Privacy notice

MyShare’s official website is sharemydemo.com. The service is provided by BUHUIPAO LTD. This notice covers the MyShare website, browser extensions and previews opened through the service.

Updated: 2026-09-15

Shared content and authentication

Your selected local addresses, files and visitor requests pass through MyShare’s Cloudflare gateway. Public connections use HTTPS/WSS; local services use the HTTP/HTTPS configuration you provide. The gateway processes requests and responses, so this is not end-to-end encryption that hides content from the service.

Local page and file bodies are used for relaying, not stored as long-term hosted copies. Requests may be temporarily buffered during transfer. Only files you select are read; copies held by the sharing page or extension remain in local memory.

Bearer, Basic and Cookie sign-in relay each visitor’s own credentials. The extension or project adapter isolates visitor cookies without reading or reusing the owner’s native sign-in. Application logs do not record request bodies, Cookie or Authorization values, passcodes or share-control credentials. Optional feedback records are described below.

Accounts, billing and domains

Registration processes your email and password; passwords are stored as hashes. We record your email verification status and use Resend to send 8-digit email verification and password reset codes. MyShare provides Resend with the recipient address, sender details and message content including the code to deliver these account emails. We do not send your password or shared content to Resend. MyShare stores a keyed hash of each code; codes expire after 10 minutes and become invalid after use. Account details, subscription state, Stripe customer/subscription identifiers and reserved domain records support sign-in, billing, entitlements and domain management.

Payment details are handled on Stripe’s checkout and billing pages. MyShare does not receive or store full payment-card numbers. Stripe, Cloudflare and Resend also process data required to operate their services under their own terms: Stripe privacy policy, Cloudflare privacy policy and Resend privacy policy.

If you choose an enabled Google, GitHub, X or Facebook sign-in option, we obtain your account identifier, available email and its verification status from that provider. We keep the provider and account identifier association to sign you in to MyShare. X sign-in reads only the identifier and available email of the account you authorize; it does not read timelines or direct messages, or publish posts. We do not request GitHub repository access or retain provider access tokens. Each sign-in method uses a separate account, even with the same email. SSO needs no email verification. Account linking and unlinking are unavailable; email password recovery only applies to email and password accounts.

Essential cookies and local storage

To record your explicit agreement to the content sharing agreement, we store its version, server confirmation time and your current account identifier or the random anonymous identifier associated with a signed cookie. Account acceptance works across browsers; anonymous acceptance applies only to that browser identity. Records contain no raw IP address, browser fingerprint, shared content, local address or security challenge token, and are separate from optional analytics or replay consent. Anonymous records are deleted after 90 days; account acceptance records are retained with the account. Use the contact below to request access or deletion, subject to legally required retention. Anonymous identity cookies last 30 days; expiry, clearing cookies or switching browsers requires renewed confirmation.

The website uses cookies for anonymous share ownership and account sign-in, plus essential cookies lasting up to 10 minutes to bind provider sign-in checks. Preview access uses a dedicated passcode header or URL parameter; the browser retains its Service Worker registration. Feedback preferences are stored separately. Your project sets its own sign-in cookies, which are mapped to the corresponding preview origin. Language preference is kept in local storage; share recovery state stays in the relevant tab or the extension’s private session storage.

The anonymous browser cookie lasts 30 days without rolling renewal. My shares lets you view feedback and end this browser’s anonymous shares without signing in; closing the original tab does not delete their summaries. These support authentication, limits, access control and recovery. Clearing browser data may sign you out, remove control of an existing share or require another unlock. Project cookies and storage at saved addresses may carry over to later shares, so use different names for different projects.

Google Analytics on this website

This website uses Google Analytics 4 cookies to measure visits to public pages, visit timing and basic device information. Visitors in the European Economic Area, the UK, Switzerland or an unrecognized region must choose “Allow analytics” first; analytics is enabled by default elsewhere. Cloudflare determines the region from the request’s network location. A previous refusal is honored in every region.

