Privacy Policy

This policy explains what information iShared.app ("we", "us") collects when you use the service, why we collect it, and the choices you have. It applies to the iShared.app website and file transfer service at ishared.app.

Information we collect

We collect the following categories of information:

• Account information. When you create an account, we collect your email address and name. If your organization uses single sign-on (SSO), we receive the identity claims (such as name and email) provided by your organization's identity provider via OIDC or SAML.
• Files and transfer content. Files you upload are stored in encrypted object storage (Amazon S3) and are encrypted at rest. We also store transfer metadata - file names, sizes, and the share links and expiration settings you configure.
• Usage and device data. When a file is downloaded, we log the download event, including the IP address and timestamp, so account owners can see who accessed a shared file and so we can detect abuse and enforce rate limits.
• Billing information. If you subscribe to a paid plan, billing and payment details are processed by our payment processor, Stripe. We do not store your full card number on our servers.
• Session data. To keep you signed in, we store a session token in your browser's local storage (see our Cookie policy for details - we use local storage, not traditional browser cookies, for this).
• Audit logs. On plans with audit logging, we record account and security-relevant actions (such as sign-ins, MFA changes, and file-sharing changes) for the account owner's visibility and for our own abuse investigation.

How we use this information

We use the information above to:

• Provide the file transfer service - storing, transferring, and delivering your files.
• Authenticate you and keep your account secure, including multi-factor authentication.
• Enforce plan limits and rate limits, and prevent abuse of the service.
• Process payments and manage subscriptions.
• Provide customer support and respond to security reports.
• Meet legal and contractual obligations, including audit logging for enterprise customers.

Who we share it with

We do not sell your personal information. We share data with:

• Service providers who help us run iShared.app - our cloud hosting and storage provider (AWS), our payment processor (Stripe), and our email delivery provider, each bound by their own data protection terms.
• Your organization, if you access iShared.app through an account provisioned by an employer or team that has enabled SSO or audit logging - your organization's administrators may be able to see your account activity.
• Law enforcement or regulators, only where required by law.

Data retention

We retain files and account data for as long as your account is active. If you delete a file or close your account, we remove it from active storage; backups are purged on a rolling schedule. Audit logs and download event records are retained for a limited period to support security investigations and are not kept indefinitely.

Your rights

Depending on where you live, you may have the right to access, correct, export, or delete your personal data. We're currently building self-service tools for data export and account deletion requests; until those ship, you can request either by emailing hello@ishared.app and we'll handle it manually.

Security

Files are encrypted at rest and in transit (TLS). We support multi-factor authentication and single sign-on for account protection. No system is perfectly secure, and we encourage you to report any concerns to security@ishared.app.

Changes to this policy

We may update this policy as the service changes. We'll update the "Last updated" date above when we do, and for material changes we'll make a reasonable effort to notify account holders directly.

Contact us

Questions about this policy? Reach us at hello@ishared.app, or see our Contact us page.