How ShareIt.onl handles your personal data

Last updated: October 18, 2026

Who is responsible for your data

WINNEROO LIMITED operates ShareIt.onl and is the data controller for the processing described here. For any privacy question or request, email [email protected].

Files you upload

Your files travel to us over an encrypted HTTPS connection and are stored with an established cloud object-storage provider in the United States, served through our own branded domain, only to make your share link work and to keep the files available in your account.

The link you hand out expires on the lifetime you chose (1 hour to 7 days, or 30 days signed in; each download extends it by 24 hours), or after the first download for a one-time link. Once it expires it stops working for everyone, permanently - sharing those files again produces a new address, never the old one.

The files are a separate matter: they stay in your account, listed in your file manager. Deleting a file first moves it to your rubbish bin, where it can be restored for 30 days; emptying the bin, or reaching the end of that period, permanently removes it from storage. Link expiry alone does not delete a stored file. An upload made when no account could be created for you at all (for example, a browser that refuses cookies) is the exception, and is deleted by an automated cleanup within 15 minutes of its link expiring. We do not sell your files, use them for advertising, or reuse them for any other purpose. We may screen uploads with automated malware-reputation checks, and our team can access files when reviewing an abuse or copyright report.

What we log, and why

To run the service securely, prevent abuse, and meet legal obligations, we keep these records:

• Upload records: for each share we store the share token, file names and sizes, upload time, the uploader's IP address, and browser user agent. This record is kept after the files themselves are deleted, so we can investigate abuse and respond to legal requests.
• Download logs: each download is logged with the time, the file, the downloader's IP address, country, and browser user agent.
• Share-page views: when a share link is opened we log the time, IP address, and country.

Signed-in members can see aggregate view and download statistics for their own shares in their dashboard.

Account data (Google sign-in)

Accounts are optional. If you sign in with Google, we store your Google account ID, email address, name, avatar URL, and sign-in times. For the daily storage reward, we also store the UTC calendar dates on which you returned while signed in. Active-device controls store a random session identifier, IP address, browser user agent, and last-seen time so you can review and revoke browsers. Team workspaces store membership, role, invitations, and an optional company email domain; comments store their author, text, page or file reference, and time. Comments posted on a personal page are public to anyone who can open that page, subject to the page password when one is set. We use this data only to operate your account, collaboration, security controls, and rewards. We do not access anything else in your Google account.

If you create a personal page, we store its username, public display name, introduction, chosen template, publication state, and the account files you selected. Public page details and items are visible to anyone who can open the subdomain unless you set a page password. Items marked private stay in your editor and are not rendered to visitors. Personal-page and folder passwords are stored as one-way password hashes, not readable passwords. We retain this configuration until you remove it or close your account, subject to abuse and legal recordkeeping requirements.

Chat privacy modes

Channel creators choose either end-to-end encrypted chat or standard chat when creating a channel, and that mode cannot later be changed. In an encrypted channel, message text, reactions, filenames, and new chat attachment copies are encrypted and decrypted in members’ browsers. We store ciphertext for offline delivery, history synchronization, and unread state, but cannot read its contents. In a standard channel, we store readable message text, reactions, and ordinary ShareIt link details to provide those same functions.

Your separate recovery passphrase is processed only in your browser and is never sent to us. Channel keys are wrapped separately for registered browser devices, and permanently removing a member starts a new key epoch. If you lose the passphrase and every already-unlocked device, encrypted history cannot be recovered. When someone reports an encrypted message, the reporting member must explicitly agree to send us a decrypted snapshot of that message and any disclosed attachment names for moderation.

In encrypted channels, a selected file is copied through the sender’s browser and stored as chunked ciphertext. Because we cannot decrypt that copy, it has no server-side preview, malware scan, or ZIP generation. Standard channels instead send the original active ShareIt link, which remains covered by the ordinary file-storage and access terms above.

ShareIt.onl browser extensions

The Chrome, Edge, Brave, and Firefox extensions have one purpose: letting you send a file through ShareIt.onl and receive a shareable link. You can select a local file in the dedicated uploader, or explicitly enable hover sharing for an individual website and choose a public file you find there. Website access is optional and requested one site at a time rather than granted across the web when the extension is installed.

When you press Upload files, the selected file contents, names, and sizes are sent over HTTPS to ShareIt.onl and handled under the file-retention terms above. If you connect Google, the extension uses your existing ShareIt.onl session to show whether you are signed in; it does not read the value of your authentication cookie or obtain your Google password. The context-menu permission provides the uploader shortcut and an action for the one link or media item you right-click. Clipboard access is used only when you press Copy link.