Use “Analytics settings” in the footer to turn analytics off at any time. This stops further collection and clears this integration’s analytics cookies without affecting sharing, sign-in or subscriptions, or interrupting an active share. It does not automatically delete data already sent.

Page addresses we send exclude query strings and fragments. We do not provide referring page addresses, account identifiers, email addresses, share passcodes, local addresses, file contents or form inputs. Automatic form, outbound-link and site-search collection, Google Signals and ad personalization are disabled. This integration runs only on our website, not in shared previews, the replay player or extensions.

Analytics cookies belong only to the website host and last up to 180 days. Your acceptance or refusal is saved locally for 180 days. Google also receives device and network information when handling analytics requests; see the Google privacy policy. Website analytics and the preview feedback choices below are independent.

Visitor choices: analytics, comments and replay

New share forms enable visitor analytics, comments and page replay by default on every plan; owners can turn them off before sharing. Visitors choose whether to allow click counts, time spent and named custom events to be recorded. Both options are preselected on the first visit, but collection starts only after saving. Saved refusals remain unchecked. Visitors who previously consented to masked-only replay must confirm again before visible content is recorded. Analytics requests may include page paths, but the server stores aggregate counts, not raw events or paths. Declining does not prevent browsing or commenting.

Replays record visible page text, styles, captured images and interactions. Ordinary input values are also recorded. Password fields, explicitly marked private areas and embedded pages remain masked or blocked. Replay does not capture screen video, network bodies, console output or keystrokes. Images and styles are saved in page snapshots; the player does not request resources from the original website. Browser restrictions and size limits may prevent some images from being captured. URL query strings and fragments are removed. Visible content may still contain personal or project information; enable replay only when you are entitled to retain that content.

Free / Pro retain each visitor’s last 30 seconds, with a current window up to 1 MiB and 5 MiB total per share, saved every 30 seconds. Studio records each visitor’s first 5 minutes, up to 5 MiB per visitor and 50 MiB of cumulative uploads per share, saved every 15 seconds. A final save on departure is best effort: lost connections or forced closure can lose unsent activity. The interface shows the last successful save time. API-only requests do not produce page replay, and API bodies are not recorded.

Withdrawing consent stops collection on the current page immediately. Once the server saves that choice, the visitor’s saved replays become unreadable and are scheduled for deletion; storage failures trigger cleanup retries. After an offline failure, retry saving the withdrawal to complete server deletion. Existing aggregate analytics may remain.

Visitors submit comments voluntarily. Comments are visible to the owner and other visitors. Do not include passwords or sensitive personal information. The owner can delete comments.

Retention

• Share access expires when stopped or timed out. Content bodies are relayed; selected files are released with their local context.
• Details and feedback within a share are retained after it stops or expires: 7 days for Free, 30 days for Pro and 90 days for Studio. Expired feedback cannot be read; failed physical cleanup is retried.
• Share creation, ownership and final usage summaries are retained for 90 days after ending. Active shares are retained while running; connection-event aggregates are retained for 90 days after their last event. Monthly cost-allowance aggregates for accounts and anonymous browsers are retained separately for the current and preceding three UTC calendar months.
• Email codes expire after 10 minutes, with expired records scheduled for cleanup. Account sign-in sessions last 30 days. Account, billing and reserved-domain records have no single automatic expiry period.
• Anti-abuse limits use irreversible HMAC identifiers derived from IP addresses. Share rate-limit counters last at most one hour; authentication limits use short-lived counters. Cloudflare Turnstile processes signals needed for security checks.

Contact and privacy requests

To ask about, access, correct or delete account-related data, contact support@sharemydemo.com with your account email and request. Do not send passwords, email codes, full card numbers or share-control credentials. Data deletion and subscription cancellation are separate actions; use account billing management to stop future renewal charges.