Last updated: 15 October 2026

Terashare is operated by iTech (BE 0643.553.428), Belgium — the "data controller" for the personal data described here. This policy covers the terashare.net website, the Terashare desktop client, and the Terashare Android app (net.terashare.mobile).

The short version

• The contents of the files you share are end-to-end encrypted. We cannot read them, and neither can our storage or relay providers.
• File names and sizes are not encrypted — we need them to show you your files and to run the service.
• We keep technical logs (IP address, browser, transfer events) to run the service and fight abuse. We don't build advertising profiles and we never sell your data.
• Transfers are peer-to-peer where possible: the other side of a transfer can see your IP address, as with any direct connection.
• Shares expire and are deleted automatically. You can delete your own shares at any time from My Files.

End-to-end encryption — what we can and cannot see

When you share a file, your browser or app encrypts its contents with a key generated on your device. The key travels only in the part of the share link after the '#', which browsers never send to any server. Our servers, our cloud storage and anyone relaying the transfer see only encrypted data. One exception: if you ask us to email the link for you, that email contains the key — see 'Emails you send through us' below.

What stays visible to us: the file's name, its size, when it was shared and downloaded, and the account it belongs to. On the rare browsers without the required encryption support, the transfer falls back to an unencrypted upload.

What we collect

Account information. Your email address and a hashed password. If you sign in with Google or Microsoft, we receive your name and email address from that provider; we never see your password there. Accounts that are never confirmed are deleted automatically within about a day.

Share metadata. File names, sizes, share links, expiry dates, and download counts. For team shares, which organisation the share belongs to.

Technical logs and transfer telemetry. Like most websites we log requests: IP address, browser (user agent), country derived from your IP, pages visited. During transfers, the website and apps report anonymous progress events (started, completed, failed, and why) so we can see where deliveries break. These are operational logs — they are kept for a limited period and are not used to build profiles.

Payments. Purchases are processed by Stripe. We never see or store your card number; we keep your billing history (what you bought, when, for which account). If you arrive from an ad, an advertising click identifier may be attached to your checkout so we can measure which ads work.

Emails you send through us. If you email a share link from Terashare, we process the recipient addresses and your message only to deliver that email. For an encrypted share, the emailed link includes its decryption key, so that one email — key included — passes through our server and our email provider. We use the key only to build the link in the email and do not store or log it; if you'd rather keep the key off our servers entirely, share the link yourself instead (copy it or use the QR code). Delivery runs through Mailgun, our email provider.

Peer-to-peer transfers and your IP address

Terashare transfers files directly between devices where possible (WebRTC). To connect you, our tracker and relay servers see the IP addresses of both sides, and the person you exchange files with can see your IP address — the same way they would on any direct connection. If a direct connection is impossible, traffic is relayed through our servers, still encrypted.

Cloud copies and how long they live

So your recipient doesn't need you online, an encrypted copy of each share is uploaded to our cloud storage, hosted in the region closest to you (in the EU by default), unless you opt out. Free shares are deleted after 24 hours. Each credit extension keeps a share for another 30 days; shares under an active subscription are kept for as long as the subscription is active, then for a final 30 days. Deleting a share yourself removes the cloud copy right away.

Cookies and storage on your device

We use cookies for signing you in (session), security (CSRF protection), your language and currency choice, and a signed cookie that meters the anonymous free allowance. Your browser's local storage holds transfer bookkeeping and, if you enable it, your encrypted key vault — those values stay on your device and are not readable by us.

On the production website we use Google Analytics and Google Ads conversion measurement to understand how the service is used and whether our ads work. These set Google cookies. The Android app and desktop client contain no advertising or analytics SDKs.

Teams and organisations

If you share files under a team (organisation), be aware: team administrators can manage those shares, and when the team has organisation encryption enabled, its administrators are able to decrypt files shared under the team. Administrators can also see membership and billing details. Your personal shares outside the team are not affected.

Who we share data with

We use a small number of service providers to run Terashare, each receiving only what their job needs: Stripe (payments), Mailgun (email delivery), OVH (cloud storage of encrypted file copies), DigitalOcean (server hosting), Google (analytics and ads measurement on the website), and Sentry (server error monitoring). We never sell personal data, and we disclose it beyond these providers only when the law requires it.

Your rights and choices

You can delete any of your shares at any time from My Files; the cloud copy and its metadata are removed. Under the GDPR you can ask us for access to, correction, deletion or a copy of your personal data, object to processing, and complain to your data protection authority (for Belgium: the GBA/APD).

To delete your account, use the account deletion page — we complete deletion requests within 30 days. Deleting your account removes your shares, their cloud copies and your profile; billing records we are legally required to keep are retained for the statutory period. For any other privacy request, reach us through the contact form.

The desktop client and the Android app

The apps talk to the same service and collect nothing beyond what this policy describes: account credentials you enter, the files you choose to share, and transfer telemetry. The Android app runs a visible background service while transfers are active so they can finish with the screen off; it stops itself when transfers are done. The apps contain no ads and no third-party trackers.

Children

Terashare is not directed at children under 16, and we do not knowingly collect personal data from them.

Changes to this policy

When we change this policy we will update the date at the top. For significant changes we will notify account holders by email or through the service.

Contact

Privacy questions and requests: use the contact form. Security reports: security@terashare.net.