Privacy Policy
Read this first — scope. sharp is self-hosted software. This policy covers only the two services we operate: this website (sharp.davideghiotto.it) and the hosted instance atapp.sharp.davideghiotto.it. If you use sharp on a server run by your employer, your community or yourself, we are not involved and we hold none of your data — that operator is the data controller, and their policy applies. See self-hosted deployments.
1. Who is responsible
The data controller for both services is Davide Ghiotto, an individual based in Italy, acting as the operator of the sharp project. Contact for any privacy matter — including the rights listed in section 10:[email protected].
No Data Protection Officer is appointed: the processing here is small-scale and none of the criteria in Article 37 GDPR apply. Requests go to the address above and are handled by the operator personally.
2. The website
sharp.davideghiotto.it is a static site. It sets no cookies, runs no analytics, embeds no third-party scripts, fonts, pixels or iframes, and loads nothing from a CDN — the typeface ships with the page. We build no profile of you and we cannot: there is nothing collecting.
What does exist is ordinary web-server logging by our hosting provider, needed to serve the page and to keep the machine reachable: your IP address, the requested URL, the referrer, the user agent, and a timestamp. Those logs are retained for a short period (currently up to 30 days) and are used only for delivery, error diagnosis, and abuse or attack mitigation. They are not combined with anything else and never used for advertising.
3. The hosted instance
app.sharp.davideghiotto.it is a sharp workspace we run. It is provided free of charge, best-effort, and without any service guarantee (see theTerms of Service). If you hold an account there, the following data exists on our server.
| Category | What it is | Where it comes from |
|---|---|---|
| Account | Email address, display name, avatar, an Argon2 hash of your password (never the password), passkey public keys, and — if you signed in with Google or GitHub — the provider name plus the opaque user id that provider assigns you | You, at registration; or the provider you chose to sign in with |
| Workspace content | Messages, thread replies, reactions, uploaded files and images, collaborative docs, canvases, boards and comments, polls, calendar events, and the channel memberships that scope them | You and the people you work with |
| Encrypted DMs | If you enable end-to-end encryption, we hold opaque ciphertext and your device public keys. The server performs no cryptography and cannot read those messages | Your devices |
| Operational state | Presence and last-seen, read markers, notification records, notification preferences and quiet hours, your interface preferences | Generated as you use the app |
| Push tokens | Web-push subscription endpoints and Apple push tokens, per device, if you turn notifications on | Your browser or desktop app, with your permission |
| Calls | Who is in a room and when, plus mute/camera/screen-share state. Audio and video are relayed live and not recorded. Transcripts and meeting notes exist only if someone in the call turns them on | Generated during a call |
| Search and AI index | Vector embeddings of messages and docs, used by the assistant. Every retrieval re-checks your channel membership and doc role, so the assistant cannot surface anything you could not already open. Encrypted DMs are never indexed | Derived from workspace content, only when the assistant is configured |
| Security records | Login-related tokens (short-lived, hashed), and server logs as described in section 2 | Generated on sign-in |
What we do not do, on either service: no advertising, no ad or social tracking, no selling or renting of personal data, no sharing for anyone else's marketing, no automated decision-making or profiling with legal effect, and no product telemetry — the sharp application ships with none, which isdocumented and auditable in the source.
4. Why we are allowed to process it
- Performance of a contract (Art. 6(1)(b) GDPR) — your account and your workspace content. You cannot have a chat service that does not store your messages.
- Legitimate interests (Art. 6(1)(f)) — server logs, rate limiting and abuse prevention, keeping the instance secure and available. Our interest is running a service that is not knocked over or abused; the data involved is minimal and short-lived.
- Consent (Art. 6(1)(a)) — optional features you switch on yourself: push notifications, Google Calendar sync, GIF search, the AI assistant, transcription. Each is off until you act, and withdrawing consent is turning it back off.
- Legal obligation (Art. 6(1)(c)) — only where the law requires us to retain or disclose something. This has not happened to date.
5. Third parties that may see data
We use as few as possible, and most of them are optional features that stay completely inert until enabled. Nobody in this list receives data for their own purposes.
| Recipient | What reaches them | When |
|---|---|---|
| Our hosting provider | Everything, as the infrastructure the server and its Postgres database run on, plus request logs | Always — it is where the service lives |
| Resend (email delivery) | Your email address and the message body, for transactional mail only — password resets. No newsletters | When such an email is sent |
| AI provider (OpenAI-compatible endpoint) | The question you ask the assistant plus the workspace excerpts retrieved to answer it; and, for transcription, the call audio chunks | Only when you use the assistant or turn transcription on |
| Sign-in: the OAuth exchange, from which we keep your provider id and verified email. Calendar sync: your events, in both directions | If you sign in with Google, or connect your calendar | |
| GitHub | Sign-in: as above | If you sign in with GitHub |
| GIPHY | Your search term and the request metadata that comes with any HTTP call | Only while the GIF picker is open |
| Media relay (LiveKit) | Live audio, video and screen-share streams, and the network addresses needed to connect peers | Only during a call. Our LiveKit runs on our own infrastructure and stores no media |
Each of these acts as a processor on our instructions, under a data processing agreement where the GDPR requires one. We may also disclose data if compelled by a valid legal order, or to protect the rights and safety of users — and we will tell you unless we are legally barred from doing so.
