Skip to main content
ShareTool
Find

Privacy Policy

Last updated: November 3, 2026

This page describes what sharetool.com collects, which services receive it, and how to get it deleted. We wrote it from the code that runs the site, so if something here does not match what you see, tell us at hello@sharetool.com.

1. Browsing the site

Most of ShareTool is a public directory you can read without an account. While you browse, this is what happens:

  • Our host, Vercel, keeps standard server logs (IP address, request URL, user agent) for a short period to run and secure the service.
  • When you open a tool page we record the tool, the referring URL, and the time in a page view table. There is no IP address or cookie identifier in that table.
  • When you click "Visit Site" on a tool, the link goes through /go/[slug] and we log the tool, the referring URL, your browser's user agent string, and the time before redirecting you. Some destinations are affiliate links and we may earn a commission. The log does not include your IP address.
  • Tool logos load straight from the service that hosts them, usually icon.horse, logo.clearbit.com, or Google's favicon service on www.google.com. Your browser fetches each logo directly, so that service sees your IP address and browser headers, the same as any image hosted elsewhere.
  • Some tool pages embed a demo video from YouTube using the youtube-nocookie.com player. YouTube does not set cookies until you press play; once you do, Google's privacy policy applies to the player.

2. Analytics

We use Google Analytics 4 to count visits and see which pages people read. It is configured with IP anonymization, Google Signals off, and ad personalization off. We do not run advertising pixels.

The first time you visit you get a banner with Accept and Decline. If you decline, the Google Analytics script is not loaded on later visits at all. Until you choose, the script runs in Google's Consent Mode with storage denied, which means it sends cookieless aggregate pings and sets no analytics cookie. Your choice is stored in your browser under the key sharetool_cookie_consent and you can change it by clearing site data.

If your browser sends a Global Privacy Control (GPC) signal, we treat it as a decline: the analytics script is not loaded and we skip the banner. We do not respond to the older Do Not Track header, because there is no agreed standard for what it should do; GPC is the signal we honor.

3. The Find feature

When you describe what you are looking for in the Find box, your query and a list of tools from our catalog are sent to Google's Gemini API, which returns suggestions. We do not store your queries. Google processes them under its API terms.

4. Accounts

Accounts exist for tool owners. You need one to manage a Premium listing or a claimed listing; you do not need one to browse, submit a free listing, or leave a review. Supabase Auth stores your email address and a hashed password. We link the account to the tools you own so the edit pages work. When you sign in, Supabase sets session cookies (names starting with sb-) that keep you logged in.

There is no self-serve delete button yet. To close an account, email hello@sharetool.com from the address on the account and we will remove the account and the submission and claim records tied to it. See section 11 for timing.

5. Forms you fill in

The submission and contact forms are protected by Cloudflare Turnstile, which checks that you are not a bot. Turnstile runs in an iframe from challenges.cloudflare.com and sends Cloudflare your IP address and browser details. We also send your email address and IP address to StopForumSpam, a public spam reputation list, when you submit a tool, send a contact message, or start a review. StopForumSpam only answers whether that email or IP has been reported; we do not report anyone to it.

Tool submissions. We keep your email, the tool name and URL, and your notes in our database with the review status. A Premium submission also creates an account (section 4) and sends you to Stripe Checkout (section 6). Submissions that our spam checks reject are kept in a quarantine state so we can recover genuine ones.

Contact form. We do not store contact messages in our database. Your name, email, subject, message, and IP address are sent by email through Resend to our inbox. Replies go to the address you gave.

Reviews. To post a review you give a display name, an email address, a rating, and the review text. We email you a one time code through Resend. The code request stores your email in plain text, the tool, and a hash of the code. The code stops working after 15 minutes, but the request record stays in our database until you ask for a new code for the same tool or ask us to delete it. The published review stores your display name, rating, text, a hash of your email, and a hash of your IP address. We keep the hashes to stop duplicate reviews and abuse; they cannot be turned back into the original values. After you verify, we set a signed cookie named st_reviewer that holds your email and display name for 30 days so you can review other tools without a new code.

Claims. To claim a listing you give an email address. We store it with a verification code, then send you to Stripe Checkout. Once a claim is approved we store the Stripe subscription ID and its status against the claim.

6. Payments

Premium listings, sponsorships, and claims are paid through Stripe Checkout on Stripe's pages. Stripe receives your email address and payment details; card numbers never reach our servers. We store the Stripe session ID, subscription ID, and payment status, and we keep a list of Stripe webhook event IDs so that an event is not processed twice.

7. Email

All email we send (review codes, submission confirmations, claim codes and onboarding links, edit request updates, contact form forwarding) goes through Resend. Resend sees the recipient address and message content as any mail provider would. We do not send marketing email and there is no newsletter.

