Privacy policy

1. Who operates Sharebox

Sharebox.sh (“Sharebox”, “we”, “us”) is operated by Sumiro Studio. Privacy questions and data requests may be sent to privacy@sharebox.sh.

2. Information we process

• Public wallet addresses, signed-login metadata, and session information used to authenticate your account.
• Blockchain transaction identifiers and amounts used to verify transfer payments.
• Operational transfer metadata such as encrypted object identifiers, sizes, expiration dates, hashed delivery identifiers, and delivery events. Filenames and MIME types are encrypted in the sender’s browser.
• Referral codes, referral usage, and usage records.
• Security and operational data including IP address, user agent, timestamps, rate-limit events, error logs, and support correspondence.

3. Files and encryption

Sharebox encrypts files in the browser before upload. Encrypted objects are stored using Cloudflare R2, while transfer records and keys required by the current delivery architecture are stored through Supabase. Encryption reduces exposure but does not replace access controls, device security, or careful handling of download codes and links.

4. Why we use information

We process information to authenticate users, deliver and expire transfers, prevent abuse, calculate and verify pay-as-you-go pricing, send transactional email, operate referrals, provide support, comply with law, and improve reliability and security.

5. Providers and disclosures

We use wallet providers and Solana RPC infrastructure for authentication, Supabase for database services, Cloudflare R2 for object storage, Vercel or comparable infrastructure for hosting, SMTP providers for email, Solana infrastructure for blockchain functions, and campaign partners for sponsored backgrounds. Providers process information under their own terms and privacy notices. We may also disclose information when required by law or to protect users and the service.

6. Advertising

Sponsored backgrounds are visually identified and may link to a partner site. Sharebox does not sell file contents. Basic campaign measurement may include impressions, clicks, approximate location, device information, and fraud signals. We do not permit advertisers to access private transfer contents.

7. Cookies and local storage

Necessary browser storage supports authentication, security controls, theme selection, pending transfer actions, and consent preferences. With your permission, analytics storage may load Google Tag Manager to measure use of public product pages and features. Marketing storage is used only when campaign measurement is configured and you grant marketing consent. You can reopen Cookie Settings at any time using the cookie button.

8. Retention and deletion

Transfer records and encrypted objects may be retained until their configured expiration, deletion, dispute, security hold, or backup lifecycle completes. Account, transaction, fraud-prevention, billing, and legal records may be retained longer where reasonably necessary. You may request account deletion, subject to legal, security, payment, and blockchain-record limitations.

9. Your choices and rights

Depending on your location, you may request access, correction, deletion, restriction, objection, or portability. You may also withdraw consent where consent is the legal basis. Contact privacy@sharebox.sh. We may verify your identity before acting.

10. International transfers and security

Providers may process information in multiple countries. We use reasonable technical and organizational safeguards, but no online service can guarantee absolute security. Keep transfer links, unlock codes, email accounts, and connected wallets secure.

11. Children and changes

Sharebox is not directed to children under 16. We may update this policy as the product or law changes; the effective date above identifies the current version.