Privacy Policy

Last updated 12 August 2026

SharedLayers lets people leave comments pinned to specific places on a web page, through a Chrome extension and a web dashboard. This policy explains what we collect, why, and what you can do about it.

Before publishing: replace [CONTROLLER] and [ADDRESS] below with your legal name or company and registered address, and confirm the contact address works. This document was drafted to describe the software accurately; it has not been reviewed by a lawyer.

Who is responsible

The data controller is [CONTROLLER], [ADDRESS], Poland. For anything in this policy, including requests about your data, write to privacy@sharedlayers.com.

What we collect

Your account

Email address, used to sign in, to send you invitations, and to contact you about the service.
Display name and, if you set one, a profile picture.
A password, stored only as a cryptographic hash — we never see or store the password itself.
If you sign in with Google, we receive your email address, name and profile picture from Google. We never receive your Google password, and we ask for no access to Gmail, Drive or any other Google service.

Your comments

The text of comments and replies you write.
The address of the page you commented on, and a technical description of the element you pinned it to — a CSS selector and coordinates. This is how a comment finds its spot again on your next visit.
The hostname of sites you create a comment layer for.
When comments were created, resolved, and which ones you have read.

We do not capture screenshots, page content, form values, or your browsing history. Nothing is recorded on a page unless you place a comment on it.

Invitations

When you invite someone, we store the address you typed so the invitation can be sent and accepted. If they never accept, the invitation expires after seven days.

Guest access

You can join a layer with an access key and a display name, without an account. Guest accounts have no email address attached, and we cannot contact you.

What the extension can do, and what it does

The Chrome extension requests access to all sites. It needs this because a comment can be left on any page you choose — the permission cannot be narrowed to a list of sites in advance. In practice the extension only reads the address of the current page and the element you click when placing a comment.

It does not read page content, inject anything into pages you have not commented on, or send anything anywhere except to our own service.

Why we are allowed to hold it

Data	Purpose	Basis (GDPR Art. 6)
Account details	Give you an account and sign you in	Performance of a contract
Comments and layers	Provide the service itself	Performance of a contract
Invitation emails	Deliver an invitation you asked us to send	Legitimate interest
Service emails	Confirm your address, reset a password	Performance of a contract

Who else processes it

We use a small number of providers, each acting on our instructions:

Provider	What for	Where
Supabase	Database, authentication, file storage	EU
Netlify	Hosting the website and dashboard	EU/US
Resend	Sending email	EU/US
Google	Sign in with Google, if you use it	US
Cloudflare	DNS for sharedlayers.com	Global

We do not sell your data, and we do not share it with advertisers. Transfers outside the EEA rely on the European Commission's Standard Contractual Clauses.

How long we keep it

Account data: until you delete your account.
Comments: until you or the layer's owner delete them.
Deleted layers: hidden immediately, permanently erased after seven days.
Unaccepted invitations: seven days.

Your rights

Under the GDPR you may ask for a copy of your data, correct it, delete it, restrict or object to how we use it, or receive it in a portable form. Write to privacy@sharedlayers.com and we will respond within one month. You can also complain to your national supervisory authority — in Poland, the President of the Personal Data Protection Office (UODO).

Cookies

We use no advertising or analytics cookies. Your browser stores a session token so you stay signed in; that is required for the service to work and cannot be turned off separately from signing out.

Children

SharedLayers is not intended for anyone under 16.

Changes

If we change this policy in a way that affects you, we will say so on this page and, where the change is significant, by email.