InstaShare

Clear boundaries over vague promises

Understand the security and privacy boundary

InstaShare is a publishing tool, not a private collaboration vault. Its safety model combines local best-effort redaction, HTTPS transport, hashed control tokens, optional account ownership, and deletion controls—with important limitations that should be understood before upload.

Know what becomes public

The transcript and extracted images are readable by anyone who obtains their URLs.

Know where controls live

Delete, claim, account, and device tokens authorize different actions and are not embedded in the normal public link.

Know what the service processes

The security and privacy pages document storage, authentication, operational providers, notifications, retention, and deletion.

Protection before and during upload

The documented skill reads the local transcript, replaces values matching its curated secret patterns in memory, and sends the transformed body to an HTTPS endpoint. The original JSONL remains untouched. Custom API clients must implement their own preprocessing.

HTTPS protects the request in transit to the service. It is not end-to-end encryption: the server must read the transcript to extract images, compute statistics, store the content, and render the public page.

Public access is the product behavior

A share does not require recipient authentication. The random slug reduces casual discovery but should not be treated as a password or strong access-control mechanism. Anyone with the link can forward it, copy it, or download its images.

InstaShare does not advertise user shares in its sitemap. Shared pages are also marked not to be indexed by compliant search engines, but those directives cannot prevent a recipient or crawler from copying content it can access.

Layered control tokens

Delete tokens authorize removal of a specific share. Device claim tokens group uploads and can later link them to an account. Account sessions enable web management, and advanced upload tokens support headless ownership. Server-side records store token hashes where the flow permits rather than retaining reusable plaintext.

These controls reduce accidental misuse; they do not make a published transcript confidential. For a detailed data-flow and operational-provider description, read the Security and Privacy pages before using InstaShare for sensitive work.

How it works

01

Classify the session

Decide whether its code, tool output, screenshots, and prose are appropriate for public-by-link access.

02

Use local safeguards

Review the skill, extend patterns, or add confirmation and project restrictions.

03

Review the result

Open the public page and inspect both conversation and tool details before distributing it.

04

Retain control

Store delete authority safely or claim the device into an account for ongoing management.

Important limits

  • InstaShare does not currently offer password-protected, invited-user, organization-only, or end-to-end encrypted shares.
  • Search-engine noindex directives reduce indexing but are not access control and are not honored by every crawler.

Related capabilities

Control

Local secret redaction

Scan the transcript on the local machine for common credential formats and replace matches before the HTTPS request body is created.

Control

Delete and revoke

Remove a public transcript with its share-specific control or an owner account, and revoke device tokens that should no longer create linked uploads.

Control

Claim and manage shares

Attach a device’s existing and future anonymous shares to a Google-authenticated account and manage them from one place.

Try it in a Claude Code session.

Install the readable skill, then say “share this chat” when the conversation is ready.

Install InstaShareRead security details