Privacy Policy

Information we collect

Account information. Marcal Share sign-in works exclusively through Google OAuth. We receive your name, email address, and profile photo from Google — we never see or store your Google password.

Content you upload. The HTML files you upload to Marcal Share, and the title you give each one.

Sharing details. The email addresses you invite to a file, and any expiration date you set on that access (Premium plan).

View history. For files you own, we log when someone you've invited opens it, so you can see who has viewed it and when. We do not log your own views of your own files.

Billing information. If you upgrade to Premium, our payment processor, LemonSqueezy, collects and stores your payment details directly — we never receive or store your card number. We receive only your subscription status and a LemonSqueezy customer identifier, which we use to know which plan you're on.

Correspondence. If you email us directly, we keep that correspondence to respond to you and for our records.

How we use this information

• To operate Marcal Share: authentication, storing and serving your files, enforcing who can view them, and showing your view history.
• To send transactional emails, such as notifying someone you've invited that they now have access to a file. We do not send marketing email.
• To enforce plan limits and rate limits, which helps prevent abuse of the service.
• To respond to support requests sent to us directly.

Who we share it with

We don't sell your data. We use the following service providers to run Marcal Security and Marcal Share, each of which processes data only as needed to provide their service to us:

• Supabase — authentication and our database (account records, file metadata, sharing rules).
• Cloudflare R2 — private storage for the HTML files you upload. The bucket is never exposed publicly; files are only ever served through our own access-controlled endpoint.
• Cloudflare Web Analytics — cookieless, aggregated traffic analytics on marcalsecurity.com.
• Vercel — application hosting.
• Upstash — Redis used only to count requests per user for rate limiting; it doesn't store your content.
• Resend — delivery of the "you've been given access" notification email.
• LemonSqueezy — payment processing for the Premium plan, acting as merchant of record.
• Google — sign-in (OAuth).

We may also disclose information if required to by law, or to protect the rights, property, or safety of Marcal Security, our users, or others.

How we protect it

• Every user can only read or write their own data — enforced at the database level (row-level security), not just in application code.
• Uploaded HTML renders inside a sandboxed iframe that can run scripts but can't read cookies, local storage, or otherwise talk to marcalsecurity.com.
• Uploaded content is served with a Content-Security-Policy that blocks it from sending data to external servers.
• Shared access can be time-limited, and expired access stops working automatically.

How long we keep it

We keep your files and account data for as long as your account is active. If you delete a file, we delete it from storage. If you close your account (see below), we delete your files, account record, and sharing rules within a reasonable time. Billing records are retained as required by LemonSqueezy and applicable tax and accounting law, independent of your account status with us.

Your choices

Marcal Share doesn't yet have a self-serve way to delete your account. To access, correct, export, or delete your data, or to close your account entirely, email sebastian@marcalsecurity.com from the address on your account. We aim to act on these requests within 30 days, consistent with applicable data protection law.

Cookies

Marcal Share sets a session cookie through Supabase so you stay signed in — this is required for the tool to work and isn't used for tracking. Cloudflare Web Analytics on the marketing site is cookieless. We don't use third-party advertising or tracking cookies.

Children's privacy

Marcal Security and Marcal Share are not directed at children, and we don't knowingly collect information from anyone under 16.

International data transfers

Our service providers operate infrastructure in multiple countries, so your information may be processed outside the country you live in. We choose providers that maintain appropriate safeguards for the data they process on our behalf.

Changes to this policy

We may update this policy as the product changes. We'll update the date at the top of this page, and for material changes we'll make a reasonable effort to notify you directly (for example, by email).

Contact

Questions about this policy or your data can be sent to sebastian@marcalsecurity.com.