Privacy Policy

This policy explains what data the ShareRush app and the website sharerush.app collect, why, who we share it with, how long we keep it, how you can delete it, and the rights you have wherever you live. We wrote it in plain words. If anything is unclear, write to [email protected].

1. Who we are

ShareRush is a file-sharing app and website run by Bhavik Senta, an individual developer based in Bhavnagar, Gujarat, India ("ShareRush", "we", "us"). We decide how and why your personal data is used, which makes us the "data controller" (under GDPR) or "data fiduciary" (under India's DPDP Act) for the data described here.

Contact for anything about privacy: [email protected].

2. The short version

• We collect only what is needed to send your files, run your account and plan, and keep the service safe.
• We do not sell your data, do not show ads, and do not use analytics or tracking tools.
• We do not open or look at your files. They are deleted automatically when they expire.
• Payments are handled by Google Play. We never see your card details.
• You can delete your account and data inside the app at any time, or by email.

3. Data we collect

3.1 Your account

• Sign-in details: when you sign in with Google (or, on iPhone, with Apple once available), we receive your email address and your account ID with that provider. Google also shares your name and Google profile picture. Our sign-in system stores these automatically, but ShareRush does not show your name anywhere. If you use Apple's "Hide My Email", we only receive the private relay address.
• Username: the unique username you choose.
• Profile photo (optional): a photo you choose from your gallery.
• Settings: whether other users can find you by username.
• Sign-in records: when you signed up and last signed in.

3.2 Your transfers

• The files you send. We store them only so the people you choose can download them.
• Transfer details: file names, file sizes, number of files, a SHA-256 fingerprint of each file (used to check the file arrived unchanged), how you sent it (username or link), the recipient's username or the private link, status, and dates (created, finished, expires).
• Received history: which transfers you received, whether you opened or hid them, and when you downloaded them. If you are signed in when you download a link, it is added to your Received list.
• Monthly amount used: how much you sent in the current month and billing period, so we can apply your plan's limit.

3.3 Your plan and purchases

• Your current plan (Free, Plus or Pro), when your billing period started, and whether a subscription is active, renewed, cancelled, expired or refunded.
• Store purchase identifiers and the product bought. These come from Google Play (or Apple) through our subscription provider, RevenueCat.
• We never receive your card number or bank details. Google Play (or Apple) processes the payment.

3.4 Your devices

• Push notification token: an ID from Firebase Cloud Messaging that lets us send "You received files" notifications to your phone, and the phone's platform (Android or iPhone). It is removed when you sign out.
• Basic device and app information that our subscription provider collects when the app checks your plan, such as device model, operating system version, app version, country and IP address.
• Upload and download progress and "complete" notifications are created on your phone and are not sent to us.

3.5 People who download a link

You do not need an account to download a ShareRush link. When someone opens a link, we briefly record their IP address to limit how many requests can be made per minute and stop abuse. We do not record who they are.

3.6 Messages you send us

If you email [email protected], we receive your email address, your message and anything you attach.

3.7 Technical logs

Our servers and service providers keep short-lived technical logs (for example IP address, time, the request made and error messages) to keep the service running, fix problems and protect against attacks.

4. Data we do not collect

• Your contacts, location, microphone, camera recordings, call logs or SMS.
• Advertising IDs. ShareRush has no ads and no ad networks.
• Analytics or tracking. We do not use analytics or tracking tools in the app or on the website, and the website does not set cookies.
• Card or bank details.
• The content of your files for any purpose other than storing and delivering them.

5. How we use your data

• To provide the service: create your account, upload, store and deliver files, show your Sent and Received history, check file integrity, and delete files when they expire.
• To connect people: let others find you by username (only if you allow it) and show your username and photo to the people you send to.
• To send notifications: tell you when you receive files.
• To run your plan: apply monthly limits, keep your plan in sync with your store subscription, and handle renewals, cancellations and refunds.
• To keep ShareRush safe: limit requests, prevent abuse and fraud, and enforce our Terms of Use.
• To give support when you contact us.
• To meet legal obligations.

Automatic plan decisions: your plan follows your store subscription automatically. If a paid purchase is refunded after you used part of your monthly amount, your account is moved to the Free plan and marked, so the same plan is not refunded again. If you think this is wrong, write to us and a person will review it.