On a website where you enable hover sharing, the extension examines link destinations and image, audio, and video source addresses in that page solely inside your browser so it can display Share with ShareIt beside likely files. Those addresses and your hover activity are not sent to ShareIt.onl. When you choose one item, the extension shows its address and asks you to confirm. It then fetches that public file without the source website's cookies, sign-in details, or a referring-page header and uploads the resulting file to ShareIt.onl. The original source address is not stored with the ShareIt upload. Some protected or sign-in-only files therefore cannot be grabbed; you can download those yourself and use the normal uploader if you have permission to share them.

If you choose a WhatsApp, Telegram, Facebook, Reddit, X, LinkedIn, email, or system share button, the extension opens that service with the completed ShareIt.onl link at your request. The file itself is not sent to that service by the extension. Those services handle the link under their own privacy terms.

Chrome Web Store Limited Use disclosure: The use of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements. Extension data is used only to provide or improve the file-upload and link-sharing features described here; it is not sold, used for personalized advertising, or transferred except as needed to provide the service, protect against abuse, comply with law, or as otherwise permitted by that policy.

Backups and offline files

Folder backup uses your browser's file-system permission and runs only while ShareIt.onl is open; the selected folder handle and change markers stay in that browser. Camera upload uses the normal device file picker. Files you explicitly mark for offline use are stored in that browser's private cache until you remove the offline copy or clear site data. ShareIt.onl cannot silently inspect your camera roll, run a native background service, or remotely erase an offline copy already saved on a device.

Cookies and analytics

We set a session cookie (sign-in state, CSRF protection, and remembering that you unlocked a password-protected share, folder, or personal page), a device cookie named did, and cookies from Matomo, an analytics platform we host ourselves - Your analytics data stays on our infrastructure and is not shared with an analytics vendor. We use no third-party advertising networks and no cross-site tracking cookies.

The did cookie is set the first time you upload something, lasts up to ten years, and holds one random identifier and nothing else - no name, no email, no browsing history. It exists because it is your account: it is what lets us show you your own files when you come back, and it is the only key to them until you connect a Google account. It is not used for advertising or for tracking you across other sites, and clearing it does not delete your files - it makes them permanently unreachable, which is why we suggest connecting Google if the files matter to you.

Service providers

We use a small number of infrastructure providers to run the service:

• Cloud object storage - An established US-based storage provider holds uploaded files for delivery. Details available to authorities on lawful request.
• Cloudflare - CDN and reverse proxy in front of the site, which processes visitor traffic to serve and protect it.
• Google - Optional sign-in (OAuth) only.
• Resend - Transactional email delivery, where email notifications are enabled.

These providers process data only to provide their service to us. We do not sell personal data to anyone.

How long we keep data

• Files: until you move them to the rubbish bin and either empty it or let its 30-day restoration period end. Files uploaded when no browser/device account could be created are removed after their link expires; one-time files are removed after their first successful download.
• Upload records and download/view logs: kept after file deletion for abuse prevention, moderation, and legal compliance. You may ask us to delete log entries about you via [email protected]; we will do so unless we need them for an ongoing abuse or legal matter.
• Account and reward data: account details, achievement records, and daily check-in dates are kept until you delete your account. This includes an account created for your browser automatically when you upload without signing in - it holds your files and nothing about your identity, and is reached only by a cookie on that device. Clearing that cookie makes the account permanently unreachable, including to us; connecting a Google account is what makes it recoverable.
• Chat: encrypted channels retain ciphertext, key envelopes and the encrypted recovery vault; standard channels retain readable messages and link details. Membership metadata and read positions are kept while the channel and account remain active. An encrypted-message report keeps only the specific decrypted snapshot a reporter chose to disclose.

The security, retention & deletion page has a full timeline for every expiry option.

Your rights

You can ask us what data we hold about you, ask for a copy, ask us to correct it, or ask us to delete it (including your account and, where legally possible, log entries) by emailing [email protected]. To have a share removed before it expires, email [email protected] with the link. If you think we have handled your data badly, you can complain to your own country's data-protection authority, or to our supervisory authority in Cyprus - The Office of the Commissioner for Personal Data Protection.

Children

The service is not directed at children under 16, and we do not knowingly collect personal data from them. If you believe a child has used the service, contact us and we will delete the data.

Changes

We may update this policy; the current version always lives at this address with its "last updated" date, and material changes will be signposted on the site.

Learn more in our security & retention overview and terms of service, or head back to share files free.