Privacy Policy

Sharedocs — Dutch Spaghetti Software Ltd

Last updated: 15 October 2026

---

At a glance: Dutch Spaghetti Software Ltd operates Sharedocs, a document-sharing platform. We collect your email address, name, and account activity information to provide the service. We do not sell your data, serve you advertisements, or share your information with anyone except the sub-processors listed in Section 7 of this policy, services you choose to use with Sharedocs (such as a sign-in provider or an AI assistant), and, where required by law, law enforcement or regulatory authorities as described in Section 7.1. You have full rights under UK GDPR to access, correct, or delete your data at any time.

---

1. About Us

Sharedocs is operated by Dutch Spaghetti Software Ltd, a company registered in England and Wales.

When we say "we", "us", or "our" in this policy, we mean Dutch Spaghetti Software Ltd.

This policy applies to all personal data we process in connection with the Sharedocs platform, including data collected through our website at sharedocs.net, our web application, and any emails we send to you.

---

2. Our Roles Under Data Protection Law

Sharedocs operates in two distinct capacities depending on whose data is being processed.

2.1 Data Controller

We act as a data controller in respect of the personal data of account holders (library owners) who register with Sharedocs. This includes the information you provide when you sign up, your billing details, and your usage of the platform. As a controller, we determine the purposes and means of processing your data and are responsible for ensuring that processing is lawful.

2.2 Data Processor

When a library owner invites collaborators to access their document library, we act as a data processor on behalf of the library owner (the controller). In this capacity, we process collaborator data — such as email addresses and access logs — on the library owner's instructions. Library owners who use Sharedocs commercially should ensure they have an appropriate lawful basis for sharing their collaborators' personal data with us, and may request a Data Processing Agreement from us at privacy@sharedocs.net.

---

3. Personal Data We Collect

3.1 Account Registration

When you create a Sharedocs account, we collect:

• Your email address (used as your login identifier and for communications)
• Your display name
• The date and time you accepted our Terms of Service
• Whether you have opted in to marketing communications
• If you choose to tell us, what you plan to use Sharedocs for (asked once after sign-up)

You can sign in in several ways. Whichever you use, no password is stored by Sharedocs unless you register with, or later set, a Sharedocs password.

If you register with an email address and password:

• Your password is stored exclusively as a PBKDF2-SHA256 hash; we never store or have access to your plaintext password
• Whether you have verified your email address

If you register or sign in using Google, Apple, Microsoft or GitHub:

• We receive your email address, your name, and an account identifier from the provider once you have signed in with them. The identifier is: for Google, the sub claim from your Google ID token; for Apple, your Apple user identifier; for Microsoft, your account's object ID (oid); for GitHub, your numeric GitHub user ID.
• Microsoft: we also store your Microsoft tenant ID, which identifies the organisation (or personal Microsoft account) your Microsoft account belongs to.
• Apple: Apple sends your email address and name only the first time you sign in. If you use Apple's "Hide My Email", the email address we receive and use is an Apple relay address, not your own.
• GitHub: GitHub does not issue an ID token, so we use a short-lived access token (permissions: read your profile and email addresses) once, to read your profile and your primary verified email address. We do not store the GitHub access token.
• For each provider you connect we store a link record: the provider, the account identifier above, the email address the provider gave us, and when the link was created and updated. You can see and disconnect your linked providers in your Security Settings. If you disconnect a provider, we keep a record that you did so (the provider, the email address it gave us, and the date), so that signing in with that provider later does not silently reconnect it to your account.
• Your browser communicates directly with the provider's sign-in pages during the sign-in flow. That interaction is governed by the provider's own privacy policy: Google, Apple, Microsoft or GitHub. We receive only the profile data described above once authentication is complete.
• Security notifications from Google and Apple: Google (through its Cross-Account Protection service) and Apple may send us server-to-server notifications about your account with them, for example that you have revoked Sharedocs' access, deleted your account with them, that your account has been disabled or its sessions revoked, or that you have turned email forwarding for an Apple relay address off or on. Each notification identifies your account by the provider's account identifier. Depending on the notification, we disconnect that provider from your Sharedocs account, sign you out of your Sharedocs sessions, or update the email address we hold for the link. We keep a record of each notification's identifier, type and time so that it is not processed twice.
• If you later wish to sign in without the provider, you can set a Sharedocs password using the "Forgot password" link on the sign-in page, or sign in with a link or code sent to your email address.

If you sign in with a passkey:

• When you add a passkey in your Security Settings, we store the passkey's credential ID, its public key, a signature counter, the ways your device can reach it (for example USB or internal), an identifier for the type of authenticator that created it (its AAGUID), the name shown in your Security Settings, and when it was added and last used. Fingerprints, face scans and device PINs used to unlock a passkey stay on your device and are never sent to us. Each sign-in uses a single-use challenge that is valid for 2 minutes.

