What we know,and for how long.
This policy is written from what the database and the code actually hold. Every retention period below is a constant you can find in the source.
1. Who is responsible for your data
The controller is Błażej Paździor, trading as mr.b Błażej Paździor, ul. Łabędzka 38B, 44-121 Gliwice, Poland, NIP 6312420910. Contact for anything about data: hello@mrb.pl. We have not appointed a data protection officer, because the scale of processing does not require one.
2. What this policy covers
It covers the site sharegrab.mrb.pl, the file preview pages (addresses of the form sharegrab.mrb.pl/<14 characters>), the panel at /app and the sharegrab app for macOS. sharegrab turns a screenshot, a recording or a file into a link. Only a person whose email address is on a list kept by the controller can open an account. Registration is not open.
The policy describes three situations:
- you open a link someone sent you (section 3),
- you have an account and upload files (sections 4 and 5),
- your data is inside a file someone else uploaded (section 6).
3. If you open a link
When you open a file preview page, the application records only the file identifier and the time. It does not record your IP address, browser, system or the page you came from. This record is a view counter for the file's owner and is removed after 90 days.
If the file is password-protected, after you enter the password correctly your browser receives a technical cookie with a signed token, so that you do not retype the password on every refresh. The cookie is limited to that single file, does not contain the password, and stops working when the token expires or when the owner changes the password. Wrong attempts are counted against a cryptographic hash of your IP address (SHA-256 with a fixed prefix) to limit guessing to 10 tries per 15 minutes; that hash is removed after one hour.
The preview page loads no scripts, fonts or images from other servers and contains no analytics.
4. If you have an account
An account needs an email address. Login is by link or by a six-digit code sent to that address, without a password. We keep:
| Data | Why |
|---|---|
| email address (as typed and normalised), internal account identifier, creation date | running the account and sending login codes |
| SHA-256 hashes of the login link, the code and the attempt identifier, number of wrong code tries | passwordless login; the database holds no codes or links themselves |
| SHA-256 hash of the session token, expiry date | staying logged in for 30 days |
After login your browser receives a session cookie sg_sess (HttpOnly, Secure, SameSite=Lax) used only to open your own private files in the browser. The panel keeps the session token and your theme and view preferences in the browser's local storage.
5. Files you upload
For each file we store: the file contents, name, type, size, upload date, expiry date, the "private" flag, a password hash (PBKDF2, if you set a password), the date it was moved to trash, and a privacy receipt if the file came from the macOS app. The receipt lists the categories of data the app redacted before upload, their count, the scan time and the SHA-256 of the file. For images we create a thumbnail and a smaller preview.
We do not scan files on the server, we do not look at them and we do not pass them to anyone. Anyone who knows the link can download the file, unless you mark it private or set a password.
6. If your data is in someone else's file
The person uploading a file is responsible for its contents and for whether they may share it. Before upload, the macOS app recognises and offers to cover typical personal data (email addresses, PESEL, IBAN, card and phone numbers), but the decision belongs to the uploader. If a file available through a link contains your data and you want it removed, write to hello@mrb.pl or use the form at /report. For the contents of files uploaded by users, the uploader decides what is shared and the controller stores and serves the file on the uploader's instruction. Requests to remove content are handled the same way as requests about your own data.
7. Why, and on what legal basis
| Purpose | Basis under art. 6(1) GDPR |
|---|---|
| running the account, storing and sharing files through links, sending login codes | (b), performance of a contract for a service provided electronically |
| a view counter without identifying data, the password attempt limit, abuse prevention | (f), legitimate interest: security of the service and information for the file owner |
| handling reports of illegal content and requests from authorised authorities | (c), legal obligation (Digital Services Act, Regulation (EU) 2022/2065) |
8. For how long
| Data | Period |
|---|---|
| files, thumbnails, previews and their metadata | until the expiry you set (from 10 minutes to indefinitely), then a 24-hour grace period with the option to restore, then permanent removal |
| files in trash | 24 hours, then permanent removal |
| account | until you remove it; removing the account removes all your files immediately |
| login attempts | 15 minutes |
| sessions | 30 days |
| record of link openings (file identifier and time) | 90 days |
| IP hash from password attempts | 1 hour |
Cleanup runs automatically after each of these periods.
9. Who receives the data
Data is stored with the hosting provider Globtel Internet Szymon Hersztek (webd.pl), ul. Matecznikowa 2/1, 80-126 Gdańsk, Poland, NIP 9570804786, which stores the data on our behalf under its hosting terms. Login emails are sent from our own mailbox on the same hosting. We use no external analytics, CDNs, web fonts or advertising services. We do not transfer data outside the European Economic Area.
The hosting provider's web server keeps standard connection logs (IP address, browser, page address, time) independently of our application. The application has no access to them; the provider decides how long they are kept.
We may disclose data to authorised authorities when the law obliges us to.
10. Cookies and browser storage
| Name | Where | Purpose | Lifetime |
|---|---|---|---|
sg_sess | cookie, HttpOnly, Secure, SameSite=Lax | opening your own private files after login | 30 days |
sgpw_<file id> | cookie, HttpOnly, Secure, SameSite=Strict | remembering that you entered the password for one file | until the token expires (at most 6 hours) or the password changes |
sg_session, sg_theme, sg_view | browser local storage, panel only | panel session, theme, list view | until logout or clearing the browser |
All of them are necessary for the service to work, so we do not ask for consent and there is no cookie banner. We use no analytics or advertising cookies.
11. The macOS app
The app runs on your computer. Text and face recognition and data redaction happen locally, through Apple's system frameworks, without sending the image anywhere before you agree. The app connects only to sharegrab.mrb.pl, collects no usage statistics, sends no crash reports and checks for no updates. It keeps the session token in the macOS keychain and settings in user defaults. It asks for permission to record the screen, and for the microphone only when you turn on sound for a recording.
12. Your rights
You have the right to access your data, to have it corrected, removed, or its processing restricted, to data portability, and to object to processing based on legitimate interest. You can remove your account together with your files yourself, in the app or in the panel; send other requests to hello@mrb.pl. We answer within a month at the latest. You also have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes UODO), ul. Stawki 2, 00-193 Warsaw, Poland.
13. How we protect data
Transmission is encrypted (TLS). The database holds no passwords, codes or tokens in plain form, only their hashes. Files and the database sit out of reach of any URL. Preview pages carry strict security headers, and files that could run code in a browser are downloaded, not opened. Only the logged-in owner can access private files. The application code has been through several security audits and is covered by automated tests. If a personal data breach could affect you, we will inform you and the President of UODO in line with articles 33 and 34 GDPR.
14. Illegal content
If a link points to content that breaks the law or your rights, report it through the form at /report or to hello@mrb.pl. A report only needs the link and a reason; contact details are optional, but without them we cannot reply. We confirm receipt, review the report without undue delay and inform you of the decision. The same address is the point of contact for authorities and users under articles 11 and 12 of the Digital Services Act.
15. Changes
We announce changes to this policy on this page, with a date and version number. Earlier versions are available on request.
Contact: hello@mrb.pl