Privacy
Shard and its browser extension have no accounts, no analytics, no telemetry and no crash reporting. Nothing about you or your downloads is sent to the people who make Shard. This page lists every request Shard makes on its own and everything it keeps.
The browser extension
The extension, "Shard integration", hands your browser's downloads to the Shard app on the same computer. It:
- acts only when the browser starts a download. It has no content scripts and never reads the pages you visit;
- reads the cookies for that download's address, at that moment, so the server lets Shard fetch the file as it would have let the browser;
- sends the download's address, those cookies, the referring page and the browser's user agent to Shard at
http://127.0.0.1:47110, an address only your own computer can reach, and nowhere else; - when Shard takes the download, cancels the browser's copy; when Shard isn't running, leaves the download to the browser;
- when it's installed, says an empty hello to the same address, so Shard's setup can show it's connected.
It asks for three permissions. Downloads, to see a download start and to cancel the browser's copy. Cookies, to pass a download's cookies along with it. Access to all sites, because downloads can come from any site and the cookies are read per site, and to reach Shard on your computer. No data the extension handles is sold, used for advertising, or transferred to anyone.
What Shard sends, and to whom
The servers you download from
Shard asks the server for the file you added, over one or more connections. For downloads the extension handed over, it sends the cookies, referrer and user agent the browser gave it, exactly as the browser would have; otherwise its user agent is shard/<version>. Those servers see your IP address, as they would for any download.
GitHub, to check for updates
With "Update automatically" on (the default), Shard checks for a new version when it starts and every six hours, by fetching two small files from Shard's releases on GitHub. If there's a newer version, it downloads the build for your computer from GitHub too, and checks its signature before offering to restart. These requests carry only the user agent shard/<version>. Turn "Update automatically" off in Shard's limits panel to stop them.
Nothing else
The fonts and icons are built in, notifications are your system's own, and finding your networks to combine them happens on your computer. There are no other requests.
What Shard keeps on your computer
Everything stays in your user account, in Shard's data folder: ~/Library/Application Support/shard on macOS, %APPDATA%\shard on Windows, ~/.local/share/shard on Linux.
- A database of your downloads (address, folder, name, size, progress, status) and your settings.
- For downloads from the extension, the cookies, referrer and user agent, so they can resume after a pause, a crash or a restart. They're removed when the download finishes. On macOS and Linux the folder is readable only by you.
- Update builds Shard downloaded, until they're installed.
Next to an unfinished download, in its folder, are the bytes so far and a small file recording how far each part got. Both go when the download finishes or is removed.
With "Offer copied links" on (the default), Shard looks at the clipboard once a second for a single web link to a file, so it can offer to download it. It doesn't store or send what it sees there.
Deleting it
Removing a download from the list deletes what Shard kept about it. To delete everything, uninstall Shard and choose to delete its history and settings, or quit Shard and delete the data folder. Removing the extension from your browser removes the extension and everything it had.
This website
This site is static, hosted by GitHub Pages, with no analytics, cookies or third-party scripts. To show the latest release, your browser asks GitHub's API for it. GitHub's own privacy statement covers those requests and the page views.
Questions
Ask in Discussions, or report a security problem privately through GitHub. If Shard ever makes a new kind of request, this page changes with it.