How to read this
The privacy policy lists what Share keeps. This note gives the reason for each item, and the limit that comes with it. At the end there is a short guide to checking it in your own browser.
Your files
Share encrypts your files in your browser before anything is sent to servers. The key travels in the link after #, which browsers never send to a server. That part of a link has been for the page alone since the early days of the web, so the key stays between your browser and your receiver's. I can't open your files or read their filenames.
Only encrypted pieces reach storage at Cloudflare. They're kept so your receiver can collect them. They're deleted when the transfer is deleted, or within two days of it expiring.
The limit: the stored size is visible to me, so I can tell roughly how large a transfer is, though not what it is. This helps me understand how much storage is needed overall. Anyone with the whole link, # part included, can open the files. Share can't tell your receiver from someone the link was forwarded to.
One more limit applies to every web app of this kind. You are trusting the page your browser loads from share.refueler.io to do what it says.
The transfer id
Each transfer has an id, with the time it was sent and the time it expires. That is how Share finds the right pieces and ends the transfer on time.
When a transfer ends, only the id and the time it ended remain. For 30 days an old link says plainly that the transfer has gone rather than show an error. Then it is deleted too.
The limit: for those 30 days, the record shows that a transfer existed and when it ended.
Error notes
When a step goes wrong, Share keeps a short note: which step, the error's name and part of the transfer id. These help me find and fix what breaks. They are kept for one day.
Cloudflare also keeps a count of these errors, by step and error name, with no transfer id, for three months. That period is Cloudflare's and can't be shortened.
They never hold file names, keys, your IP address or anything about your browser. The limit: the partial id can tie a note to a transfer, not to a person.
Signing in, for Citizens
You don't need an account to send. If you become a Citizen, Share keeps your email address, a reference to your Stripe customer record, your plan and its renewal date. These sit in a database run by Supabase in Ireland, for as long as you are a Citizen.
The email is there so you can sign in with a link instead of a password. Each link works once, for 15 minutes.
While you're signed in, Share keeps a one-way fingerprint of your sign-in and when it was last used. A copy of the database couldn't be used to sign in as you. They stop working after an hour unused, or 24 hours at most, and are deleted within the hour. They hold no IP address, device or location.
The limit: a Citizen account links your email to your plan and the transfers you send while signed in. Transfers sent while signed out aren't linked to anyone.
Payment
Stripe takes card payments for paying Citizens. I never see your card. Stripe keeps its own records, under its own privacy policy.
Cloudflare
Cloudflare runs the servers, so it sees your IP address. It also keeps a sample of requests for my account for at least a month: the IP address, the time and the web address asked for. Since 21 Oct 2026, Share's own requests carry no transfer ID. Opening a link page still sends the transfer ID (UUID) part, never the key part after the #, and that page load may be in the sample. I can't check those records, so assume Cloudflare keeps them indefinitely. I can't turn this off. A VPN hides your IP address from both of us.
Before an upload, Cloudflare runs a short check that you're a real person. It reads signals from your browser inside Cloudflare's own frame and Share receives only the result. The check is there so automated bot traffic can't fill storage.
The limit: those signals go to Cloudflare, under its policy. Now and then it also sets a short-lived cookie of its own, __cf_bm or cf_clearance.
A permanent record, if you choose one
On paid plans you can ask for a permanent record of a file: evidence, anchored in Bitcoin through OpenTimestamps, that the file existed by a certain time. Your browser sends a one-way fingerprint of the file straight to OpenTimestamps' calendar servers, not through Share. The fingerprint reveals nothing of what the file says. The calendar servers see your IP address.
The limit: anyone who already holds the same file can work out the same fingerprint and see that it matches. The record shows when a file existed, not who made it.
What Share doesn't run
Share itself runs no analytics, advertising or tracking scripts. Its visit numbers come only from Cloudflare's own traffic totals. As I cannot turn this feature off, I use it to monitor overall site traffic. Share's front page and Plans, on refueler.io, count visits with this site's own counter: no cookie, nothing stored in your browser, no IP address kept.
Check along
Everything above can be seen from your own browser.
| Where | Cookies | Other storage and requests |
|---|---|---|
| Share appshare.refueler.io | None until you sign in. Then __Host-rfs_session, listed under api.share.refueler.io. Now and then Cloudflare's __cf_bm or cf_clearance. |
Local storage: rs-theme, once you pick Paper or Carbon. IndexedDB: refueler-share-resume, for carrying on an interrupted upload. Session storage: which notices you've seen. Third parties: Cloudflare's check (challenges.cloudflare.com) before an upload; OpenTimestamps only if you ask for a permanent record. |
| refueler.io pagesthis site | None from Refueler. Now and then Cloudflare's. On Share's Plans page, once you press Continue to payment, Stripe and its hCaptcha fraud check may set their own, on their own sites, not on refueler.io. | Local storage: rs-theme, once chosen. Some pages, this one included, send one visit count to analytics.refueler.io: no cookie, no IP address kept. Fonts from Google Fonts and Fontshare. Cloudflare adds a small script of its own to check for automated traffic, and one that hides email addresses from scrapers on pages that show one. |
- Safari (Mac). Safari → Settings → Advanced → tick Show features for web developers. On the page, Develop → Show Web Inspector. The Storage tab lists Cookies, Local Storage, Session Storage and Indexed Databases. The Network tab, after a reload, lists every server the page talks to.
- Firefox. Tools → Browser Tools → Web Developer Tools (⌥⌘I on a Mac, Ctrl+Shift+I elsewhere). Storage tab, then Network tab and reload.
- Chrome, Brave and Edge. View → Developer → Developer Tools (⌥⌘I or Ctrl+Shift+I). Application tab → Storage, then Network tab and reload.
It helps to look in steps: open the page, pick a theme, start an upload, and watch what appears at each one. Phones don't offer these tools without a computer attached, so a Mac or PC is the easier place to check.
If something doesn't match
Write to privacy@refueler.io. Every message is read and answered personally.
Refueler Share
Encrypted file transfer. No account required. Free for transfers up to 4 GB.
Try it →