If you sign in with an emailed link or one-time code:

• When you ask for a sign-in link, we store a single-use link token and a 6-digit code for your account, both valid for 10 minutes, and count failed attempts to enter the code. Requesting a new link cancels any earlier unused one.

3.2 Subscription and Billing

If you purchase a paid subscription, we collect:

• Your subscription tier and status
• Your Stripe customer ID and subscription ID (references to your billing record held by Stripe)
• Billing interval (monthly or annual)

We do not store your payment card details. All payment processing is handled directly by Stripe.

3.3 Technical and Usage Data

When you use the platform, we automatically collect:

• IP addresses — used for rate limiting, security monitoring, audit logging, and (on Business-tier libraries) country-based access restrictions and the visitor-country breakdown in Business analytics. IP addresses are never used for marketing or profiling.
• Browser and device information (User-Agent string) — used to identify your active sessions and display human-readable device labels in your Security Settings (for example, "Chrome on macOS"), and recorded in library audit logs.
• Session tokens — cryptographically signed tokens stored in your browser to keep you logged in.
• Activity timestamps — we record when sessions are created and last used, when you last signed in, and when documents are viewed, downloaded, or uploaded.
• Bot-protection signals — when you sign up, sign in with a password, request a password reset or a sign-in link, or use a contact form, Google reCAPTCHA Enterprise assesses whether the request comes from a person (see Sections 5 and 7).

3.4 Collaborator Data

If a library owner invites you as a collaborator, we hold your email address and record your acceptance of the invitation, your access history, and your IP address (for audit and token-sharing detection purposes). If you choose to create a Sharedocs account after being invited, your account data is governed by Section 3.1 above.

If you send a library owner a message using a library's contact form, we store your name, email address and message for that library's owner, who can read and reply to it.

3.5 Communications

If you contact us via our contact form or by email, we retain the content of your message and your contact details in order to respond to you. Emails sent to our sharedocs.net addresses are received through our email provider (Resend); we store the message and any attachments in our own private storage, forward them to our team, and may send an automatic acknowledgement.

3.6 Data We Do Not Collect

We do not collect or store:

• The content of documents uploaded to libraries for any purpose other than delivering them and protecting the platform (see Section 6 for the limited automated checks and abuse reviews we carry out)
• Plaintext passwords or payment card numbers
• Passwords or other credentials for your Google, Apple, Microsoft or GitHub account, or any data from those accounts beyond the profile data described in Section 3.1
• Biometric data (passkeys are unlocked on your device; see Section 3.1)
• Precise geolocation data
• Any special category data as defined by UK GDPR (for example, health, racial or ethnic origin, or biometric data)

3.7 AI assistant connections

You can connect an AI assistant, such as Claude or ChatGPT, to your Sharedocs account using the Model Context Protocol (MCP). When you connect, you sign in to Sharedocs and choose whether the assistant gets read access, or read and write access. We then hold a record of that connection: the assistant's name as it identifies itself, the access you granted, when the connection was created and last used, the IP address its last request came from, and how many requests it has made.

A connected assistant can only see and do what you can see and do in Sharedocs. Depending on the access you granted, it can list your libraries, documents, folders and collaborators, read the text of documents, give you links to open documents, read audit logs (owners and admins only), and upload, create, rename, move or replace documents and invite collaborators. It cannot delete documents or change library settings. A library owner can stop assistants reaching a library, or limit it to the owner, in that library's Access Controls.

When an assistant opens or changes a document, or invites someone, the library's audit log records it in the same way as the web app does, labelled with the assistant's name (for example "Sharedocs MCP (Claude)"), together with the IP address the request came from, which is usually the assistant provider's server rather than yours.

We do not receive or store your conversations with the assistant. We receive only the requests the assistant makes to Sharedocs on your behalf. For product analytics and reliability we record, for each request, which tool was used, whether it succeeded, the assistant's name, your role and plan, and how long it took; we do not record the content of the request or the document text returned.

You can disconnect an assistant at any time from Connected apps in your Security Settings. It stops working on the assistant's next request. Connections end automatically after 90 days.

---

4. How We Use Your Personal Data

The table below sets out the purposes for which we process your personal data and the lawful basis we rely on under UK GDPR.

Where we rely on legitimate interests, we have conducted a balancing test to confirm that our interests are not overridden by your rights and interests. You may request a copy of any such assessment by contacting us at privacy@sharedocs.net.

---

5. Cookies and Local Storage

Sharedocs does not use advertising cookies, and our own web application and website set no cookies. Our web application stores the following items in your browser's local storage or session storage. Session storage is cleared when you close the tab.

