Full policy with any updates: https://sessionshare.dev/privacy/

This policy describes the Session Share browser extension (for Chrome, Edge and Firefox) and the Session Share Plus purchase, provided by SharkX AI, the trading name of Shayu Liang, an individual developer. Contact: support@sessionshare.dev.

• Your saved logins (cookies, optional Web Storage, the login record of websites that sign in with Firebase, account names) stay encrypted in your browser. We never receive them.
• No account and no tracking of your browsing; only anonymous daily usage totals, including the website (such as netflix.com) where a copy, paste, switch or save succeeded or failed. You can turn them off. In Edge they never include the website; in Firefox they are sent only if you allow it when you install.
• The free version shows one contextual ad from AdsOnBread (in Firefox only if you allow it when you install), which receives only a short-lived random token, your browser language and whether the ad was seen or clicked.
• Buying Plus is handled by Creem; our billing service stores only an anonymous installation record.

The Chrome Web Store, Microsoft Edge Add-ons and Firefox Add-ons each ask an extension to disclose the kinds of data it handles. The labels below are the Chrome Web Store's; the other stores ask about the same kinds of data, sometimes under other names. For Session Share they mean:

• Authentication information: the cookies of a website when you save, switch, copy or paste its login; they are what keeps you signed in there. On websites that sign in with Firebase, whose login is not a cookie, also that site's Firebase login record. They stay encrypted in your browser and leave it only inside a share code that you copy and send yourself. They are never sent to us or to advertisers.
• Website content: a site's Local Storage and Session Storage, only if you turn on Also save Web Storage for that site. Handled like cookies: kept on your device, or inside a share code you send.
• User activity: whether the ad was seen or clicked, sent to AdsOnBread with a random token that is replaced every 24 hours, and the anonymous daily usage counts sent to us, which you can turn off. Neither includes a cookie, account name or identifier; the usage counts name only the website (such as netflix.com) of a copy, paste, switch or save you performed.
• Web history: in a narrow sense only. The usage counts name a website's domain (such as netflix.com) when you copy, paste, switch or save there, added up per day without any identifier. We never receive the pages you visit, their addresses or titles, or a list of the websites you browse.

Edge and Firefox. In Edge, the usage counts never name a website. Firefox asks when you install Session Share which optional data it may collect: the usage counts are sent, and the ad is shown, only if you allow technical and interaction data, and the counts name a website only if you also allow browsing activity. Without these choices no usage counts are sent and no ad is requested. You can change them later in Firefox's add-on settings.

As we declare in each store, this data is not sold, is used only for the extension's features, and is never used to decide creditworthiness or lending.


When you save, switch, copy or paste a login, the extension reads and writes the current site's cookies, and Local Storage and Session Storage only if you enable that for the site. On websites that sign in with Firebase it also reads and writes their Firebase login record (the firebase:authUser: entry in the page's IndexedDB, Local Storage or Session Storage) and nothing else of that storage; it looks for that record only when you open the popup on the site or act on it there, never in the background. Saved logins, their names, sites and times are stored in the browser's extension storage, encrypted with AES-GCM using a key kept in the same browser profile. This protects them from casual inspection, not from someone with access to your unlocked computer. Auto-save is off until you turn it on for a site. Uninstalling the extension deletes this data.


Share codes are created only when you copy one and contain the login they share: the site's cookies and, for websites that sign in with Firebase, its Firebase login record. By default that record goes without its refresh token, so the recipient stays signed in to that site for at most about an hour. Only if you choose Include long-term login and confirm its risks does the code carry the refresh token: the recipient then stays signed in until you change that site's password, and signing out does not end it. Without a separate password, anyone holding the code can use it. The extension reads the clipboard only when you paste a session and writes to it only when you copy one. Notifications report only the result of a right-click or address-bar action.


The extension can access all websites so it can read and write the current site's cookies when you act on it; it runs no scripts in the pages you browse except on a site you act on: to look for a Firebase login when you open the popup there, to save (also automatically, if you turn auto-save on for it), switch, copy or paste a login, and to remove a timed share's Firebase login when it expires. The popup shows the current site's own icon, which the browser provides for the open tab.


This extension uses AdsOnBread to display contextual ads; in Firefox only if you allow technical and interaction data. The SDK stores a random pseudonymous token and a 24-hour expiration time in local extension storage and transmits the unexpired token, browser language, impressions, and clicks to AdsOnBread for frequency capping, billing accuracy, and fraud prevention. An expired storage record is replaced the next time the SDK runs and can also be removed by clearing extension storage or uninstalling. AdsOnBread also derives coarse country from the network request. This information is not used for behavioral advertising or cross-site profiling. See the AdsOnBread privacy policy. Website addresses, cookies, account names and share codes are never sent to AdsOnBread. Clicking an ad opens the advertiser's site, which has its own privacy practices.


