Sharing is opt-in and per-chat. Nothing you type is ever public until you explicitly share the chat. When you do, LADLE takes a snapshot of the chat's current active branch (not the raw DB rows) and publishes it at /share/:slug — a public read-only page anyone with the link can view without an account.
URL model and privacy
Every share URL is a random 10-character slug from a-z0-9 (36^10 ≈ 3.7 × 10^15 possibilities).
Listing and revoking
GET /api/app/shared returns every share the caller has ever created (live + revoked). Settings → Data & privacy displays them with per-share Revoke buttons. Revoked shares stay in the DB (for the historical record) but the public page returns 404. Un-revoking is not supported — sharing again produces a new slug.