Strictly necessary (needed for a feature you have asked for):

Preferences:

Analytics and error tracking: our analytics provider (PostHog) is configured to hold its identifiers in memory only and does not write cookies or local storage entries. Session recording is turned off in PostHog. Our error tracking provider (Sentry) may keep a short-lived identifier in session storage for its error recordings (see Section 4), and writes no cookies. Our database provider (Supabase) is configured not to write any session keys to your browser.

Google reCAPTCHA: the pages that use reCAPTCHA (sign-up, password sign-in, password reset, sign-in link requests and contact forms) load it from Google, and Google may set cookies and collect information about your browser and device to assess whether you are a person. This is governed by Google's Privacy Policy and Terms of Service.

Google Fonts: our website and web application load fonts from Google Fonts, so your browser sends your IP address to Google when it fetches them.

If you sign in using Google, Apple, Microsoft or GitHub, that provider may set cookies on its own sign-in pages. Those interactions are governed by the provider's own privacy policy (see Section 3.1).

If you have a paid subscription, Stripe may set cookies on its own hosted payment pages. Those pages are governed by Stripe's own privacy policy.

---

6. Your Documents

Files you upload to Sharedocs libraries are stored in a private, access-controlled storage bucket. We do not read, analyse, index, or use the content of your documents for any purpose other than delivering them to the people you authorise, except for the limited checks below that protect the platform from abuse.

• Automated checks on upload. When a file is uploaded we check that its contents match its file type, and we calculate a fingerprint of the file (a SHA-256 hash). The fingerprint is compared with the fingerprints of files from accounts we have suspended for abuse. If it matches, the upload is refused and the uploading account is suspended automatically (see Section 9).
• Abuse investigations. When we suspend an account for abuse, we record the fingerprints of its documents and the web addresses linked from its PDF documents, so that the same files and phishing links can be recognised if they appear again. When we investigate a report or a suspect account, a member of our team may run a review that reads the PDF documents in that account's publicly accessible (open) libraries to look for such links. These reviews are started by a person, one account at a time; documents in private and invite-only libraries are not read.

Documents are served to collaborators via short-lived, signed URLs generated on demand. They are not publicly accessible by URL.

No document content is shared with any third-party processor. If you connect an AI assistant (section 3.7) and ask it to read or open a document, we send that document's content or a link to it to the assistant at your request. The assistant's provider (for example Anthropic or OpenAI) is not our processor: it handles that content under its own terms and privacy policy, which you agreed to when you started using the assistant.

---

7. Third-Party Processors

We share personal data with the following sub-processors to deliver the Sharedocs service. All processors are contractually required to process data only on our instructions and to maintain appropriate security measures.

Sign-in providers (independent controllers): if you choose to sign in with one of these providers, we exchange the data below with them. They are not our processors: each acts as an independent data controller for your account with them and for the sign-in interaction itself, and their handling of your data is governed by their own privacy policies (linked in Section 3.1), not by this policy.

Standard Contractual Clauses (SCCs) are the mechanism used for transfers to processors outside the UK/EEA, providing equivalent protection to UK GDPR requirements.

No raw document content is shared with any of the above processors.

7.1 Legal and Regulatory Disclosures

In addition to the sub-processors listed above, we may disclose personal data to the following categories of recipients where required or permitted by law. These recipients are not sub-processors acting on our instructions — they are independent recipients to whom disclosure is made under a legal obligation or in the exercise of a legitimate interest to prevent serious harm.

Internet Watch Foundation (IWF)

Where we identify or receive a credible report of child sexual abuse material (CSAM) hosted on the platform, we are required under the Protection of Children Act 1978 and related legislation to report it to the IWF. Such a report may include account identifiers, IP addresses, and content references sufficient to identify the material. The lawful basis for this disclosure is legal obligation (Art. 6(1)(c) UK GDPR).

Law enforcement authorities

This includes the National Crime Agency (NCA), UK police forces, and any other competent authority in the UK or, where applicable, overseas. We will disclose personal data to law enforcement where:

• we receive a valid legal process requiring disclosure (such as a court order, production order, or statutory notice);
• we are under a legal duty to report (for example, in connection with CSAM or terrorism-related content); or
• we reasonably believe disclosure is necessary to prevent serious harm or an imminent threat to the safety of any person, and legitimate interests override the data subject's privacy interests in the circumstances.

The lawful basis is legal obligation (Art. 6(1)(c) UK GDPR) for mandatory disclosures, and legitimate interests (Art. 6(1)(f) UK GDPR) for voluntary disclosures made to prevent serious harm.

