Last updated: 5 October 2026
Direct transfers
Files sent between your devices go straight between them, over your own network. The apps keep a name for your device, your settings and a history list on your own device only. Other devices on the same network can see the device name you chose, so pick a name you are happy to show.
App network usage
Some public pages may show clearly labeled sponsored images with links. GleamShare does not use ad scripts or ad cookies for these placements. An externally hosted image or a sponsor link you open can connect to that sponsor's service.
Admins may see an approximate country, region or city inferred from a public IP using a local GeoLite database. This is not GPS or an exact address, and VPNs may show a different location. Visitor IPs are not sent to an external location service.
When your browser or an online Windows or Android app connects to our service, we record its network IP address, app platform, first and last use, and an observation count. This includes guests and is visible only to admins. These records contain no account email, device name, file contents, messages or decryption keys. Records expire 90 days after the last use. Offline app usage is not reported. Several devices can share one public IP address.
Finding nearby devices (the website)
To show you devices on the same network, the server sees the address your connection comes from and relays the device names of devices that share it. Discovery information is kept in memory only while you have the page open. File contents travel directly between devices; signed-in completion counts are stored as described below.
Link and email shares
Files are encrypted on your device before upload. The server stores the encrypted data for 7 days and then deletes it. It cannot read the files, the file names or your message. The key stays in the link after the "#", which is never sent to the server. When you send by email, the recipient addresses and the link are used once to send the message and are not kept by us.
Accounts (only for "Send by email")
Admins can see the network IP used at account creation and the networks used while signed in, with approximate country, region or city. Usage network history is retained for 90 days, up to 100 networks per account; creation IP stays with the account. Existing accounts may have no recorded creation location.
To stop strangers from using GleamShare to send spam, sending by email needs a free account.
- When you create an account we store your email address and a scrambled form of your password (a salted hash, never the password itself) on our server, so you can log in again. We use your address only to confirm it, to let you log in and reset your password, and to show it as the sender of emails you choose to send.
- We email you a 6-digit code to confirm your address, and again if you forget your password. The server keeps each code, scrambled, for 30 minutes, then discards it.
- While signed in, we store completed send and receive counts, file counts and byte totals, together with a transfer identifier and time. We also store sign-in devices, network addresses and the last activity time. Admins can see account roles, these totals and whether an account was active in the last 90 seconds. Transfer activity records do not contain file names, file contents, messages, recipient addresses or decryption keys. Deleting your account removes its activity records.
- When you log in, your browser or app keeps a login token for 30 days. It is stored on your device. Resetting your password or deleting the account ends every login.
- "Log out" removes the token from your device. "Delete account" removes your email address and password from our server. Links you already shared keep working until they expire (7 days).
- Accounts that never confirm their address are not usable and can be removed on request.
Who else handles data
Emails (the confirmation codes and the messages you send) are delivered through our mail provider, who has to see the addresses to deliver them. Our web host keeps ordinary server logs, such as the address a request came from and the time. We also use the connecting address briefly, in memory, to limit abuse such as too many emails in an hour.
No advertising or selling
No advertising and no analytics cookies. We do not sell or share personal information.
Your choices
You can turn off "Show me on network" so nobody can find or send to you, log out to remove your login from your device, delete your account to remove your email address and password from our server, and decline any incoming transfer. Encrypted link and email data is deleted automatically after 7 days. For anything else, contact us below.
Questions? Contact acaciawebmaster.