Privacy Policy

Last updated October 5, 2026

This policy describes the Session Share Chrome extension and the Session Share Plus purchase, provided by SharkX AI, the trading name of Shayu Liang, an individual developer. Contact: support@sessionshare.dev.

Summary

• Your saved logins (cookies, optional Web Storage, account names) stay encrypted in your browser. We never receive them.
• No account and no tracking of the sites you visit; only anonymous daily usage totals, which you can turn off.
• The free version shows one contextual ad from AdsOnBread, which receives only a short-lived random token, your browser language and whether the ad was seen or clicked.
• Buying Plus is handled by Creem; our billing service stores only an anonymous installation record.

Data that stays on your device

When you save, switch, copy or paste a login, the extension reads and writes the current site's cookies, and Local Storage and Session Storage only if you enable that for the site. Saved logins, their names, sites and times are stored in Chrome's extension storage, encrypted with AES-GCM using a key kept in the same browser profile. This protects them from casual inspection, not from someone with access to your unlocked computer. Auto-save is off until you turn it on for a site. Uninstalling the extension deletes this data.

Share codes and the clipboard

Share codes are created only when you copy one and contain the login they share. Without a separate password, anyone holding the code can use it. The extension reads the clipboard only when you paste a session and writes to it only when you copy one. Notifications report only the result of a right-click or address-bar action.

Permissions

The extension can access all websites so it can read and write the current site's cookies when you act on it; it runs no scripts in the pages you browse unless you save or restore Web Storage. The popup shows the current site's own icon, which Chrome provides for the open tab.

Ads (free version)

This extension uses AdsOnBread to display contextual ads. The SDK stores a random pseudonymous token and a 24-hour expiration time in local extension storage and transmits the unexpired token, browser language, impressions, and clicks to AdsOnBread for frequency capping, billing accuracy, and fraud prevention. An expired storage record is replaced the next time the SDK runs and can also be removed by clearing extension storage or uninstalling. AdsOnBread also derives coarse country from the network request. This information is not used for behavioral advertising or cross-site profiling. See the AdsOnBread privacy policy. Website addresses, cookies, account names and share codes are never sent to AdsOnBread. Clicking an ad opens the advertiser's site, which has its own privacy practices.

Plus purchases

When you start or restore a purchase, the extension contacts our billing service at billing.sharkx.ai, hosted on Cloudflare. It stores a hash of a random installation credential, the Creem checkout and order IDs, the purchase status, and the license key Creem issued with its device activations (so you can restore Plus on up to 3 devices), and keeps webhook event IDs for 90 days to prevent replays. Your IP address is not stored. Payment is processed by Creem, the merchant of record, which handles your name, email, payment details and tax information under the Creem privacy policy. We never see your card number.

Purchase records are kept while Plus is active and for up to 7 years after a refund or chargeback where needed for accounting. Cloudflare may process connection data (such as IP addresses) to deliver and protect the service; we do not log requests.

Once Plus is confirmed, a copy of that installation credential is kept in Chrome's sync storage, so Plus also appears on your other computers signed in to the same Chrome account when Chrome sync is on. Uninstalling the extension deletes this copy too (also from Google's servers), so after a reinstall Plus is restored with the license key from your Creem receipt. Google syncs it with your other Chrome data; we never see your Google account. Free installations are not copied.

Feedback

The Feedback link in the extension opens our feedback form and fills in, on your device, the website you were on, the extension version, your browser and operating system, whether it was an incognito window and the last error code. You can change or remove the website and untick the technical details; nothing is sent until you press Send. We store what you submit (topics, website name, description, optional email and the technical details you chose) and email it to our support inbox through Cloudflare, without your IP address, for up to one year or until you ask us to delete it. We use your email only to reply.

Anonymous usage counts

From version 3.0 the extension counts a few actions on your device each day, such as how often the popup opens and how often copy, paste, switch and save succeed or fail, and how often the right-click menu and address bar are used. Once a day it sends only these totals, with the extension version and language, to billing.sharkx.ai. There is no installation ID or other identifier, and never a website, cookie, account name, share code or error text. We store them added together per day, version and language, and do not log IP addresses. Turn this off at any time in the extension's Settings (Anonymous usage stats); unsent counts are then deleted.

The counted actions are: opening the popup, Settings, the guide, Feedback or the Stored on this device screen; copying (including whether a time limit or password was chosen, never the code itself), pasting, switching, saving, renaming and deleting accounts; turning auto-save on or off; hiding the ad; the right-click menu and address bar; installing or updating. With each day's totals the extension also says which of these it used for the first time that week or month, so we can count weekly and monthly users without any identifier. This is decided on your device and stored there as a list of action names only.

When you uninstall, Chrome opens a short optional survey on this website. If you answer, we store your reason, your comment and the language, with no identifier, for up to one year.

Website visits

This website does not use cookies or analytics scripts. When you open one of our other addresses (sessionshareapp.com, www.sessionshare.dev or the former sessionshare.sharkx.ai), you are redirected to sessionshare.dev and we count that visit per day with only the address you used, the website that linked to it and your country as reported by Cloudflare. We do not store your IP address, the page you asked for or any identifier.

Your choices

Delete any saved login in the extension, turn auto-save off per site, or delete all local copies in the Stored on this device screen. To ask about or delete purchase records, email us with your order number.

Children

Session Share is not directed at children under 13.

Changes

We will update the date above when this policy changes and tell you in the extension about significant changes.