 of the address with a secret key) | every upload and abuse report | rate limits, quotas, abuse correlation, without holding the raw address |
| Country (from Cloudflare) | every upload | abuse patterns and legal obligations |
| User-agent hash | every upload | abuse correlation |
| Anonymous browser id (cookie) | anonymous uploads | to let you claim your pages after signing in |
| OAuth profile: email, name, avatar URL, provider user id | sign-in with GitHub or Google | to identify your account |
| Session and API token hashes | signed-in use | authentication |
| Billing customer id, subscription status, plan, period end | Pro subscription | to know who is Pro; card details never reach us |
| View counts per page | each page load | the Pro view counter; no per-visitor record is kept |
| Abuse reports: reason, details, reporter email if given | when someone reports a page | to act on the report and answer the reporter |
We do not log raw IP addresses. We do not use Cloudflare Web Analytics or any analytics on shared pages. Cloudflare's own edge logs are covered by its policies.
2. Cookies
__Host-session: your sign-in session, 30 days sliding.__Host-anon: a random id for anonymous uploads so you can claim them later.__Host-view: on a password-protected page only, remembers that you entered the password.
No advertising or tracking cookies. Shared pages set no cookies of ours.
3. Retention
- IP hashes are set to null after 180 days. For pages removed for abuse or by legal order, 180 days from the removal.
- Pages, versions and titles are kept until you delete them.
- After deletion the bytes are gone; the page's address stays reserved and the content hash of removed pages stays blocked.
- Sessions expire after 30 days without use. API tokens last until revoked.
- Abuse reports and takedown records are kept for 180 days after resolution, longer if a legal matter is open.
- Billing records are kept as long as tax law requires.
4. Who processes your data
- Cloudflare, Inc.: hosting, storage, database, edge delivery and bot protection (Turnstile).
- Dodo Payments: merchant of record for Pro; holds your card and billing details.
- GitHub, Inc.: sign-in, if you choose GitHub.
- Google LLC: sign-in, if you choose Google.
Data is stored in Cloudflare's network with the database located in North America.
5. When we share data
With the processors above; when a law, court order or government request requires it; to investigate abuse or protect the service; and, if the service is ever sold, with the buyer under the same policy. We do not sell personal data.
6. Aggregate statistics
We may publish aggregate counts about uploads (for example, size distribution or the share of pages using a given framework). Aggregates only, never page content, never anything that identifies a page or a person.
7. Your rights
You can access, correct, export or delete your account data at any time. Deleting your account deletes your profile, sessions, tokens and pages. Residents of the EU, UK, India and other jurisdictions with data protection laws have the rights those laws provide, including the right to complain to a supervisory authority. Write to hello@sharehtml.org; we answer within 30 days.
8. Children
The service is not directed at children under 13. We delete accounts we learn belong to them.
9. Changes
Changes are listed on the changelog. Material changes are emailed to account holders 14 days in advance.
10. Contact
hello@sharehtml.org. The grievance officer and legal contacts are on legal.