Sharing a PCB for review safely: view-only links, privacy and licensing

Kinds of link, from most open to most controlled

Link	Who can open it	Use it for	Where you find it
Public	Anyone, and search engines may find it	Open hardware you mean to publish	BoardRepo (public board)
Link-only	Anyone who has the link	A quick review with people you trust not to forward it	BoardRepo (unlisted); Altium 365 Viewer (shared link)
Expiring link	Anyone with the link, for a limited period	One-off looks; the link stops working on its own	Altium 365 Viewer
Password	People with the link and the password	Clients and suppliers outside your team	BoardRepo (password-protected)
Named people	Only signed-in accounts you authorize	Teams, contract manufacturers who should see one board only	BoardRepo (private boards; organization admins assign board access)

View-only is not the same as no download

A viewer that shows your board in a browser has to send the reviewer enough data to draw it. Treat anything a reviewer can see as something they can keep. Before you share, check in the viewer whether the reviewer also gets a download of the source files, and turn that off if the option exists and you do not want it.

Where your files go

In your browser only: tracespace view keeps Gerber files in browser storage and does not send them anywhere, per its privacy policy.
On the vendor's servers for a session: Altium 365 Viewer removes an upload when you close the tab, unless you share it (then for a limited period) or save it.
Stored until you delete it: workspaces such as BoardRepo and EasyEDA keep your project so it can be shared and versioned. BoardRepo boards can be private, and its terms grant no model-training rights over your projects. Deleting a project cannot erase a copy someone downloaded while they had access.

For anything under NDA, read the viewer's privacy policy and terms before uploading, and ask whoever owns the design whether a cloud upload is allowed at all.

Licences

Your own open hardware: pick a licence before you publish, and put it in the project. Hardware licences such as the CERN Open Hardware Licence (strongly reciprocal, weakly reciprocal or permissive variants) are written for designs; Creative Commons and MIT licences are also common on open boards.
Someone else's board: sharing a link to a public design is fine; republishing or modifying it is governed by its licence. Keep the author and licence with any copy.
Library parts: symbols, footprints and 3D models from libraries carry their own licences. KiCad's official libraries are licensed CC BY-SA 4.0 with an exception that lets you use them in your designs; vendor models may have their own terms.

Include

The full project: every schematic sheet, the board, and project libraries
3D models for the parts that matter to the review
A BOM with values and part numbers
Board notes: layer stack, thickness, finish, impedance requirements
What changed since the last version, and what you want the reviewer to look at

Leave out

Customer or project names in title blocks and silkscreen that the reviewer should not see
Parts and datasheets under NDA, if the reviewer is not covered by it
Firmware, keys, passwords or Wi-Fi credentials sitting in the project folder
Backups, autosave files and old outputs that confuse the review
Unused sheets and experiments you do not want reviewed