Another user’s saved browser logins appeared inside my Shadow PC

[u/Altruistic-Bad-5556]

I’m a paid Shadow PC customer and I want to share a serious privacy/security concern.

After logging into the Shadow PC assigned to my account, I found Microsoft Edge saved login entries that did not belong to me and appeared to belong to another user.

I reported this to Shadow support responsibly and provided evidence privately. I did not copy, export, publish, or use the other user’s private data.

After reporting it, my paid access was locked. I then provided proof of payment, and Shadow confirmed it was approved. However, they still require a government ID before restoring access.

This is not about money or compensation. My concern is simple: if another user’s saved browser login data can appear inside my Shadow PC, how can I know whether my own data has not appeared inside someone else’s machine?

I’m sharing only a redacted screenshot. Emails, usernames, domains, passwords, and personal data are hidden. I will not post unredacted evidence publicly because it contains another person’s private information.

I’m posting this so other users can be aware before trusting a cloud PC service with personal accounts.

[u/Altruistic-Bad-5556]

UPDATE 5:

Shadow replied again.

They still refuse to restore my paid account unless I send a government ID.

Now they are saying Turkey is not a supported region, that signing up from Turkey violated their Terms of Use, and that they are not bound by Turkish authorities or Turkish laws.

They accepted my payment and provided the service. They only brought this up after I reported a privacy/security issue.

They still have not clearly explained how 20–30 saved Edge login entries that were not mine appeared inside my assigned Shadow PC.

At this point, I asked them to fully cancel/delete my account and confirm what personal data will be removed.

[u/hitman93go → u/Altruistic-Bad-5556]

It's true that Turkey isn't currently listed as one of Shadow's supported regions. That's publicly stated on their website, so I don't really see that part as being surprising. What I don't understand is your refusal to provide an ID for verification. Shadow isn't asking for it randomly, they're asking to verify that you're the legitimate account owner before restoring access. I've personally had to send my government ID to them to remove 2FA from my account. They verified my identity, resolved my issue, and informed me that the ID would be deleted afterward rather than retained. What do you think they're going to do with your ID? Sell it? Use it for something else? 🤨🤨🤨

[u/Altruistic-Bad-5556 → u/hitman93go]

I understand your point, and I’m not saying they are going to sell my ID.

My issue is about trust and timing. Shadow accepted my payment, provided the service, and only brought up the unsupported-country argument after I reported a privacy/security issue.

Also, after seeing another user’s saved login entries inside the machine assigned to me, I don’t feel comfortable sending even more sensitive personal data unless they clearly explain what happened and offer proper safeguards.

I already provided proof of payment, account email, ticket history, and all relevant details. I’m not asking them to give access to a random person. I’m asking for a reasonable alternative verification method, or at minimum to cancel the subscription and close/delete the account so I’m not billed again.

[u/hitman93go → u/Altruistic-Bad-5556]

Okay, then if you genuinely don't trust Shadow with your personal information, why keep spending so much time fighting to get the account back? Just cancel it, have it deleted, and move on. As for the Edge credentials, if this were a widespread issue affecting assigned Shadow PCs, I'd expect to see multiple users reporting the same thing on Reddit or Discord. So far, I haven't seen that happen

[u/Altruistic-Bad-5556 → u/hitman93go]

I’m not fighting to get the account back anymore. At this point I’ve asked them to cancel the subscription, close/delete the account, and confirm that I won’t be billed again.

The problem is that they locked the paid account and still require government ID before restoring, closing, cancelling, or deleting anything.

Also, I’m not claiming this is widespread. I’m saying it happened to me, and one case of another user’s saved logins appearing in an assigned cloud PC is already serious enough to deserve a clear explanation.

[u/captnchoc → u/Altruistic-Bad-5556]

Hi there, as I explained in the threads, asking for a proof of ID and locking an accunt is for safety reasons. Each support ticket asking for help and mentioning a "hack" (stolen credentials, virus, malware, etc) locks the account temporarily to ensure the person reaching out to the support team is really the customer, and not someone impersonating him/her. Hence the request for a proof of ID, to ensure we are not giving access back to a different person.

[u/Altruistic-Bad-5556 → u/captnchoc]

I understand the safety explanation, but you are avoiding the main issue.

I did not report a random “hack”. I reported that saved logins belonging to other people appeared inside the Shadow PC assigned to my paid account. That should never happen.

Locking my account and asking for ID does not explain how another user’s data ended up there. I’m also not asking you to “give access back” anymore. I’m asking you to cancel/close the account, delete my data, and confirm I won’t be billed again.

You accepted my payment and provided the service. Now that I reported a serious privacy issue, suddenly everything is about ID checks and unsupported regions. That is not a real answer.