6. Legal bases for using your data

Where the law requires a legal basis (for example GDPR in Europe and the UK, or LGPD in Brazil), we rely on:

In India, we process your data for the purpose you use ShareRush for, with your consent given when you create an account, and for the other lawful uses the DPDP Act allows.

7. Who can see your information

• Other ShareRush users: if you allow others to find you, signed-in users can find your username and see your profile photo in search. You can turn this off in Profile, then Security.
• People you send to by username: they see your username, your profile photo, the file names, sizes and the files themselves.
• People with your link: anyone who has the link can see the file names, sizes and expiry date and download the files until they expire or you delete them. They do not see your username. Only share links with people you trust.
• People who sent you files can see that the transfer was delivered to your username.
• Profile photos are stored at a web address that anyone who has the exact address can open.

8. Service providers we share data with

We use trusted companies to run ShareRush. They process data only to provide their service to us, under their own privacy and security terms. We do not sell or rent your data to anyone, and we do not share it for advertising.

We may also share data if ShareRush is sold or merged, in which case this policy continues to protect your data and we will tell you first.

9. Where your data is stored

ShareRush is run from India, but our database is in the United States and the files you send are stored in Eastern North America. This means your data is transferred outside your country, including outside India, the European Economic Area and the UK.

Where the law requires it, these transfers are protected by the safeguards in our providers' data processing terms, such as the European Commission's Standard Contractual Clauses and the UK addendum. You can ask us for more information.

10. How long we keep your data

11. How to delete your account and data

In the app: open Profile, then Delete account, type DELETE and confirm. Your account is deleted straight away.

Without the app: email [email protected] from the email address of your ShareRush account with the subject "Delete my ShareRush account". You do not need to reinstall the app. We confirm the request is really from you and delete the account within 30 days, usually much sooner. More details are on our Delete account page.

Before you delete: deleting your account does not cancel a paid subscription. Cancel it first in Google Play (Profile, then Subscription & billing, then Cancel subscription, or in the Play Store under Subscriptions), or you may be charged again.

What is deleted

• All files you sent that are still stored, including unfinished uploads. Links and Inbox downloads stop working.
• Your profile photo, username (it becomes free for others to take), settings, push tokens and your Received history.
• Your sign-in account and email address.

What is kept, and why

• Other people's history: people you sent files to, or who sent files to you, keep their own record of those transfers (file names, sizes and dates). Your username is replaced with "Deleted user" and the record is no longer linked to you.
• Purchase records kept by Google Play, Apple and RevenueCat, as their policies and tax laws require.
• Short-lived security records (such as request limits and technical logs) until they expire as listed in section 10.
• Anything we must keep to meet a legal obligation, resolve a dispute or deal with abuse.

Deleting some data without deleting your account

• A transfer you sent: long-press it in Sent, then Delete. The files are removed from storage for everyone.
• A transfer you received: long-press it in Received, then Delete. It is hidden from your list.
• Your profile photo: Profile, then Account details, then Remove photo.
• Search visibility: Profile, then Security, then turn off "Let others find you by username".

12. How we protect your data

• All connections between the app, the website and our servers use HTTPS encryption.
• Files are stored encrypted on Cloudflare's storage.
• Each file has a SHA-256 fingerprint, checked after download to prove it was not changed.
• Private links are long and randomly generated, so they cannot be guessed.
• Database access rules make sure each user can read only their own data. Secret keys are kept only on our servers, never in the app.
• Download addresses expire, and files are deleted automatically when transfers expire.

Files are encrypted in transit and at rest, but they are not end-to-end encrypted. No system is perfectly secure. If a data breach affects your personal data, we will inform you and the authorities as the law requires.

13. Your rights

Depending on where you live, you may have the right to:

• Access the personal data we hold about you and get a copy.
• Correct data that is wrong or incomplete.
• Delete your data (see section 11).
• Move your data: get it in a common format.
• Object to or restrict some uses of your data.
• Withdraw consent at any time, for example by turning off notifications.
• Complain to a data protection authority (see section 14).
• Nominate someone to act for you if you die or cannot act yourself (India).

To use any of these rights, email [email protected] from your account's email address. We reply within 30 days (within the time your local law sets, if shorter or longer). We may need to confirm your identity first. Using your rights is free, and we will never treat you differently for using them.

