How sharing stays safe
The short version
- The app only connects out. Nothing on the internet can connect in to your computer through it.
- It refuses to reach your router, your other devices, or anything else on your home network, and it checks this on the exact address it is about to connect to.
- It only carries web traffic (ports 80, 443, 8080 and 8443), so it can't be used to send email spam.
- It doesn't read your files or your own browsing, and it doesn't send us your computer's name.
- You can pause, schedule, cap or slow sharing at any time, and both the app and our servers enforce it.
- Websites will see your IP address as the source of the traffic. Read the risks before you start.
What the app does
- It opens one encrypted (TLS) connection out to Spareband's servers and keeps it open while it runs.
- When a customer needs to load a website from your area, our servers ask your app to connect to that website. Your app connects out to it, and the website's response travels back through Spareband to the customer.
- Your app looks up the website's name through your computer's normal DNS settings, as any app would.
- It counts the data it carries today and this month, saving the count in a small file on your computer, so your caps still work after a restart.
- It tells our servers whether it's sharing, why not if it isn't, how much it has carried, and which settings it is applying. It also sends its version, operating system and processor type (for example "linux/amd64").
What it never does
| Never | How |
|---|---|
| Accept connections from the internet | The app never opens a listening port. Everything, including requests from our servers, travels over the one connection your app makes out to us. |
| Reach your router or other devices at home | The app refuses private, local and special-purpose addresses: home network ranges, loopback, link-local, your internet provider's shared (CGNAT) range, and IPv6-to-IPv4 translation ranges (NAT64 and 6to4) that could lead back into a private network. It also refuses the public IP address our server sees you connect from, and the public networks your computer's own network connections are on, so a public IPv6 address on a device at home is refused too. It checks the exact address it is about to connect to, after the DNS lookup, so a website name that points at your home network is refused as well. Our servers also refuse private addresses, and your own public IP address, before they ask your app. |
| Send email or connect to other services | The app only connects to web ports 80, 443, 8080 and 8443. Email ports are refused, so your connection can't be used to send spam. |
| Read your files or your own browsing | The app only handles the connections our servers ask it to make. It doesn't look at your files, other programs, your browser or other devices on your network. |
| Send us your computer's details | The app doesn't collect your computer's name, its local network addresses, or the hardware addresses of your devices. It checks your computer's network addresses on your computer only, to protect your home network. |
| Record the websites customers visit on your computer | The app's own activity log notes things like "sharing paused", not destinations. |
| Update itself | The app has no automatic update. You choose when to install a new version. |
Your controls
For each device, in your dashboard, you can:
- Pause sharing at any time.
- Set sharing hours, for example only overnight or only while you're out.
- Set daily and monthly caps on the data it carries.
- Set a speed limit, to keep sharing to a slice of your line.
- Turn the device off or remove it.
Your app and our servers both enforce these settings. Our servers count the data themselves and cut connections that run past a cap or outside your hours, and the app refuses new connections on its own too. Changes reach a connected app within about 15 seconds. You can also stop or uninstall the app at any time.
Who uses the traffic, and the limits on it
Our customers are proxy providers, which resell the traffic to their own business customers. Typical uses are seeing websites the way a local visitor does: checking prices, ads and search results in different places. We name the providers we sell to on our home page, under "Who buys the traffic?".
- Web traffic only. Customers can only reach web ports, and never private or home network addresses.
- Limits per customer. Each customer has a cap on how many connections it can have open at once.
- Home connections only. When an app connects, our servers check its IP address against a public dataset of networks, kept on our own servers, and refuse hosting, cloud and VPN networks. Only one device can share from the same IP address at a time.
- A record for tracing abuse. We keep a record of each connection for 90 days: when it happened, which customer made it, which device carried it, the device's IP address, the destination website's host name and port, and how much data moved. We don't record pages or contents. This record lets us trace an abuse report to the customer responsible and stop them.
We don't inspect the content of each request, and most traffic is encrypted between the customer and the website, so we can't read it.
Risks to know about
- Your IP address is visible. Websites our customers visit see your connection's public IP address, and the approximate location that can be worked out from it, as the source of the traffic. They don't see your name, email or account.
- Some websites may treat you differently. A website may show more security checks (such as CAPTCHAs), slow you down, or block your IP address, including when you browse it yourself.
- Your internet provider's rules apply. Your agreement with your provider may limit sharing your connection or running server-like software. Check it before you share.
- Data caps. If your plan has a data allowance, shared traffic counts toward it. Use the daily and monthly caps to stay inside it.
- DNS lookups. Your app looks up customers' destination names through your normal DNS provider (often your router or internet provider), so that provider sees those lookups.
- You may be contacted about traffic. A website, your provider or an authority may ask about traffic from your IP address. Forward any such message to hello@spareband.com. Our connection records can show the traffic came through Spareband and identify the customer responsible, and we'll help you respond.
Report abuse
If you run a website or network and see unwanted traffic you believe came through Spareband, email hello@spareband.com with:
- the date and time, in UTC, as precisely as you can;
- the source IP address you saw; and
- the destination host name or IP address, and port.
We'll look it up in our connection records, reply to you, and act against the customer responsible, up to removing them. We won't tell you who the sharer is.
Report a security problem
If you find a security problem in Spareband, its app or our servers, email hello@spareband.com. Our contact details for security reports are also at /.well-known/security.txt. We welcome good-faith research. Please don't access, change or delete other people's data, don't disrupt the Service or other sharers' connections, and give us a reasonable time to fix the problem before you publish it.
The Terms of Service and the Privacy Policy are the binding versions of what this page describes. Tekari LLC operates Spareband.