Privacy Policy for ShareText.io

Introduction

Welcome to ShareText.io. We respect your privacy and are committed to protecting your personal data. This policy explains how we handle data when you use the site. ShareText is operated by Andy Feliciotti. Contact us about privacy at contact@sharetext.io.

The Data We Collect

When you use ShareText.io, we collect and process the following data:

• The text content you share through our service
• Account and sign-in information, such as your email address and information provided by Google when you choose Google sign-in
• URLs, QR settings and titles you submit, plus necessary security and service information such as network request information
• Your privacy choices and, only with your permission, the limited usage analytics described below

How We Use Your Data

We use your data for the following purposes:

• To provide our text sharing service
• To generate meta titles and descriptions using AI to make shared content more accessible
• To improve our website and user experience
• To analyze usage patterns and optimize our service

Live Online Clipboard

When you create a live clipboard, we store the text you type or paste on Convex to synchronize it between devices. Anyone with its room link can read, change, or end the room. The link contains an access token in its URL fragment; we store a hash of that token. Rooms are unlisted, and their text is not included in public search pages, AI link previews, or analytics. Text is not end-to-end encrypted. We do not automatically read your device clipboard.

Room access expires 24 hours after creation. Scheduled cleanup runs hourly to remove expired rooms from the active database; you can end a room earlier to delete its saved text. Text already copied or loaded on another device may remain there. Infrastructure backups may retain data under the provider’s retention policies. Unsaved edits are held in the current tab and may be lost if it closes or reloads.

We store a random browser identifier locally to apply clipboard creation limits, and retain operational counters for rate limiting. This identifier is separate from optional analytics and is not sent to PostHog. With analytics permission, we measure clipboard creation, opening, copying, and ending; we do not send room tokens, room links, or clipboard text.

Analytics

We use Simple Analytics to count page views. It does not use cookies or collect personal data, and it respects Do Not Track.

Optional product analytics uses PostHog when configured. It is off unless you choose to allow it. Declining does not limit sharing or your account. We honor Global Privacy Control and Do Not Track signals by keeping this analytics off. Analytics is intended only for adults aged 18 or older; do not allow it if you are under 18.

With permission, we send named tool actions, a broad page category, broad device, browser and operating-system categories, acquisition category (such as search or email) and a known email/promotion campaign category, a country code when available, a random browser identifier and a session identifier. Examples include successful share creation, copying, downloads, upgrade views and checkout starts. For signed-in users, we associate the random identifier with the account so verified subscription payments, payment failures and cancellations can be measured. This is pseudonymous data, not a claim of complete anonymity.

We do not send shared text, document titles, passwords, email addresses, share slugs, delete keys, destination URLs, full page URLs, URL queries or fragments as analytics properties. We do not use session replay, automatic click capture, screen recording, keystroke capture, advertising pixels or automatic error capture. We send only deliberate events and controlled categories. Country reporting uses a country code supplied by our hosting provider; we disable PostHog GeoIP enrichment and set the event IP property to a placeholder. Network requests necessarily expose your connection IP and browser request headers to the receiving infrastructure.

We remember your analytics choice in browser local storage for 180 days, after which we ask again. If allowed, a random browser identifier is stored for that consent period, with a session identifier in session storage that changes after 30 minutes of inactivity. Withdrawing removes those identifiers and stops future browser collection. For signed-in accounts we also synchronize the choice to gate future billing analytics; network failures may delay account synchronization. Earlier events are not automatically deleted by withdrawing.

Use Privacy choices at any time to change your choice. Analytics uses consent where required. Necessary storage for authentication, abuse prevention, drafts, theme and privacy choices is separate and continues to support the service. For access or deletion of earlier analytics, contact us before clearing the browser identifier if possible; we may need limited information to locate your records safely.

Our PostHog project uses US Cloud, so optional analytics is processed in the United States, which may be outside your country. Its processing terms, safeguards and subprocessors are described in PostHog's privacy policy and data processing agreement. Browser collection stays disabled until the integration is configured. PostHog’s event query window depends on the plan: its current documentation describes one year on Free and seven years on paid plans. These query windows are not automatic deletion guarantees. We handle access and deletion requests separately; see PostHog’s event retention details. Our local billing-analytics delivery ledger is deleted after 30 days; required billing records are separate.

Email choices

We send sign-in and necessary account/service messages to provide the service. Sharing tips and Pro offers require a separate opt-in in your account preferences; analytics consent does not subscribe you to email. You can turn product emails off in your dashboard or use their unsubscribe link. We check preferences again before sending and do not send product offers without configured unsubscribe controls. Email is processed by Resend.

Data Storage

ShareText.io uses Convex as our backend database platform to store your shared text, QR codes, short links, and account information. Convex provides secure, real-time data synchronization and storage. Your data is stored on Convex's servers which maintain industry-standard security practices. You can learn more about Convex's security and privacy practices at https://www.convex.dev/legal/privacy/.

Payment Processing

ShareText.io uses Stripe to process payments for our Pro subscription. When you upgrade to Pro, your payment information is collected and processed directly by Stripe. We do not store your credit card details on our servers. Stripe is a PCI-DSS compliant payment processor, ensuring your payment data is handled securely. You can learn more about Stripe's privacy practices at https://stripe.com/privacy.

AI Text Summarization

ShareText.io uses artificial intelligence to automatically generate meta titles and descriptions for shared text. This supports link previews; user shares remain excluded from search indexing. The AI processing is done on Cloudflare Workers AI, and we do not retain the original text or summaries beyond what's necessary to provide the service.

Abuse Scanning

To keep the service free of phishing, malware, and other abuse, we automatically scan new shares. Links are checked against Google Safe Browsing, URLhaus, and scam domain blocklists. Share text, except password-protected shares, is classified by an AI model on Cloudflare Workers AI. We strip email addresses, phone numbers, and similar personal details before the text is sent, and the model only returns a risk score. Shares flagged as likely abuse may be reviewed by us. To improve detection, we keep each score for 90 days, along with a redacted excerpt (personal details removed) of shares that were reported or scored as possible abuse. That excerpt can outlast the share's own expiration. Password-protected shares are never excerpted.

Disclaimer

ShareText.io is provided "as is" without any warranties of any kind. We do not guarantee the accuracy, reliability, availability, or performance of our service. You use ShareText.io at your own risk, and we disclaim all liability for any damages or losses resulting from your use of our service.

Content Responsibility

ShareText.io is not responsible for the contents of shared links or any text uploaded by users. Users are solely responsible for ensuring their content complies with applicable laws and regulations. We reserve the right to remove any content that violates our Terms of Service or applicable laws. If you encounter inappropriate content, please use the report button to notify us.

Your rights and retention

Depending on where you live, you may have rights to access, correct, delete or receive a copy of your personal data, withdraw consent, object to or restrict processing, and complain to a relevant data protection authority. Contact contact@sharetext.io to make a request. We may need to verify your identity and may retain information required for legal, billing, fraud-prevention or dispute-resolution purposes.

Shares follow the expiration you select and applicable subscription rules, and may be deleted earlier for abuse. You can delete your shares using your dashboard or anonymous delete URL. Account, billing, security and backup information may follow different retention periods where needed to operate the service or meet legal requirements. Our service providers may process data internationally under their applicable contractual safeguards.

Changes to This Privacy Policy

We may update our privacy policy from time to time. We will notify you of any changes by posting the new privacy policy on this page. You are advised to review this privacy policy periodically for any changes.

Contact Us

If you have any questions about this privacy policy or our data practices, additionally if you'd like to report a bug or request a feature, please contact us at:
contact@sharetext.io