Privacy Policy

Your privacy is not just a feature; it's our foundation.

Introduction & Zero-Knowledge

ShareBase is built on a Zero-Knowledge Architecture. We do not have the technical capability to access, read, or store the files you share. Our role is strictly limited to introducing two devices to each other; once the introduction is made, we step out of the way.

Our Hybrid P2P Technology

ShareBase utilizes a proprietary Hybrid Signaling System to ensure maximum reliability without compromising privacy. Here is exactly how we handle your data:

WebRTC (The Core)

Your files are streamed directly from your browser to the recipient's browser using WebRTC Data Channels. Files are never split, cached, or saved on any intermediate server. The data path is encrypted end-to-peer using DTLS and SRTP protocols.

Firebase Realtime Signaling

We use Google Firebase as our signaling coordinator. When you share a file, we store temporary, zero-knowledge encrypted "handshake" metadata (ICE candidates and Session Descriptions). All signaling data is encrypted in your browser using PBKDF2 + AES-GCM before upload, meaning Firebase never sees raw file metadata or connection details.Data Retention: This handshake data is ephemeral and is deleted as soon as the room is closed or the transfer is complete.

What We See

  • Encrypted File Metadata (Name, Size, Type) — decryptable only by the receiver using the shared 12-char key.
  • Temporary 6-digit Room Key — used as the database directory path.
  • Encrypted Network Signatures (ICE candidates) — encrypted before upload to coordinate peer connection.

What We NEVER See

  • The actual content of your files.
  • Your identity, email, or physical location.
  • A history of who you shared files with.
  • Persistent logs of IP addresses once a session ends.

Security Safeguards

To protect against unauthorized access to a share room:

  • All signaling data is transmitted over secure HTTPS/WSS connections.
  • Room keys are cryptographically generated and have short lifespans.
  • WebRTC connections require mutual consent from both peers.

Third-Party Services

We use Google Firebase for real-time signaling. Since we don't handle accounts, Google does not receive your PII (Personally Identifiable Information). They only see the standard network telemetry required to operate the Realtime Database.

ShareBase Privacy Version 2.0

Last updated: January 26, 2026