Private by default, shared on purposePrivate by default, shared on purpose

Private, nobody named

You, and no one else. This is where every artifact starts.

Private, shared with addresses

You and the people you name. They are emailed to say an artifact was shared and where it is — before that existed, being granted access was completely silent.

Public

Anyone holding the URL, without signing in.

Neither half of the system can do this alone. The platform is the only thing that can decide — the session cookie is on its origin and it can evaluate a share list against a person — and it holds none of the artifact bytes. The worker is the only thing that can serve, and it has no database credential at all.

So the platform decides once and signs the decision, and the worker verifies that signature on every subsequent request. This is also why artifacts are addressed by id on one shared host rather than by a subdomain each: a hostname per artifact is its own origin, and an origin the platform cannot set a cookie on can only ever be protected by “know the URL”.

A signed decision is bound to one artifact and lasts up to a year in the browser that holds it. Un-sharing stops new access at once, not access already held. Access that came only from workspace membership lasts a day and is not renewed.

That is a deliberate price rather than an oversight: the alternative is a database round trip on every image, script and stylesheet an artifact requests. It is written here, on the marketing page, because it is exactly the kind of thing that should be known before somebody relies on revocation being instant.