14. Rights by country and region

ShareRush is available worldwide. The rights in section 13 apply to everyone. These extra points apply in specific places.

India (Digital Personal Data Protection Act, 2023)

You have the rights to access, correct, complete and erase your data, to withdraw consent, to nominate another person, and to have your complaints handled by our Grievance Officer (section 20). If you are not satisfied with our answer, you can complain to the Data Protection Board of India.

European Union and European Economic Area (GDPR), including Germany, France, Italy, Spain and the Netherlands

You have all the rights in section 13. We use your data only on the legal bases in section 6. Data transfers outside the EEA are protected as described in section 9. You can complain to the data protection authority in the country where you live or work.

United Kingdom (UK GDPR and Data Protection Act 2018)

You have the same rights as under the EU GDPR. You can complain to the Information Commissioner's Office (ICO).

Switzerland (Federal Act on Data Protection)

You have the rights in section 13 and can complain to the Federal Data Protection and Information Commissioner (FDPIC).

United States, including California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon and other states with privacy laws

• We do not sell your personal information and do not share it for cross-context behavioural advertising. We do not use sensitive personal information to profile you.
• Categories we collect: identifiers (email, username, account and device IDs, IP address), commercial information (plan and purchases), the content you choose to send, and internet activity limited to technical logs. Sources and uses are listed in sections 3 and 5, and the providers we use in section 8.
• You can ask to know, access, correct or delete your data, and you may use an authorized agent. If we refuse a request, you can appeal by replying to our answer. We will not discriminate against you for using your rights.

Canada (PIPEDA and provincial laws, including Quebec)

You can access and correct your data and withdraw consent. You can complain to the Office of the Privacy Commissioner of Canada, or in Quebec to the Commission d'accès à l'information.

Australia (Privacy Act 1988)

You can access and correct your data. If you are not satisfied with our answer to a complaint, you can contact the Office of the Australian Information Commissioner (OAIC).

Japan (Act on the Protection of Personal Information)

You can ask us to disclose, correct, stop using or delete your data. Data is transferred to providers in the United States as described in sections 8 and 9. You can contact the Personal Information Protection Commission.

South Korea (Personal Information Protection Act)

You can access, correct, delete and suspend the use of your data. Your data is transferred to the providers and countries listed in sections 8 and 9 to provide the service. You can complain to the Personal Information Protection Commission.

Brazil (LGPD)

You have the rights in section 13, including confirmation that we process your data and information about who we share it with. You can complain to the National Data Protection Authority (ANPD).

Singapore, United Arab Emirates, Saudi Arabia, Indonesia, Turkey, Mexico, South Africa and other countries

You have the rights your local data protection law gives you, which include at least the rights in section 13. Email us to use them, and you can also complain to your local data protection authority.

15. Children

ShareRush is not meant for children. You must be at least 13 years old to create an account. If you are under 18, or under the age of adulthood where you live, you may use ShareRush only with the permission of a parent or legal guardian, who agrees to this policy and our Terms for you.

We do not knowingly collect data from children under 13. If you believe a child under 13 has an account, write to us and we will delete it.

16. App permissions

17. The sharerush.app website

The website does not use cookies, analytics or ads. When you open a ShareRush link in a browser, the page asks our server for the file details and download addresses, and your browser downloads the files directly. The optional "Verify file" check runs entirely on your device, and the file is never uploaded. Our hosting provider, Cloudflare, keeps standard technical logs (such as IP address and browser type) to deliver and protect the website.

18. Legal requests and abuse reports

We do not look at your files. We may access, keep or remove a transfer and related data only when the law requires it, to answer a valid legal request from authorities, or to act on a credible report of illegal content or a breach of our Terms of Use. To report a link, email [email protected] with the link.

19. Changes to this policy

We may update this policy when ShareRush changes or the law requires it. We will change the "Last updated" date at the top. If the changes are important, we will also tell you in the app before they take effect.

20. Contact and Grievance Officer

For questions, requests or complaints about your data:

• Grievance Officer: Bhavik Senta
• Email: [email protected]
• Location: Bhavnagar, Gujarat, India

We acknowledge complaints within 7 days and aim to resolve them within 30 days.