Privacy Policy

sh4de collects as little as it can to run the service. No ads, no tracking, no analytics scripts, and we never sell your data. This page lists exactly what we keep and why.

what we store

• Account: your email, username and a securely hashed password, which invite you used and who invited you. Needed to run your account.
• Your uploads and their details: file name, size, type, upload date, and view counts. On upload we remove location (GPS) and camera data from photos, and location tags from profile videos and music.
• Your profile, if you set one up: avatar, bio, location text, links, background and music. A profile is only public if you switch it on.
• Activity log: things like uploads, deletions and sign-ins, shown to you on your dashboard. Sign-in entries include the IP address you signed in from, so you can spot logins that weren't you.
• Abuse protection: to stop password guessing and spam, we briefly keep counters tied to IP addresses. They're deleted after a day.
• sh4de+ purchases: a record of the payment (Stripe's reference, amount, currency, status). Your card details go to Stripe only.

When someone views your uploads or profile we only count the view. We don't store who viewed it or their IP address.

cookies

sh4de only sets the cookies needed to keep you signed in. No tracking or advertising cookies, so there's no cookie banner. Password-protected links set a short-lived cookie after you unlock them.

who else handles your data

We use a few providers to run sh4de. Each only gets what it needs:

• Supabase (EU): database and sign-in.
• Cloudflare: file storage (R2) and delivery of your files.
• Railway (EU): runs the website and video processing. Like any web server it keeps short-lived request logs, including IP addresses.
• Stripe: payments for sh4de+, under Stripe's own privacy policy.

how long we keep it

• Uploads stay until you delete them or they expire. Deleted files are removed from storage and the CDN cache.
• Your account data stays until you ask us to delete your account ([email protected]). Then we remove it and your files.
• Payment records are kept as long as the law requires for bookkeeping.

your rights

Under the GDPR you can ask to see the data we have on you, correct it, get a copy, or have it deleted, and you can object to how we use it. Email [email protected] (or ask an admin on Discord) and we'll handle it within a month. You can also complain to your data protection authority (in the Netherlands: the Autoriteit Persoonsgegevens).

changes

If this policy changes in a way that matters, we'll say so on the site or on Discord first. See also the terms.