Privacy Policy

Effective 2026-10-31. This describes what U3com Sharer collects and why.

What we collect

• Account data — name, email, password hash, plan, API token hashes (never plaintext).
• Your content — files, images, pastes, shortened URLs, albums, and their metadata.
• Upload provenance — when anyone (account or guest) uploads a file, paste, or short link we record your IP address plus request metadata (user agent, device class, referer, origin, accepted languages/encodings, via, host, timestamp). This is used for abuse investigation, enforcement, and legal compliance, and is visible to staff only.
• View analytics — coarse per-item events: device class, bot classification, approximate country, referer host. Raw IPs are not stored in analytics events.
• Server logs — standard web-server access logs retained on a rotation.
• Moderation — abuse reports, audit log of staff actions, CAPTCHA answers in-session.

Cookies

Session cookie, a sharer_guest cookie identifying guest uploads (1 year), and the CSRF token. Third-party ad vendors may set their own cookies on pages where ads run — see each vendor's policy.

How we use it

• Operate the service (storage, quotas, replication, delivery).
• Abuse prevention and moderation (IP/request provenance, bot detection, virus scanning — uploads are scanned for malware).
• Usage metering, quotas, and plan limits.
• Legal compliance.

What we don't do

• Sell or rent personal data.
• Profile you across other sites — ads are selected per page, not per person.
• Store plaintext API tokens or passwords.

Content handling

• Image EXIF/GPS metadata is stripped from public derivatives (thumbnails); originals keep metadata unless you strip it before upload.
• Deleting content removes public access immediately; stored bytes purge from storage nodes and replicas asynchronously, and from backups on their rotation schedule.
• Staff may inspect content in the course of moderation or abuse reports.

Sharing

We disclose data only to: infrastructure providers who run the service under our control; ad vendors serving pages (they receive the page request itself); and authorities when legally required (including reports of child exploitation material to NCMEC).

Your controls

Dashboard users can delete items, revoke API tokens, and delete their account. Guest uploads are claimed into your account when you register from the same browser. Questions or requests: use the report page.