When you start or restore a purchase, the extension contacts our billing service at billing.sharkx.ai, hosted on Cloudflare. It stores a hash of a random installation credential, the Creem checkout and order IDs, the purchase status, and the license key Creem issued with its device activations (so you can restore Plus on up to 3 devices), and keeps webhook event IDs for 90 days to prevent replays. Your IP address is not stored. Payment is processed by Creem, the merchant of record, which handles your name, email, payment details and tax information under the Creem privacy policy. We never see your card number.

Purchase records are kept while Plus is active and for up to 7 years after a refund or chargeback where needed for accounting. Cloudflare may process connection data (such as IP addresses) to deliver and protect the service; we do not log requests.

Once Plus is confirmed, a copy of that installation credential is kept in the browser's own sync storage, so Plus also appears on your other computers where the same browser is signed in to the same account with sync on: your Google account in Chrome, your Microsoft account in Edge, or your Mozilla account in Firefox with add-ons included in sync. It does not carry over between different browsers; there, restore Plus with the license key from your Creem receipt. In Chrome and Edge, uninstalling the extension deletes this copy too (also from the sync servers), so after a reinstall Plus is restored with that license key. The browser's maker (Google, Microsoft or Mozilla) syncs it with your other browser data; we never see that account. Free installations are not copied.


The Feedback link in the extension opens our feedback form and fills in, on your device, the website you were on, the extension version, your browser and operating system, whether it was an incognito or private window, the last error code, and the result of your last copy, paste, switch or save (such as "pasted, some cookies refused", never the cookies' names) with how many minutes ago it was; the last two only from the past day. You can change or remove the website and untick the technical details; nothing is sent until you press Send. We store what you submit (topics, website name, description, your email and the technical details you chose) and email it to our support inbox through Cloudflare, without your IP address, for up to one year or until you ask us to delete it. We use your email only to reply.


From version 3.0 the extension counts a few actions on your device each day, such as how often the popup opens and how often copy, paste, switch and save succeed or fail, and how often the right-click menu and address bar are used. Once a day it sends only these totals, with the extension version and language, to billing.sharkx.ai. There is no installation ID or other identifier, and never a cookie, account name, share code, page address or error message: errors are sent as fixed codes only. We store them added together per day, version and language, and do not log IP addresses. Turn this off at any time in the extension's Settings (Anonymous usage stats); unsent counts are then deleted. In Firefox nothing is counted or sent unless you allowed technical and interaction data.

Websites and error codes. When you copy, paste, switch or save a login, the count also names the website and, if it failed, the error code, so we can find the websites where Session Share breaks. The website is only its registrable domain, such as netflix.com for www.netflix.com/browse: never a subdomain, page address, path or query. For a paste it is the website the share code is for. IP addresses and local or intranet names are not named. An error code is a fixed name such as COOKIE_EXPIRED or NO_SESSION, never a cookie name, error message or other text. Websites you only visit are never counted. These counts are added together per day, version and language like the others. In Edge the counts never name the website, and in Firefox only if you allowed browsing activity.

The counted actions are: opening the popup, Settings, the guide, Feedback or the Stored on this device screen; copying (including whether a time limit or password was chosen or a long-term login included, never the code itself), pasting, switching, saving, renaming and deleting accounts; turning auto-save on or off; hiding the ad; the right-click menu and address bar; finding a Firebase login on the site where you opened the popup (never anything from it); installing or updating. With each day's totals the extension also says which of these it used for the first time that week or month, so we can count weekly and monthly users without any identifier. This is decided on your device and stored there as a list of action names only.

When you uninstall, your browser opens a short optional survey on this website. If you answer, we store your reason, your comment and the language, with no identifier, for up to one year.


About once a day the extension downloads a small public list of websites, such as Google, whose login is tied to the device it was created on and so cannot be moved to another device or browser. It uses the list to warn you before you copy on such a site. This is a plain download of a public file: no cookies are sent, nothing about you or the site you are on is sent, and we store nothing about it. As with any web request, Cloudflare serving the file sees your IP address to deliver it, but we do not log it.


This website does not use cookies or analytics scripts. When you open one of our other addresses (sessionshareapp.com, www.sessionshare.dev or the former sessionshare.sharkx.ai), you are redirected to sessionshare.dev and we count that visit per day with only the address you used, the website that linked to it and your country as reported by Cloudflare. We do not store your IP address, the page you asked for or any identifier.


Delete any saved login in the extension, turn auto-save off per site, or delete all local copies in the Stored on this device screen. To ask about or delete purchase records, email us with your order number.


Session Share is not directed at children under 13.


We will update the date above when this policy changes and tell you in the extension about significant changes.