6. Transfers outside the EEA
Some processors above operate from outside the European Economic Area, principally the United States. Those transfers rely on the European Commission's Standard Contractual Clauses, on an adequacy decision where one covers the recipient, or on your explicit consent for the optional features involved. You can ask us which mechanism applies to a given recipient at [email protected].
7. How long we keep it
- Workspace content — until it is deleted. Deleting a message blanks its content and marks it deleted; channels with disappearing messages drop content on their own timer.
- Your account — until you ask us to delete it, after which the account and its personal data are removed. Content you posted in shared channels may be retained in de-identified form where removing it would destroy other people's conversations; say so in your request if you want it purged too.
- Backups — rolling, and overwritten within 30 days, so a deletion may persist in a backup for that window before it ages out.
- Server logs — up to 30 days.
- Password-reset tokens — one hour, stored only as a SHA-256 hash, and invalidated the moment they are used.
- Sign-in handoff codes — 60 seconds, single use.
- Push tokens — until you disable notifications or the device stops accepting them, at which point they are pruned automatically.
- Call metadata — for the lifetime of the room; rooms are ephemeral and vanish when the last participant leaves.
8. Security
Traffic is TLS-encrypted end to end at the transport layer. Passwords are hashed with Argon2 and are not recoverable — nobody, including us, can read them or reset them to a value we know. Sessions are signed tokens with a fixed expiry. Access to workspace content is authorised per channel and per document on every request, including for the AI assistant. Optional end-to-end encrypted DMs use per-device X25519 and Ed25519 keys, so the server holds only ciphertext.
No system is perfectly secure. If we become aware of a breach affecting your personal data we will notify the Italian supervisory authority within 72 hours where the GDPR requires it, and notify you directly where the risk to you is high. To report a vulnerability, email [email protected] rather than opening a public issue.
9. Cookies and local storage
The website sets nothing at all. The app is not cookie-based either: your session token and your interface preferences live in your browser's local storage undersharp.* keys, and clearing site data signs you out and resets them. The only cookie the app uses is a short-lived, HttpOnly one set during a social sign-in to protect that flow against cross-site request forgery. Both are strictly necessary, so neither needs a consent banner — which is why you are not seeing one.
10. Your rights
Under the GDPR you may, at any time:
- ask what we hold about you and get a copy (access, Art. 15);
- have inaccurate data corrected (rectification, Art. 16);
- have your data deleted (erasure, Art. 17);
- have processing limited while a dispute is resolved (restriction, Art. 18);
- receive your data in a portable, machine-readable form (portability, Art. 20);
- object to processing based on legitimate interests (Art. 21);
- withdraw any consent you gave, without affecting what was lawful before (Art. 7(3)).
Write to [email protected]. We reply within 30 days, free of charge, and we may ask you to confirm control of the account's email address before acting — not as an obstacle, but so we do not hand your data to someone else.
If you are unhappy with how we handled it you can complain to your local data protection authority. In Italy that is the Garante per la protezione dei dati personali(garanteprivacy.it).
11. Children
The services are not intended for anyone under 16, and we do not knowingly create accounts for children. If you believe a child has registered on our instance, write to[email protected] and we will delete the account and its data.
12. Self-hosted deployments
This is the part most people are actually here for. When you run sharp yourself:
- the software contains no analytics, no telemetry and no error reporting, and makes no outbound request of its own accord;
- every integration — email, AI, calendar, GitHub, GIFs, push, object storage — stays inert until you set its environment variable, and the feature is hidden from the UI until then;
- we receive nothing: no ping, no licence check, no usage count. We cannot tell that your instance exists;
- you are the data controller for your users' data, and writing their privacy notice is your job, not ours.
The claim above is verifiable rather than promised — the network-destination inventory ships with the app and iskept in the repository. Downloading a release from GitHub is a request to GitHub, governed by their privacy policy, not ours.
13. Changes to this policy
If the data flows change, this page changes with them, and the effective date at the top moves. Material changes affecting the hosted instance are announced in the workspace before they take effect. Because this site is open source, you can also read the exact diff of any revision. Continuing to use the services after a change means you accept the updated policy.
Questions: [email protected] · Terms:Terms of Service · The instance:app.sharp.davideghiotto.it