GDPR
Last updated: 15 October 2026
Scope
This page explains how the service approaches the EU and UK General Data Protection Regulation. It applies where the GDPR governs the processing concerned.
Data controller
The operator of the instance you are using is the controller for the data described here. If you run your own instance, you are the controller for it.
What we process, and why
- URLs and job metadata. Processed to perform the download you requested and to show progress. Legal basis: performance of your request.
- IP address. Processed transiently to apply rate limits and to defend the service against abuse. Legal basis: legitimate interests.
- Server logs. Processed for security and debugging. Legal basis: legitimate interests.
What we do not process
No account data, no special-category data, and no credentials for any supported platform. The service does not log in on your behalf.
Retention
Files and job records are removed after the configured retention window, with an hourly cleanup job. Rate-limit counters expire automatically on a short cycle.
Your rights
- Access. Ask what personal data is held about you.
- Rectification. Ask for inaccurate data to be corrected.
- Erasure. Ask for your data to be deleted.
- Restriction. Ask for processing to be limited.
- Objection. Object to processing based on legitimate interests.
- Portability. Ask for data you provided in a portable format.
To exercise any of these, use the contact page. We may ask for enough information to locate the data, while asking for as little as possible.
International transfers
The service may be hosted outside the EEA. Where personal data is transferred, the operator is responsible for putting appropriate safeguards in place.
Complaints
You have the right to complain to your local supervisory authority. We would appreciate the chance to address your concern first.
No automated decision-making
The service does not carry out automated decision-making or profiling that produces legal or similarly significant effects.