Privacy policy

• We only collect what we need to run the exchange, keep it honest and safe, and get paid.
• We never sell your personal data and we don't use advertising cookies. In the EU, EEA, UK and Switzerland analytics cookies are used only if you say yes; elsewhere you can turn them off at any time.
• Card details go to our payment provider, not to us.
• You can see, correct or delete your data — just email [email protected].

Sharelum (we, us) runs this website and the hubs it links to: Sharelum for Amazon and Sharelum Books. Each hub keeps its members' data in its own database. This policy explains what we collect and why; a hub's own privacy page may add details that only apply there.

This website itself doesn't ask for an account. When you choose a hub to join, you go to that hub's own waitlist page.

• Account: your name, email address and a securely hashed password (we never store it in plain text).
• Waitlist: your name, email, whether you're joining to ask for reviews or to write them, an optional listing link, your referral code and who referred you.
• Platform activity: listings and their marketplace links, the reviews you claim and write (with their links), points movements, requests, community posts, likes and saves.
• Support: the messages you send us and our replies.
• Billing: your plan and subscription status, and invoice records from our payment provider. We don't receive your full card number.
• Account security: a sign-in history (time, device and browser type, and a one-way scrambled form of your IP address — never the address itself), counters of failed attempts, and — if you turn them on — your two-factor setup (stored encrypted) and your passkeys (only their public keys; your fingerprint or face never leaves your device).
• Fraud prevention: when you sign up or join a waitlist, we compare a scrambled form of your network address and your email with other signups, to stop one person from opening several accounts.
• Technical: basic logs (like IP address and browser type) that our hosting provider records to keep the service secure and working.
• Usage analytics (this website and the hubs): the pages you open, how far you scroll, which buttons and links you click, the referring site and campaign tags, your device type and country. Without analytics cookies these measurements carry no identifier; with them, a random visitor id on your device lets visits be linked over time.

• Create and secure your account, and keep you signed in.
• Show listings to reviewers, run claims and requests, and keep the points ledger.
• Moderate reviews and prevent abuse — for example blocking self-reviews and review swaps.
• Protect accounts: limit repeated sign-in attempts, block automated signups, flag likely duplicate accounts for a person to review, and email you when your password, two-factor or passkeys change.
• Manage the waitlists and send founding invites in order.
• Process subscriptions and answer support requests.
• Send service emails: invites, password resets, security alerts and important account or policy updates.

We rely on our contract with you to provide the service, our legitimate interest in keeping it safe and honest, and your consent where the law requires it (for example, analytics on this website).

• Other members: members asking for reviews see the reviewers working on their listings and their reviews; community posts are visible to members of that hub. Your email isn't shown to other members.
• Our moderators and admins see what they need to approve listings, verify reviews, review flagged accounts and answer support.
• Service providers acting for us: our hosting provider Vercel (which also measures page speed and counts visits without cookies, see below), Google (Google Analytics, see below), our database provider, LemonSqueezy (payments), our email provider, Cloudflare Turnstile (a privacy-friendly check on a hub's public forms that tells people from bots; it sees your IP address and browser signals for that check only), and Microlink, which opens a public product link you paste to fetch its photo when the shop blocks direct requests (it receives only that public link). They may only use your data to provide their service to us.
• The law: if we are legally required to, or to protect members from fraud or harm.

We never sell personal data or share it for advertising.

• On this website: your browser remembers your light/dark theme.
• We count visits and measure page speed with Vercel Web Analytics and Speed Insights. They set no cookies and don't identify you or follow you across sites: they record the page, referrer, country, device type and loading times, in aggregate.
• We use Google Analytics 4 in Google Consent Mode. If you are in the EU, EEA, UK or Switzerland, it sets no cookies and sends only cookieless measurements until you accept analytics cookies. Elsewhere, analytics cookies (such as _ga) are on by default and you can decline them at any time. Google processes this data for us; ad storage is always off.
• Your choice is saved in a small cookie (sl_consent) that applies to sharelum.com and every Sharelum hub, so you only answer once. Change it anytime with "Cookie settings" at the bottom of every page.
• On a hub: a secure session cookie keeps you signed in, and your browser remembers small preferences on your own device (such as your theme, posts you chose to hide, your waitlist code, and your email while you reset your password). A hub's public forms may run Cloudflare Turnstile to tell people from bots.
• We don't use advertising cookies anywhere, and ad storage stays off even if you accept analytics.

We keep your data while your account is active. When you ask us to delete your account, we delete or anonymise your personal data within 30 days, except records we must keep by law (such as billing records) or need to prevent fraud.

Waitlist entries are kept until the founding launch ends or you ask us to remove yours.

Security records (sign-in history and fraud signals) are kept while your account is open, so you and our team can spot misuse; rate-limit counters expire within an hour.

Depending on where you live, you can ask to access, correct, export or delete your personal data, or object to or restrict how we use it. You can update most profile details yourself in your hub's Account settings.

To make a request, email [email protected] from the address on your account and tell us which hub it's about. We'll reply within 30 days. You can also complain to your local data protection authority.

All traffic is encrypted (HTTPS), passwords are hashed, two-factor secrets are encrypted, repeated sign-in attempts are limited, and only the people who need it can access member data. On each hub you can turn on two-factor authentication, add passkeys, review your recent sign-ins and sign out everywhere in Settings → Security. No system is perfectly secure, but if a breach affects you we will tell you promptly.

Sharelum is for adults (18+). We don't knowingly collect data from children.

We update this policy as the product changes. If a change materially affects you, we'll let you know by email or in the app before it takes effect. The date at the top shows the latest version.

Questions about your privacy? Write to [email protected].