8. Rate limiting

To slow abuse, each submission, review, claim, and contact request is recorded in a rate limit table with your IP address and the time. A daily job deletes rows older than 24 hours.

9. Cookies and local storage

  • _ga and _ga_* (Google Analytics): set only after you accept the banner. Expire after 2 years.
  • sb-* (Supabase Auth): set when you sign in to an account. Needed to stay logged in.
  • st_reviewer: set after you verify a review. Holds your email and display name in a signed token. 30 days.
  • admin_session: set only for ShareTool staff signed in to the admin area. Visitors never receive it.
  • Cloudflare may set its own cookies inside the Turnstile iframe on forms.
  • sharetool_cookie_consent (local storage, not a cookie): remembers your Accept or Decline choice.

10. Who receives data

Besides the services named above (Vercel, Supabase, Google Analytics, Google Gemini, Cloudflare Turnstile, StopForumSpam, Resend, Stripe, YouTube, icon.horse, Clearbit, Google's favicon service), we share personal data only when the law requires it or to protect the site from abuse. We do not sell personal data and we do not share it for cross context behavioral advertising.

11. Your choices and requests

Anyone, anywhere, can ask us what we hold about them, ask us to correct it, or ask us to delete it. Send the request to hello@sharetool.com or use the contact form. We will confirm receipt within 10 business days and complete the request within 45 days; if we need longer we will tell you why. Because we only know you by your email address, we verify requests by replying to the address on file or, for reviews and submissions, by matching the address you used.

If you post a review and later want it removed, email us from the address you verified with and name the tool. For reviews we also delete the stored email and IP hashes.

12. California residents

This section adds the disclosures the California Consumer Privacy Act (CCPA, as amended by the CPRA) asks for. It covers the previous 12 months.

Categories of personal information we collect, and where each comes from:

  • Identifiers: email address, IP address, account ID, display name. Collected from you directly and from your browser or device.
  • Customer records: name on contact messages, email, Stripe customer and subscription IDs. From you and from Stripe.
  • Commercial information: Premium listings, sponsorships, and claims you have purchased, and their payment status. From you and from Stripe.
  • Internet activity: pages viewed, referring URLs, user agent, outbound clicks, analytics events if you accepted the banner. From your browser.
  • User content: tool submissions, review text, contact messages, Find queries (not stored). From you.

We do not collect precise geolocation, sensitive personal information as the CCPA defines it, biometric data, or inferences used to build a profile. Google Analytics may derive a coarse location from the anonymized IP for its reports.

We use this information to run the directory, publish listings and reviews, process payments, answer messages, prevent spam and abuse, and measure site traffic. We will not use it for a materially different purpose without updating this policy first.

We have not sold personal information in the last 12 months. We have not shared personal information for cross context behavioral advertising; Google Analytics runs with ad features disabled, and we honor Global Privacy Control as an opt-out signal. We have no actual knowledge that we collect data from anyone under 16 and we do not sell or share data of consumers under 16.

Retention:

  • Rate limit entries: 24 hours.
  • Review code requests: the code expires after 15 minutes; the record with your email stays until you request a new code for that tool or ask us to delete it.
  • Reviews, submissions, claims, and account records: while the listing or account is active, then until you ask us to delete them.
  • Page view and outbound click logs: kept for traffic reporting; they contain no identifier that can be tied back to you.
  • Stripe records: as long as needed for tax and accounting.
  • Contact messages: in our mailbox until we clear them.

Your rights under the CCPA: to know what we collect and get a copy, to delete it, to correct it, to opt out of sale or sharing (we do neither, and GPC is honored regardless), to limit use of sensitive information (we collect none), and not to be treated differently for exercising these rights.

Submit a request by email to hello@sharetool.com or through the contact form. We verify you by matching the email address you contact us from against our records, and for account requests by sending a confirmation to the account email. An authorized agent can submit a request for you if they provide your signed permission; we may still ask you to confirm directly.

The California Online Privacy Protection Act asks us to say how we handle Do Not Track: we do not act on the Do Not Track header, but we do act on Global Privacy Control as described in section 2.

Shine the Light (California Civil Code section 1798.83): we do not disclose personal information to third parties for their own direct marketing purposes, so there is nothing to request under that law.

13. Children

ShareTool is not directed at children under 13 and we do not knowingly collect personal information from them. If you believe a child has given us information, email us and we will delete it.

14. Changes

When we change this policy we update the date at the top. If a change affects how we use data you already gave us, we will say so on this page and, where we have an email address for you, by email.

15. Contact

Privacy questions: hello@sharetool.com or the contact form.