Privacy Policy
ShieldSync is pre-launch
Everything below describes how the software actually behaves today — the categories, the retention windows and the rights are the ones implemented in the running code, not intentions. One thing is outstanding: no company is incorporated yet, so section 2 names a person rather than a legal entity. We will publish the company name, registered address and CVR number there before any account holds real data, and this notice will otherwise stand as written.
1. The short version
- Your files are encrypted on your device before they reach us. We cannot read them, and neither can anyone who compromises our storage.
- We collect what an account and a sync service need: who you are, what devices you use, and what you have shared with whom.
- We run no advertising, no analytics and no tracking, and we do not sell or share your data with anyone for their own purposes.
- You can download everything we hold, or delete your account outright, from your dashboard at any time.
- If you sync only over your local network, your files never touch our servers at all.
2. Who is responsible for your data
ShieldSync is developed in Denmark. Until the company behind it is incorporated, the controller for the purposes of the GDPR is the person who builds and runs it, Muhammed Alsabban, contactable at privacy@shieldsync.dk.
Incorporation is planned before launch. When it happens this section will name the company, its registered address and its CVR number, and the change will be recorded in the revision date above — the rest of this notice is unaffected by it, and your rights under it do not depend on who is named here. We have not designated a Data Protection Officer; the address above reaches the person responsible for privacy questions directly.
3. What we collect, why, and for how long
Everything we hold falls into one of the categories below. Nothing else is collected, and there is no hidden telemetry in the desktop application.
| Category | What it is & why we have it | Legal basis | Kept for |
|---|---|---|---|
| Account | Your name, email address, avatar image if you upload one, and the verifier derived from your password. Your password itself never reaches us. To create and run your account, sign you in, and contact you about the service. | Contract Art. 6(1)(b) — we cannot give you an account without it. | Until you delete your account, then immediately. |
| Devices | Device name, operating system, the version of the ShieldSync app on it, its cryptographic peer identity, and the network addresses it reports itself reachable on (including its public IP address and port). So your devices can find and sync with each other, and so you can recognise and remove them from your dashboard. | Contract Art. 6(1)(b) — syncing between devices requires knowing where they are. | Until you remove the device or delete your account. Removing a device erases its name, operating system and network addresses immediately; we keep only its cryptographic identity, so it cannot quietly rejoin your account. Reachability announcements are ignored after 30 minutes. |
| Files you back up | The encrypted contents, plus storage keys, file sizes and timestamps. Filenames are encrypted on your device before they reach us when filename protection is on. To store your backup and sync it to your other devices. | Contract Art. 6(1)(b) — this is the service you asked for. | Until you delete the file, then 30 days in the trash so you can undo it. You can set that window from 1 day up to your plan’s limit: 30 days on Free, 180 on Personal, a year on Pro. If you move to a plan with a shorter limit, the shorter limit applies from then on. Separately, if your account stays above its storage allowance for 30 days — which can happen when a paid plan ends — we move the most recently added files into that same trash, after warning you twice by email. Nothing is removed without both windows having passed. On Personal and Pro, each new version of a file you keep in the cloud is stored there too, and trimmed to your plan’s version-history window — 30 days on Personal, a year on Pro. Free plans keep version history on your own device only; when a paid plan ends, the versions it kept in the cloud move to the trash. |
| Sharing | The email address of anyone you invite to a shared folder, and of anyone who invites you, together with the device names and permission you chose. A one-way fingerprint of each address you invite, against your account, to count how many new people you invited that day. If you report an invitation as unwanted, which account you reported and when. To deliver the invitation, to enforce who may read or change a shared folder, and to stop invitations being used to send spam. | Contract & legitimate interests Art. 6(1)(b) for you; Art. 6(1)(f) for a recipient who has no account, whose address we use to deliver the message you asked us to send and, kept only as a one-way fingerprint, to have your invitation waiting if they sign up — and who can refuse further invitations from the link in it. Limiting how many new people one account can invite, and acting on reports, is Art. 6(1)(f): everyone’s interest in invitations that cannot be used for spam. | While the share exists. Declined, revoked and orphaned invitations are deleted 30 days after they end, and an invitation nobody ever answers is deleted after 90 days — or after 30 days, if it came from someone you had not shared with and you chose to receive those quietly. An invitation to someone with no account waits 30 days for them to sign up, then is deleted. The fingerprints used for the daily limit are deleted after 24 hours. A report is kept for 180 days, so that whoever reviews an account paused by reports can see them. |
