# How RecBaba Share Links Stay Private

RecBaba share tokens are long and random, pages are noindex, and you can password, expire, or revoke a link. There is no public directory of recordings.

Category: Security. Published 2026-09-18.

![Private RecBaba share controls: unlisted link, password, expiry, and revoke.](https://www.recbaba.com/blog/cover-share-privacy.jpg)

> **Key takeaway:** Share tokens are about 95 bits of random data — not sequential ids. Search engines are asked not to index /share. Unlisted is not secret if you paste the URL in a public chat.

A share is a link you send, not a listing. RecBaba does not publish a directory. robots.txt still disallows /share/* for search crawlers, and the page sends noindex. Preview crawlers (the ones that build a link card in chat) are allowed to fetch the page so the card can render.

![RecBaba share dialog over the local editor, with Unlisted visibility and Create link.](https://www.recbaba.com/screenshots/share.png)

*Creating the link is the upload. Password, expiry, and revoke live on that object.*

## Controls that actually exist

- Unlisted by default: anyone with the URL can watch.
- Password on Pro: same private link plus a password you set (minimum eight characters).
- Optional expiry. Hosted share links are on Pro and Max.
- Download on or off.
- Revoke: immediate. The next request fails.

Tokens are 16 random bytes, about 95 bits. They are not sequential recording ids. Owner tools reconstruct the public URL from an encrypted mapping so a guessable id never becomes the token. If you pasted the link in a public Slack, rotate it — unlisted is a courtesy to search engines, not a lock.

## What we log

Share-access logs use hashed identifiers, not raw IP addresses. Pro shows who opened the link. Max adds a 30-day views trend. That is analytics on the share, not a public view count on the marketing site.

Password shares stay gated until the viewer unlocks. AI and transcript JSON for that token follow the same gate — hiding insights on the link does not leak the payload. Revoke is still the hard stop if the URL escaped the thread.

![A RecBaba share page that can also show AI insights, still behind an unlisted token.](https://www.recbaba.com/screenshots/transcript.png)

*AI on the page does not make the link indexable. You can hide insights per link.*

> **Unlisted is not a vault:** If the URL is forwarded, the new holder can watch until you revoke, expire, or password it. Treat the link like a document you attached, not like a locked room.