Privacy Policy

Last updated 3 October 2026

ShareTree lets a business collect anonymous feedback from its customers. This policy explains what we collect, why we collect it, who else sees it, and how to have it removed. It is written to be read, not to be survived.

Who we are

ShareTree is operated by ShareTree LLC. For anything in this policy, including a request to delete your data, email support@sharetree.app.

If you left feedback for a business

We do not ask who you are. Leaving feedback requires no name, no account and no email address.

When you send feedback we store:

  • the message you wrote, and the star rating you chose;
  • any photos you chose to attach;
  • the date and time;
  • which ShareTree you scanned, so the business knows where the feedback came from;
  • a random identifier stored in your browser (the STC_DeviceId cookie). It is not linked to your name or any account. It exists so you can come back and read the business's reply, so a conversation stays yours, and so repeated submissions can be rate-limited.

We do not store your IP address with your feedback, and we do not use advertising cookies or sell anything to anyone.

If you give an email address — which is optional, and only used so we can tell you the business has replied — we store it against that conversation and use it for nothing else.

The business whose ShareTree you scanned can read your feedback. They see the message, the rating, any photos and the time, but not your name, email or device identifier. If you write something that identifies you, they will of course see that too.

If you run a business on ShareTree

We store the account information you give us: your email address, a securely hashed password, your business name, your plan, and any locations and ShareTree names you create. We also store:

  • the feedback your customers send you, and your replies;
  • scan counts for each ShareTree, so you can see how many people scanned without writing;
  • web push subscriptions, if you turn notifications on;
  • billing identifiers from Stripe if you subscribe to a paid plan. We never see or store your card details — Stripe handles payment information directly.

Cookies

We use a small number of cookies, and none of them are for advertising:

  • Sign-in cookies, so a business owner stays logged in.
  • STC_DeviceId, the random identifier described above, so a customer can return to their own conversation.
  • Analytics, used to count page views and diagnose errors. IP addresses are masked before we see them.

Who else processes your data

We use a small set of providers to run the service. They process data on our behalf and nothing more:

  • Microsoft Azure — hosting, databases and backups, in the United States.
  • SMTP2GO and Brevo — sending email such as login codes and notifications.
  • Stripe — subscription payments for paid plans.
  • Cloudflare — the anti-spam check on our public forms.
  • Printful — only if you order printed materials, and only the name and address needed to post them.

We do not sell personal data, and we do not share it for advertising.

How long we keep things

  • Feedback and replies are kept until the business deletes them or closes its account.
  • Account information is kept while the account is open.
  • Backups are encrypted and kept for 30 days, then deleted automatically. Something you delete today can still exist in a backup for up to 30 days.

Your choices

  • Customers: you can delete a conversation from your side at any time, and clearing your browser data removes the identifier that links you to it.
  • Business owners: you can edit or delete your ShareTrees and conversations, turn off notification emails from your account page, and ask us to delete your account entirely.
  • Anyone: email support@sharetree.app to ask what we hold about you, to correct it, or to have it deleted. We will act within 30 days.

Children

ShareTree is a tool for businesses and is not directed at children under 13. We do not knowingly collect their information.

Security

Traffic is encrypted in transit, passwords are stored hashed, backups are encrypted, and access to the production system is limited to the operator of ShareTree. No service can promise perfect security, and we will not pretend otherwise — but if a breach ever affects your data, we will tell you promptly.

Changes

If this policy changes in a way that matters, we will update the date at the top and, for material changes affecting business accounts, send an email.

Questions: support@sharetree.app