| Guest links | The link's expiry, its size, and how many times it was downloaded. The name of the shared item is encrypted with a key that exists only in the link itself, so we cannot read it, and the path is stored in the same protected form as your other filenames. Links created before this change still carry a readable name. If someone reports a link, what they chose and wrote, and their email address only if they gave one so we can answer. To serve the link and let you see and revoke what you have shared, and to act on reports of links that carry something they should not. We cannot see inside a link, so a takedown acts on the report, and its owner is told. | Contract & legitimate interests Art. 6(1)(b) — you created the link; Art. 6(1)(f) for reports — everyone’s interest in links not being used to spread harmful content. | Deleted 2 days after the link expires or you revoke it. A report is deleted after 180 days, or with the link when its owner deletes their account. |
| Security records | The IP address and browser user-agent attached to each sign-in, and to entries in your activity log. So you can review and revoke sessions you do not recognise, and so we can detect and investigate unauthorised access. | Legitimate interests Art. 6(1)(f) — see the balancing note below. | 12 months. |
| Notifications | The text of notifications sent to you, such as an invitation or a change to a shared folder. To deliver them to each of your devices. | Contract Art. 6(1)(b) — part of running a shared folder. | Deleted once every device has received them, and in any case after 30 days. |
| Support | The name and email address you give on the contact form, what you write to us there or on the conversation page, and our replies. Each email we send you carries a private link to that conversation: anyone with the link can read and answer that one conversation, so keep it to yourself. We keep only a one-way fingerprint of the link. To answer you, by email. | Legitimate interests Art. 6(1)(f) — you asked us something and we answer it. We do not email the address you give until we reply, so the form cannot be used to send mail to someone else. | Deleted 12 months after the last message in the conversation, or straight away when the account with that address is deleted. |
| Billing | Your plan, its status and renewal date, the billing email you gave us, and identifiers linking your account to your Stripe customer and subscription. Card numbers never reach us — they are entered on Stripe’s own payment page and we never see or store them. To take payment for a paid plan, apply the right storage allowance, and issue invoices. | Contract & legal obligation Art. 6(1)(b) to provide the plan you bought; Art. 6(1)(c) for the invoice records bookkeeping and VAT law require us to keep. | While you hold a paid plan. Invoices already issued are kept by Stripe for the period tax law requires (in Denmark, five years) and survive account deletion — an issued invoice is an accounting record and cannot lawfully be erased on request. |
| Deletion records | A one-way hash of the email address of a deleted account, and the date. Never the address itself. So we can show that we honoured an erasure request if we are ever asked to prove it. | Legal obligation Art. 6(1)(c) with Art. 5(2) — we are required to be able to demonstrate compliance. | Kept. It contains nothing that identifies you. |
Our legitimate interests, and how we weighed them. We keep sign-in records with IP addresses because without them nobody — you included — can tell an ordinary login from an intruder's, and you would have no way to spot a session that is not yours. We judged this proportionate because the data is narrow (an address and a browser string, not your activity), it is shown to you rather than hidden from you, it is never used for profiling or advertising, and it is deleted after 12 months. If you disagree with that balance in your case, you can object under Article 21 using the contact address above.
If someone invited you and you have no account. A ShieldSync user can enter your email address to share a folder with you, and we use it to send you that one message. We do not create an account for you. So that the invitation can be waiting for you if you sign up, we keep it for 30 days, with your address stored only as a one-way fingerprint rather than the address itself; after 30 days we delete it. For the first 24 hours we also keep that fingerprint against the account that invited you, only to limit how many new people one account can invite in a day. If you never sign up, that is all we held about you. Every such invitation carries a link that stops any further ShieldSync invitations to your address, from anyone, and deletes any invitation still waiting for you, immediately — we record that as a one-way fingerprint too, so honouring your request does not require keeping a readable copy of what you asked us to stop using.
4. What we cannot see
Your files are encrypted on your device with keys derived from your password, which never leaves your device. We store the resulting ciphertext and the keys to it in a form we cannot open. This is deliberate and it has a consequence worth stating plainly: we cannot recover your files if you lose both your password and your recovery code, and no support request can change that. When filename protection is on, we do not receive your filenames either — only their sizes and encrypted identifiers.
5. Who else processes your data
We use a small number of service providers to run ShieldSync, and each one is bound by a written agreement meeting Article 28(3) before it handles anything. The current list is published on our sub-processors page, which is the authoritative version. We do not sell personal data, and we do not share it with anyone for their own purposes. We would disclose data to an authority only where we are legally compelled to, and we can only ever hand over what we actually hold, which does not include the contents of your files.