Regulatory authorities

This includes the Information Commissioner's Office (ICO) and any other competent regulatory body. We will cooperate with regulatory investigations and comply with any notices or orders issued by a supervisory authority. The lawful basis is legal obligation (Art. 6(1)(c) UK GDPR).

In all cases we will disclose the minimum personal data necessary for the purpose of the disclosure. Where we are not legally prohibited from doing so (for example, where a disclosure is not subject to a non-disclosure order), we will endeavour to notify the affected account holder before complying with a disclosure request, unless doing so could prejudice an investigation or where the nature of the report makes notification inappropriate.

---

8. How Long We Keep Your Data

We retain personal data only for as long as necessary for the purposes set out in this policy.

When an account is deleted, we cascade-delete all associated libraries, documents (including storage files), collaborators, audit logs, and subscription records. Records of actions taken by our administrators on the platform (for example a suspension), with the reference to the deleted account removed, and messages you have sent us, are not deleted with the account.

---

9. Your Rights

Under UK GDPR you have the following rights in relation to your personal data. We will respond to all valid requests within one month. If a request is complex or we receive a large number of requests, we may extend this period by up to two further months and will notify you accordingly.

Right of Access — You have the right to request a copy of the personal data we hold about you and information about how we use it.

Right to Rectification — You have the right to request that we correct inaccurate personal data or complete incomplete data. To change your display name or email address, contact us at privacy@sharedocs.net.

Right to Erasure — You have the right to request that we delete your personal data where there is no compelling reason for us to continue processing it. Note that we may be required to retain certain data for legal or regulatory purposes (for example, financial records), and that we keep data about accounts suspended for abuse as described in Section 8.

Right to Restrict Processing — You have the right to request that we restrict the processing of your personal data in certain circumstances, for example while a dispute about accuracy is resolved.

Right to Data Portability — You have the right to receive the personal data you have provided to us in a structured, commonly used, machine-readable format, and to transmit it to another controller. You can export your document libraries at any time from within the platform (Professional and Business tiers) as an AES-256 encrypted ZIP archive.

Right to Object — You have the right to object to processing based on legitimate interests. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or the processing is for legal claims.

Right to Withdraw Consent — Where processing is based on your consent (for example, marketing emails), you may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal. You can withdraw consent for marketing communications by clicking the unsubscribe link in any marketing email or by contacting us. You can also stop the getting-started tips at any time using the unsubscribe link in them.

Right Not to Be Subject to Automated Decision-Making — We make one decision about you by automated means: if a file you upload has the same fingerprint as a file from an account we have suspended for abuse, the upload is refused and your account is suspended automatically (see Section 6). We are told of every such suspension and review it. If this happens to you, you can contact us at support@sharedocs.net to ask for a person to review the decision, to give your point of view, and to contest it. We make no other decisions about you solely by automated means that have legal or similarly significant effects.

How to Exercise Your Rights

To exercise any of the above rights, please contact us at privacy@sharedocs.net. We may need to verify your identity before processing your request. There is no charge for exercising your rights unless a request is manifestly unfounded or excessive.

---

10. Security

We take the security of your personal data seriously. Our technical measures include:

• Passwords stored as PBKDF2-SHA256 hashes with 100,000 iterations and a random salt — we cannot retrieve your password (accounts that sign in only with Google, Apple, Microsoft, GitHub, a passkey or an emailed link have no password stored with us)
• All data transmitted over HTTPS/TLS
• Session tokens cryptographically signed and validated on every authenticated request
• Per-device session tracking with the ability to revoke individual sessions remotely
• Two-factor authentication (TOTP) available on all accounts
• Passkey (WebAuthn) sign-in, where we store only your passkey's public key
• All database tables protected by restrictive Row-Level Security policies — no direct client access to the database is possible
• Documents stored in a private storage bucket and served only via short-lived signed URLs
• Rate limiting on all authentication endpoints to protect against brute-force attacks

No method of transmission over the internet or electronic storage is 100% secure. If you discover a security vulnerability, please report it responsibly to security@sharedocs.net.

---

11. Children

Sharedocs is not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, please contact us at privacy@sharedocs.net and we will delete it promptly.

---

12. Changes to This Policy

We may update this privacy policy from time to time. When we make material changes, we will notify you by email (if you have an account with us) and update the "Last updated" date at the top of this document. Your continued use of Sharedocs after a change takes effect constitutes your acknowledgement of the updated policy.

Previous versions of this policy are available on request by contacting privacy@sharedocs.net.

---

13. Complaints

If you have a concern about how we handle your personal data, we would always prefer to hear from you first so we can try to resolve it. Please contact us at privacy@sharedocs.net.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's data protection supervisory authority:

---

14. Contact Us

For any questions about this privacy policy or about how we handle your personal data, please contact us: