Privacy

What we collect

• Account basics. If you sign in, we receive your email, name, and a stable user id from your sign-in provider (Apple or Google). We use these to operate your account. If you use Apple Hide My Email, the address may be an Apple relay address.
• Your vault catalog and encrypted vault data. To sync your vault and let an AI app discover what it can request, your device sends field names and types (such as "email" or "card") together with encrypted vault data. Our account database does not receive the plaintext values.
• A disclosure ledger. When a connected app requests a field and you approve it, we record who asked, why, when, and the outcome, so you have an audit trail. Protected-action pilots also record the action class, enforcement label, flags, and a hash of the reviewed facts; who a message is to and from stays in the sealed request your phone reviews. The ledger never stores a released vault value.
• Device tokens. If you enable notifications, we store a push token so we can alert your device to a pending request.
• Product telemetry. We count a limited set of product events each week to understand whether features work and how they are used. The counts are not linked to your account or your device: each is an event name, the week, and a few fixed categories such as the platform or which screen. They never include the text you scan, vault values, encryption keys, merchant names, amounts, or banks.

What stays local, and when plaintext is opened

• Privacy scans stay local. Make Private and Fingerprint analyze text on your device. The text they scan is not uploaded to ShareLess.
• Local connectors stay blind to ShareLess. With the desktop connector or browser extension, an approved value is opened on your computer or in the extension. ShareLess servers relay ciphertext and do not open the value.
• The hosted remote connector opens approved values briefly. For an AI surface that cannot hold the key locally, the hosted connector creates a fresh key for the request, opens the approved value in server memory, and returns it to the connected AI. ShareLess does not log or store that plaintext. The AI provider receives a value when its model uses it and handles it under that provider's terms.
• Payment depends on the path. On iPhone, a checkout or booking your AI hands to your phone opens in the app's own browser. Only after your hold does your phone fill the card saved in your vault, and only into the store's or hotel's own payment page; the card is never sent to your AI. The store, your card issuer or your wallet may still ask you to confirm. Existing stored cards and legacy invite-only checkout jobs remain during migration so users can review or remove their data and old jobs can close. If you use that legacy cloud path, your device seals approved details to a one-purchase runner, which opens them in memory long enough to fill checkout and then discards them. The ShareLess account database does not store a raw card number. The merchant and its payment providers receive the details needed to complete a purchase.
• Store sign-ins stay in the app's browser. When you choose to sign in to a store or a hotel inside the ShareLess app, that sign-in stays in the app's browser on your iPhone. Sign-ins are kept separate for each ShareLess account, and a household request gets its own browser data, erased when the request ends. They are erased when you disconnect, erase your saved details, delete your account or choose Sign out of all stores in Settings. The app never reads your store password or the store's sign-in cookies, and neither they nor the list of stores you're signed in to are sent to us or told to your AI. You can see each store, and other sites the browser keeps, and sign out in Settings. If a hotel you're signed in to charges less than the total you held, your phone reports the lower total, so your AI can tell you what you paid.
• Promotion codes from your store emails stay on your iPhone. With Gmail connected and Offers from your email on, your iPhone reads recent emails from stores you shop at, keeps their promotion codes and member offers sealed on the device until they expire, and uses a code only at that store's checkout. It never opens a link in those emails. The codes and the emails are never sent to us or told to your AI, and turning the setting off erases them.

Approvals, standing rules, and payments

Your device asks before releasing a field unless a matching non-payment request is covered by a standing rule you created. A standing rule is revocable prior approval and may allow future matching requests without another prompt. Payments are never covered by a standing rule. Every ShareLess-routed payment asks; a money threshold adds attention and does not silently approve a smaller amount. New consumer shares finish with the merchant and your wallet or issuer. You can revoke connectors and standing rules at any time.

Service providers

We rely on a small set of providers to run the service: sign-in providers (Apple and Google), cloud hosting and a database for your account, catalog, and ledger, and push-notification providers (Apple Push Notification service and Firebase Cloud Messaging) to alert your devices. If you explicitly choose cloud assist, cloud processing and storage providers handle the item you submit. If you purchase premium, a payment processor handles that transaction.

Keeping and deleting your data

A request an AI makes (a detail, a purchase handed to your phone, a background job) is kept on our server while it is open and deleted after it ends: about 15 minutes later for a request for a detail, a day later for a purchase or a job (two days for a household purchase), and 30 days later for a purchase whose outcome nobody confirmed. A household request you have not answered ends after a day while it waits for the member and after a week with the account holder. A request leaves a sealed note that only the AI's own retry key or the request's id can open: for 90 days it stops a retried purchase or job from running twice, and for 30 days it tells the AI how the request ended. For an older connector that sends no retry key, the note is keyed by the link it sent instead. Your receipts are kept as described above.

You can delete your account at any time from Account → Danger zone (or the Account screen in the apps). Account deletion removes your account and its database records, including your catalog, connectors, approvals, audit history, packs, rules, and plan. Weekly usage counts are not linked to your account, so they stay. Sealed notes your requests left can no longer be opened or tied to you, and expire within 90 days. The app you use to delete the account also wipes its local vault; remove ShareLess data separately from any offline or unused device.

If you used optional cloud assist for a file, account deletion currently removes its database record but does not immediately delete the corresponding encrypted temporary file object from external object storage. Contact us if you need us to confirm its removal. Canceling premium does not delete your data; advanced features pause instead.

Children

ShareLess is not directed to children under 13, and we do not knowingly collect their data.

Changes

We may update this policy as the product evolves. We'll revise the date above and, for material changes, surface a notice in the app.

Contact

Questions about privacy? Email skulk@shareless.ai.