What InstaShare processes and why.

Information you upload

• Session content: the Claude Code JSONL transcript, including prompts, responses, tool inputs and outputs, commands, file content, timestamps, and other recorded session events.
• Images: pasted screenshots and supported images captured in message or tool-result blocks.
• Optional session labels: model, reasoning effort, and account-plan labels supplied by the skill.
• Direct API data: any content a custom client includes in the request body or supported request headers.

The published skill performs best-effort credential-pattern redaction locally. This is not comprehensive and does not apply automatically to direct API clients. See Security.

Information generated by the service

• Share slug, title, creation and update timestamps, line and byte counts, turn counts, tool-call counts, and estimated session duration.
• SHA-256 hashes of applicable delete, claim, and upload tokens. Plaintext controls are returned or shown to the client as required by each workflow.
• Device hostname, first-used and last-used timestamps, share count, ownership state, and revocation state when a claim token is used.
• Public blob URLs and content-derived names for extracted images.

Account information

If you sign in with Google, InstaShare receives and stores the account information needed by the sign-in flow, such as your email address, display name, profile-image URL, provider account identifier, and session records. InstaShare does not receive your Google password.

Network and operational information

Hosting and application infrastructure may process request metadata such as IP address, request time, route, user agent, response status, and error details in operational logs. InstaShare does not add the upload IP to the chat database document.

When new-upload notifications are configured, the application reads the forwarding IP supplied by its hosting layer, may send that IP to IPinfo to obtain an approximate city, region, country, or network organization, and sends an operational email through SendGrid. That email may contain the IP, approximate location, public share URL, delete URL, and transcript statistics.

How information is used

• Store, render, update, and delete the shares you request.
• Extract images and compute transcript titles and statistics.
• Authenticate accounts and associate claimed devices and shares.
• Protect mutation routes with control-token or account authorization.
• Operate, diagnose, monitor, and protect the service.
• Respond to support, security, legal, and abuse requests.

InstaShare does not sell shared transcript content or use it for advertising.

Service providers

Information is processed through providers used to operate InstaShare:

• Microsoft Azure: application hosting, infrastructure, secrets management, and Blob Storage.
• MongoDB Atlas: transcript, account, token-hash, and application-data storage.
• Google: OAuth account authentication.
• Twilio SendGrid: operational upload-notification email when configured.
• IPinfo: approximate IP-location lookup for those notifications when available.

Providers may process information in countries other than your own under their applicable terms and data-protection arrangements.

Public sharing and indexing

Anyone with a share URL can read the transcript and access its referenced images. Recipients can forward, copy, download, or capture that content. Share pages are omitted from InstaShare’s sitemap and use a noindex directive, but search engines and other crawlers may ignore directives or discover links elsewhere.

Local files, browser storage, and cookies

The skill writes a per-device credentials file and a per-session sidecar on your machine. These files can contain plaintext claim or delete authority and should be protected like credentials. InstaShare’s viewer uses browser local storage to remember the selected viewing mode. Account authentication uses cookies and database-backed sessions needed to keep you signed in.

Retention and deletion

Shares are retained until deleted by a valid delete control, an owner, or InstaShare for legal, abuse, security, or operational reasons. Deleting a share removes its database record and requests removal of image blobs recorded for it. Independent copies and caches may remain.

Revoking a device stops its existing claim token from future use but does not delete earlier shares. Account deletion requests include associated account data, tokens, and owned shares, subject to records that must be retained for legal, security, fraud-prevention, or backup-cycle reasons.

Your choices and requests

• Share without creating an account.
• Delete an anonymous share with its delete URL.
• Claim shares, delete owned shares, or revoke a device from the account interface.
• Request access, correction, or deletion of account information where applicable.

Privacy, account deletion, and data requests: [email protected].