Privacy policy
How shareme.lol processes personal data under the GDPR (Datenschutzerklärung).
1. Controller
Zoldenburg UG (haftungsbeschränkt), Franz-Josef-Straße 11, 80801 München, Germany. Email: [email protected]
2. Visiting this website
When you open a page, technical connection data (IP address, date and time, requested address, browser type) is processed to deliver the page and keep the service secure and stable (Art. 6 (1) (f) GDPR). Our own server does not record IP addresses; it logs only failed requests, with share links removed. To limit request rates, it counts requests per IP address (for API calls, per IP address and token) in memory only, never on disk. Each count runs for at most an hour; old entries are cleared as the tables fill or when the server restarts. The payment service's own counters are described in section 4. To keep part of each hour's signups for new users, it also keeps in memory a pseudonymous keyed hash of the network a signup came from (the IPv4 address, or the IPv6 /64 and /48) with the time of the signup; after 24 hours it is no longer used and is deleted at the next successful signup, and a restart deletes it at once (Art. 6 (1) (f) GDPR).
3. Shared files
share-me lets users upload files with an access token and pass on a link to them. We store the file, its name, size and expiry time on our server. Anyone who has the link can open the file until the link expires (24 hours by default, at most 7 days) or the uploader revokes it. The file is then deleted automatically. Links are random and not listed anywhere.
The person who shares a file decides what it contains and who receives the link. We process uploaded files only to store and deliver them (Art. 6 (1) (b) GDPR towards uploaders, Art. 6 (1) (f) GDPR otherwise) and do not look at their content, apart from checking that the file type matches its name.
If someone reports a file under our abuse process, we open that file to decide on the report. We use the report and the reporter's contact details only to handle it, reply and, where the law requires it, pass it on to the authorities (Art. 6 (1) (c) and (f) GDPR), and keep them as long as we need to document the decision.
4. Paid link extensions (test network)
Links can be kept longer than the free limit by paying with x402, a protocol AI agents use to pay for web requests. This currently runs only on Base Sepolia, a public test network. It is paid in test USDC, which has no monetary value, so no real payments are expected or taken.
When an agent pays, the payment is checked and submitted by our own payment service (Zold), which runs on a separate server in Germany that Zoldenburg UG operates itself (not the file server in section 5). Requests reach it through Cloudflare's encrypted tunnel (see section 6). The share-me server passes it only what the payment needs: the signed payment, the price, which link it extends (as a short code derived from the link, never the link itself) and the IP address the request came from. The payment service stores the paying wallet address, the amount, the transaction and that short code, readable only by the service, to process the payment (Art. 6 (1) (b) GDPR) and keeps these records for 10 years, as German tax and commercial law requires (§ 147 AO, § 257 HGB; Art. 6 (1) (c) GDPR). It uses the IP address only to limit request rates and protect the service from abuse, in short-lived rate counters (one-minute windows), and does not store it with the payment (Art. 6 (1) (f) GDPR). The share-me server keeps, for 30 days, only what a payment was for (the link's short code, the price and the time it extends the link to) under a one-way code derived from the payment, without the wallet address, so that a payment can be retried at the same price (Art. 6 (1) (b) GDPR). The transfer itself is recorded on the blockchain, where it is public and cannot be changed or deleted by anyone, including us. To read the blockchain and submit transfers, the payment service uses Base's public node (sepolia.base.org), operated by Coinbase (Base), which receives the wallet address and the transaction, both of which become public on the blockchain anyway. More: base.org/privacy-policy.
5. Hosting (Akash Network)
The server that stores shared files is leased through the Akash Network, a decentralised marketplace for cloud resources. It is operated by Digital Frontier Unipessoal LDA, Cascais, Portugal, on a dedicated server that Digital Frontier leases from DA International Group Ltd. (AlphaVPS), Sofia, Bulgaria, which hosts it in its data centre in Sofia. Shared files therefore stay within the European Union. Both companies can technically access the data stored on the server. Files are kept on that server only until they expire. More: digitalfrontier.so/legal/privacy and alphavps.com/privacy-policy.
6. Content delivery (Cloudflare)
All traffic to shareme.lol passes through Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA, which connects to our server through an encrypted tunnel. Requests from the share-me server to our payment service (section 4) also pass through Cloudflare. Cloudflare processes technical connection data (including IP addresses) to deliver, secure and stabilise the website (Art. 6 (1) (f) GDPR). Transfers to the USA are based on the EU-U.S. Data Privacy Framework, under which Cloudflare is certified, and additionally on standard contractual clauses (Art. 46 (2) (c) GDPR). More: cloudflare.com/privacypolicy.
7. Cookies
shareme.lol sets no cookies of its own, uses no analytics or tracking, and serves its fonts itself, so your browser contacts no third parties beyond Cloudflare. To protect against abusive access, Cloudflare may set the strictly necessary cookie "__cf_bm" (bot detection, lifetime 30 minutes) and, where applicable, "cf_clearance" (confirmation of a passed security check). These cookies are required for operating the website securely (§ 25 (2) no. 2 TDDDG, Art. 6 (1) (f) GDPR) and contain no information for tracking you across websites.
8. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing (Art. 21 GDPR).
9. Right to lodge a complaint
You can complain to a data protection supervisory authority, for example the Bavarian Data Protection Authority (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA), Promenade 18, 91522 Ansbach, Germany.
10. Changes
This privacy policy is as of October 2026 and will be updated when needed.