Last updated: August 24, 2026

Privacy in plain English
  • Uploaded files are automatically deleted when your link expires; a record of the upload (not the files) is kept for abuse prevention.
  • We log uploads, downloads, and share-page views (including IP addresses) to fight abuse - Details below, nothing hidden.
  • No ad networks, no sale of personal data. Analytics run on our own self-hosted Matomo.

Who is responsible for your data

WINNEROO LIMITED operates ShareIt.onl and is the data controller for the processing described here. For any privacy question or request, email [email protected].

Files you upload

Your files travel to us over an encrypted HTTPS connection and are stored with an established cloud object-storage provider in the United States, served through our own branded domain, only to make your share link work. They are automatically and permanently deleted when the lifetime you chose expires (1 hour to 7 days, or 30 days signed in; each download extends the link by 24 hours), or immediately after the first download for one-time links. An automated cleanup removes expired files every 15 minutes. We do not sell your files, use them for advertising, or reuse them for any other purpose. We may screen uploads with automated malware-reputation checks, and our team can access files when reviewing an abuse or copyright report.

What we log, and why

To run the service securely, prevent abuse, and meet legal obligations, we keep these records:

  • Upload records: for each share we store the share token, file names and sizes, upload time, the uploader's IP address, and browser user agent. This record is kept after the files themselves are deleted, so we can investigate abuse and respond to legal requests.
  • Download logs: each download is logged with the time, the file, the downloader's IP address, country, and browser user agent.
  • Share-page views: when a share link is opened we log the time, IP address, and country.

Signed-in members can see aggregate view and download statistics for their own shares in their dashboard.

Account data (Google sign-in)

Accounts are optional. If you sign in with Google, we store your Google account ID, email address, name, avatar URL, and sign-in times. We use this only to operate your account and dashboard. We do not access anything else in your Google account.

Cookies and analytics

We set a session cookie (sign-in state, CSRF protection, remembering that you unlocked a password-protected share) and cookies from Matomo, an analytics platform we host ourselves - Your analytics data stays on our infrastructure and is not shared with an analytics vendor. We use no third-party advertising networks and no cross-site tracking cookies.

Service providers

We use a small number of infrastructure providers to run the service:

  • Cloud object storage - An established US-based storage provider holds uploaded files for delivery. Details available to authorities on lawful request.
  • Cloudflare - CDN and reverse proxy in front of the site, which processes visitor traffic to serve and protect it.
  • Google - Optional sign-in (OAuth) only.
  • Resend - Transactional email delivery, where email notifications are enabled.

These providers process data only to provide their service to us. We do not sell personal data to anyone.

How long we keep data

  • Files: until the share expires (or is downloaded once, for one-time links, or deleted early from a member dashboard), then permanently deleted from storage.
  • Upload records and download/view logs: kept after file deletion for abuse prevention, moderation, and legal compliance. You may ask us to delete log entries about you via [email protected]; we will do so unless we need them for an ongoing abuse or legal matter.
  • Account data: until you ask us to delete your account.

The security, retention & deletion page has a full timeline for every expiry option.

Your rights

You can ask us what data we hold about you, ask for a copy, ask us to correct it, or ask us to delete it (including your account and, where legally possible, log entries) by emailing [email protected]. To have a share removed before it expires, email [email protected] with the link. If you think we have handled your data badly, you can complain to your own country's data-protection authority, or to our supervisory authority in Cyprus - The Office of the Commissioner for Personal Data Protection.

Children

The service is not directed at children under 16, and we do not knowingly collect personal data from them. If you believe a child has used the service, contact us and we will delete the data.

Changes

We may update this policy; the current version always lives at this address with its "last updated" date, and material changes will be signposted on the site.

Learn more in our security & retention overview and terms of service, or head back to share files free.