Privacy policy
Bandwidth Sharing pays people for sharing the internet connection their computer or phone is not using. That involves personal data, so this page says exactly what is stored, why it is allowed, who else sees it, and how long it stays. It is written to be read.
Last updated 24 October 2026.
Who is responsible
Obsidian UG (haftungsbeschränkt), Leopoldstr. 2-8, 32051 Herford, Germany, represented by its managing director Billal Ainaoui. Registered at Amtsgericht Bad Oeynhausen, HRB 20982. Questions about your data go to [email protected].
What is stored, and why it is allowed
Each row says what is stored, what it is for, and which part of the GDPR permits it. Nothing here is collected for advertising, and nothing is sold.
| What | What for | Legal basis |
|---|---|---|
| Your email address and a password hash | Your account, signing in, the confirmation link, a password reset. | Art. 6(1)(b): we cannot keep an account for you without it. |
| Only if you sign in with Google: the id Google gives your Google account, and the email address Google confirms for it | Signing you in with Google, and knowing it is the same Google account next time. | Art. 6(1)(b): it is the way in you chose. Closing your account removes it. |
| That you confirmed you are 18 or older, and when | The age this service is for. | Art. 6(1)(b). |
| Sign-ins: the time, your IP address and your browser's description | Showing you your own sessions, and noticing a stolen password. | Art. 6(1)(f): keeping accounts from being taken over. |
| Every consent you give or withdraw, with the exact wording you saw and its version | Proving what you agreed to, which is the point of consent. | Art. 7(1): we must be able to demonstrate it. |
| Each device you set up to share: the name and system it reports (on a phone, its model), the app's version, the IP address and country it was set up from, whether it is online, and how much the network counted for it | Running the sharing you switched on, paying you per gigabyte, and noticing one connection used by many accounts. | Art. 6(1)(a) for the sharing itself, which you can switch off at any time; Art. 6(1)(b) for paying you. |
| Your balance, every movement of it, and what each settlement paid for | Your money. Each line says what it was, when, and what the balance was afterwards. | Art. 6(1)(b), and Art. 6(1)(c) for the accounting record. |
| Cash-outs: the amount and the address the gift card goes to | Sending you what you asked for. | Art. 6(1)(b). |
| Visits to this website: the page, the site that sent you there, your browser and system, your screen size and your country | Knowing which pages people read and how they find them. Counted by a program on our own server; no other company receives it. | Art. 6(1)(f). No cookie is set, and your IP address is not stored. |
What sharing means for your data
When a device of yours shares, other companies' web requests go out through your internet connection, so the websites they visit see your IP address. We keep a record of which of our customers sent each request, so misuse can be traced to that customer.
The app on your computer or phone never reads your files, your browsing or anything else you do, and it never reaches anything inside your home network. What we learn from it is the IP address it shares from, whether it is online, and how much it carried.
On a phone, the app reads on the phone itself whether it is on Wi-Fi, mobile data or a VPN, and how full its battery is, to decide when it may share. None of that leaves the phone.
Who else sees it
- Our network, which carries the traffic: it receives each device's id, the id and fingerprint of the consent you gave, and the country it was set up from, and it sees the device's IP address while the device is connected.
- The websites our customers visit through your connection see your IP address, as they would see that of any visitor. They learn nothing else about you.
- Cloudflare sits in front of the website, so it sees the requests your browser makes.
- Google, only if you choose “Continue with Google”: you sign in on Google's own page, under Google's privacy policy; it tells us only your email address and the id of your Google account.
- The provider that sends our emails (the confirmation and the password-reset links), named here before anyone can sign up.
- The provider of the server the app runs on, named here before anyone can sign up.
- The gift-card provider, for a cash-out you request.
Nobody else. Your data is not sold, and it is not used to advertise to you anywhere.
Where it is processed
Where a provider processes data outside the EU or EEA, the transfer is safeguarded by the European Commission's Standard Contractual Clauses (Art. 46 GDPR). Which country each provider processes in is named here, with the providers, before anyone can sign up.
How long it is kept
- Your account and its settings: until you close it.
- Sign-in sessions: 30 days, then they expire on their own.
- Your devices: as long as the account, because each settlement points to the device that earned it.
- Visit statistics: two years. They hold no IP address and no account.
- Consents: as long as the account, and afterwards for as long as we might have to prove one.
- Money: every movement of a balance is an accounting record, and German law requires those to be kept for ten years. Closing your account removes your identity from them; the amounts and dates stay.
What you can do
- Get a copy of everything (Art. 15 and Art. 20). Settings has a button that hands you one file with every piece of data listed above, and nothing about anybody else.
- Correct what is wrong (Art. 16), directly in Settings.
- Close your account (Art. 17). Every device stops sharing, your sign-in and your email address are removed, and the money record stays for the ten years above without your identity attached.
- Take back your consent (Art. 7(3)) with the same switch you used to give it. Every device stops within seconds. What happened before stays lawful; nothing new happens after.
- Object (Art. 21) to anything resting on a legitimate interest, which here is the sign-in log and the visit statistics.
- Complain (Art. 77) to a data protection authority, in the country you live in or where the company is. Ours is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Kavalleriestr. 2-4, 40213 Düsseldorf, Germany.
Age
Bandwidth Sharing is for people aged 18 and over. Signing up asks you to confirm that, and the answer is stored with its timestamp. If we learn that an account belongs to someone younger, it is closed, its devices stop, and its data is removed.
When this page changes
The date at the top says when it last did. If a change affects what you already agreed to, the app asks you again rather than assuming, and the version you saw is what is recorded.