Privacy Policy

• We only collect what we need to run the community, keep it honest and get paid.
• We never sell your personal data and we don't use advertising cookies. In the EU, EEA, UK and Switzerland analytics cookies are used only if you say yes; elsewhere you can turn them off at any time.
• Card details go to our payment provider, not to us.
• You can see and correct your data in Account settings, and delete your account in Settings → Security. You can also email [email protected].

• Account: your name, email address and a securely hashed password (we never store it in plain text).
• Waitlist: your name, email, whether you're joining as a seller or tester, your referral code and who referred you.
• Platform activity: products you list (with their marketplace links and when you confirmed your right to list them), tests you claim, test reports you file, the optional link to a public review if you add one, when you agreed to disclose a free product in any public review, lum movements, requests, community posts, likes and saves, and any reader copy (ePub or PDF) you upload — stored privately and shown only to testers with an open claim on that product.
• Support: the messages you send us and our replies.
• Billing: your plan and subscription status, and invoice records from our payment provider. We don't receive your full card number.
• Technical: basic logs (like IP address and browser type) that our hosting provider records to keep the service secure and working.
• Account security: a sign-in history (time, device and browser type, and a one-way scrambled form of your IP address — never the address itself), counters of failed attempts, and — if you turn them on — your two-factor setup (stored encrypted) and your passkeys (only their public keys; your fingerprint or face never leaves your device).
• Fraud prevention: an email that is an alias of an existing account (a plus-tag, or dots in a Gmail address) suspends the new account. Sharing a network with other members does not. On the waitlist, a referral from the referrer's own network does not move them up the line. We keep a one-way fingerprint of each test report's text to spot the same report submitted twice.
• Marketplace profile: the link to your public marketplace profile, which our moderators check once to confirm you are one real member (the badge). We never ask for your marketplace login or password.
• Usage analytics: the pages you open, how long you stay and how far you scroll, which buttons and links you click, which forms you send (their name, never what you typed), the referring site and campaign tags (including which kind of ad-click tag a link carried, never its value), your device type and country. Without your consent these events carry no identifier; we only keep a daily-rotating, irreversible hash of your IP address and browser to count unique visitors. If you accept analytics cookies, we also store a random visitor id on your device so visits can be linked over time.

• Create and secure your account, and keep you signed in.
• Show products to testers, run tests and requests, and keep the lum ledger.
• Moderate test reports and prevent abuse — for example blocking self-tests and conflicts of interest.
• Protect accounts: limit repeated sign-in attempts, block automated signups, suspend likely duplicate or fraudulent accounts automatically (a person reviews every appeal), and email you when your password, two-factor or passkeys change.
• Manage the waitlist and send waitlist invites in order.
• Process subscriptions and answer support requests.
• Send service emails: invites, password resets, and important account or policy updates.
• Understand how the site is used (which pages help, where people get stuck) so we can improve it.

We rely on our contract with you to provide the service, our legitimate interest in keeping it safe and honest, and your consent where the law requires it.

• Other members: sellers see the first name of the testers working on their products, and their test reports once a moderator has verified them; community posts are visible to members. Your email isn't shown to other members.
• Our moderators and admins see what they need to approve listings, verify test reports and answer support.
• Service providers acting for us: our hosting provider Vercel (which also measures page speed and counts visits without cookies, see below), Google (Google Analytics, see below), our database provider, LemonSqueezy (payments), our email provider, Cloudflare Turnstile (a privacy-friendly check on public forms that tells people from bots; it sees your IP address and browser signals for that check only), Microlink, which opens a public product link you paste to fetch its photo when the shop blocks direct requests (it receives only that public link), and an AI model provider (Groq, Google Gemini or OpenRouter, whichever is available) that answers questions you type into the in-app assistant (it receives your question, the last few messages, the page you're on and, when you're signed in, your first name, balance, plan and counts of your open tests and products; Google's free tier may use these to improve its services, so please don't type personal details into the assistant). They may only use your data to provide their service to us.
• The law: if we are legally required to, or to protect members from fraud or harm.

We never sell personal data or share it for advertising.

• A secure session cookie keeps you signed in.
• Public forms (sign-up, sign-in, waitlist, contact) may run Cloudflare Turnstile, which uses only what it needs to tell people from bots and doesn't track you across sites.
• Your browser remembers small preferences on your own device: light/dark theme, posts you chose to hide, your waitlist code, whether you've seen the card-deck hint, and your email while you reset your password.
• We count visits and measure page speed with Vercel Web Analytics and Speed Insights. They set no cookies and don't identify you or follow you across sites: they record the page, referrer, country, device type and loading times, in aggregate.
• Our own analytics record how the site is used (see “What we collect”). Until you choose, nothing is stored on your device for them.
• We use Google Analytics 4 in Google Consent Mode. If you are in the EU, EEA, UK or Switzerland, it sets no cookies and sends only cookieless measurements until you accept analytics cookies. Elsewhere, analytics cookies (such as _ga) are on by default and you can decline them at any time. Google processes this data for us; ad storage is always off.
• Your choice is saved in a small cookie (sl_consent) that applies to sharelum.com, app.sharelum.com and books.sharelum.com, so you only answer once.
• We don't use advertising cookies, and ad storage stays off even if you accept analytics.

You can change your choice at any time:

We keep your data while your account is active. When you close your account in Settings → Security, we remove or anonymise your personal data then: your name, email, password, two-factor setup, passkeys, profile link, posts and support messages go, and usage analytics are unlinked from you. A verified test report stays so the other member keeps their record, shown as “Former member”. We keep billing records (your plan and invoices, without your name) and the security records we need to prevent fraud, such as sign-in history and report fingerprints. When you can’t sign in, email [email protected] and we’ll do the same within 30 days.

Waitlist entries are removed when you ask, when an admin removes yours, or when you close an account that joined from the waitlist. Otherwise they’re kept until the waitlist launch ends.

Security records are kept after an account is closed where we need them to prevent fraud. Rate-limit counters expire within an hour.

Raw usage-analytics events are deleted automatically after 13 months.

You can update most profile details in Account settings, and you can delete your account yourself in Settings → Security. Depending on where you live, you can also ask to access, correct, export or delete your personal data, or object to or restrict how we use it.

To make a request, email [email protected] from the address on your account. We'll reply within 30 days. You can also complain to your local data protection authority.

All traffic is encrypted (HTTPS), passwords are hashed, two-factor secrets are encrypted, repeated sign-in attempts are limited, and only the people who need it can access member data. You can turn on two-factor authentication, add passkeys, review your recent sign-ins and sign out everywhere in Settings → Security. Closing your account there asks for your password, and for a two-factor code when two-factor authentication is on. No system is perfectly secure, but if a breach affects you we will tell you promptly.

Sharelum is for adults (18+). We don't knowingly collect data from children.

If we change how we use your data in a way that matters, we'll tell you by email or in the app before it applies.

Questions or requests: [email protected].