Payments are handled by Stripe (Stripe Payments Europe, Limited, Ireland). When you buy a plan we pass Stripe your name and email address so it can identify the payment; you enter your card details on Stripe’s own page and they never pass through ShieldSync. Stripe is not only our processor: for fraud prevention and its own regulatory duties it acts as an independent controller of payment data, governed by its own privacy policy rather than by us.
6. Where your data is processed
We process personal data in the European Economic Area, and our own infrastructure stays there.
One exception, stated plainly: Stripe may transfer payment-related data to its group outside the EEA, including the United States. Those transfers rely on the European Commission’s standard contractual clauses (Implementing Decision (EU) 2021/914) and, where applicable, the EU–US Data Privacy Framework. This affects your name, email address and payment details. It does not affect your files, which are encrypted before they leave your device and are never sent to Stripe at all.
Files synced directly between your own devices are not transferred anywhere by us — they travel between your machines.
7. Your rights
Under the GDPR you have the following rights. Most of them you can exercise yourself, immediately, without asking us:
- Access (Art. 15) — get a copy of everything we hold about you. Settings → Your data → Export Data.
- Rectification (Art. 16) — correct anything wrong. Settings → Profile.
- Erasure (Art. 17) — delete your account and everything in it. Settings → Danger Zone.
- Portability (Art. 20) — take your data elsewhere in a machine-readable format. The same export covers this, and can include your encryption keys on request.
- Restriction (Art. 18) — ask us to hold processing while a dispute is resolved.
- Objection (Art. 21) — object to anything we do on the basis of legitimate interests, including our security logging.
- Automated decisions (Art. 22) — we make none. No profiling, no scoring, no automated decisions with legal or similarly significant effects.
- Withdrawing consent (Art. 7(3)) — we currently rely on consent for nothing, so there is nothing to withdraw. If that changes, withdrawal will be as easy as giving it.
For anything not available in the dashboard, write to privacy@shieldsync.dk. We answer within one month, and will tell you if we need longer, as Article 12(3) allows. We do not charge for this.
8. Complaints
If you think we have handled your data wrongly, please tell us first — we would rather fix it. You also have the right to complain to a supervisory authority at any time. In Denmark that is:
Datatilsynet
Carl Jacobsens Vej 35, 2500 Valby, Denmark
+45 33 19 32 00 · dt@datatilsynet.dk · datatilsynet.dk
If you live elsewhere in the EU or EEA, you may complain to your own national supervisory authority instead.
9. Children
ShieldSync is not intended for children. You must be at least 13 to create an account, which is the age Denmark has set for a child to consent to online services. If we learn that we hold data about a younger child without the consent of a parent or guardian, we will delete it.
10. How we protect your data
Files are encrypted on your device with AES-256-GCM before upload. Your password is turned into a verifier on your device using Argon2id and is never sent to us, so it cannot be learned by anyone reading our traffic or our database. Connections use TLS, and syncing between your devices is separately encrypted. Accounts can be protected with two-factor authentication, and every session is listed in your dashboard so you can revoke one you do not recognise.
Our diagnostic logs identify an account by its internal number, never by your name, your email address or the name of a file. Where a log line needs to refer to a specific address or file so that two entries can be matched up, it carries a one-way fingerprint of it instead of the thing itself. Server access logs do record the IP address a request came from, which is covered in section 3.
11. If something goes wrong
We have a written procedure for handling a data breach, decided in advance rather than improvised. If personal data is lost, exposed or altered, we investigate immediately, and where the law requires it we report to Datatilsynet within 72 hours of becoming aware. We keep an internal record of every breach, including ones we were not required to report, so that our decisions can be checked afterwards.
If a breach is likely to put you at serious risk, we will tell you directly and in plain language — what happened, what it means for you, and what to do about it. One thing we can already tell you: the contents of your files are encrypted with keys we have never held, so a breach of our storage does not expose them. That protection covers your files and not the rest — your email address, sign-in records and device names are stored in a form we can read, and we will not describe a breach of those as harmless because something else was encrypted.
12. Changes to this notice
We will update this page when what we do changes, and the date at the top will tell you when. If a change materially affects your rights or how we use your data, we will tell you directly rather than relying on you to notice.
13. Contact
Questions about this notice, or about anything we do with your data, go to privacy@shieldsync.dk.