Privacy policy
Last updated: 31 October 2026
This page is about the data Downaro actually touches. It is not a storefront privacy pack copied from a template. There is no member account. There is no public video library. The product lives at downaro.com and does one job: look at a public link you paste and, when the platform already advertised a file, point you at it.
If you only want the short version: we never ask for an Instagram or TikTok password, we do not sell a list of the URLs you pasted, and a file that lands in your Downloads folder is on your device, not in a Downaro gallery. The rest of the page is the unglamorous part — logs, cookies, mail, and what we cannot delete for you on someone else’s site.
Who this is for
You landed here because the footer said Privacy, because a search engine sent you, or because you want to know what happens to a URL after you hit enter. All of that is fair. This text is for people who use the paste field, people who write to us, and people who have to decide whether a small helper site is something they can live with.
It is not a promise that every law in every country has a named officer behind this product. Downaro is operated as a small site. We will not invent a data-protection officer, a registered company number, or an EU representative we do not have. If a sentence here later needs a legal name, the date at the top will move and the sentence will name it.
How you may use the tool is on the terms. How a rights holder sends a notice is on the copyright page. The short version of what the product is sits on About.
What we process
Most visits are a page read. The host then sees what any ordinary website sees: an IP address, a user agent, a time, and the path you asked for. That is hosting, not a Downaro member profile.
When you use the tool or the form, a few more things appear:
- The URL you submit to the resolver, so we can check the host and look for public media.
- Technical logs and short-lived rate-limit files, so one network cannot occupy the API for everyone else.
- A contact message, if you send one: name, email, topic, the text, and the IP the form arrived from.
- A session cookie that protects the contact form and holds a short security nonce for the page.
- Theme and language preferences, if you toggle them — those stay in your browser, not in a Downaro account.
We do not run a user table. There is no “my downloads” folder waiting for the next visit. There is no checkout, so there is no card number to lose.
Links you paste
You copy a public address from Instagram, TikTok, Facebook, X, Pinterest, Reddit, or YouTube — Share → Copy link, or the address bar — and paste it here. The browser sends that string to /api/resolve on our origin. The server checks the protocol and the host. It refuses private networks, malformed URLs, and hosts we do not support. Then it looks at what that public page already exposes to a logged-out visitor.
We use the URL to fulfill that request. We do not publish a browse history of other people’s pastes. We do not build a public search index of Reels you looked up. A successful lookup is not an automatic download. Nothing is saved to your disk until you choose a file.
The same rule applies on every tool page: Instagram, TikTok, Facebook, X, Pinterest, Reddit, and YouTube. The homepage accepts any of those public hosts.
A listed MP4 or JPEG is a technical result: the platform advertised a public file. It is not a licence, and it is not Downaro storing the clip for the next stranger. If the media is not yours and nobody gave you permission to keep it, do not paste the link.
Logs and rate limits
The host keeps ordinary access logs. Those usually include an IP address, a user agent, a time, and the path. They exist so the site can stay up, so abuse can be seen, and so a broken deploy can be traced. They are not a catalogue of videos.
On top of that, the resolver, the file endpoint, and the contact form keep short-lived rate-limit files. A file is keyed from a hash of the action plus the client IP we see. It holds a count and a reset time. When the window ends, the count starts over. The windows are measured in minutes for the tool, and about an hour for the form. That is how we slow a flood without inventing member bans. There are no accounts to ban.
If the same refused URL keeps arriving, or a pattern looks like scanning, we can keep refusing it or shut that pattern down. That is a safety measure for the site. It is not a public shaming list, and it is not a score we sell.
Cookies and your browser
The only cookie we set for ordinary use is a session cookie named downaro_s. It is HTTP-only. It uses SameSite=Lax. On HTTPS it is marked Secure. It dies when the browser session ends. We use it for two unglamorous jobs: a CSRF token on the contact form, and a short nonce that the Content-Security-Policy header expects. We do not use it to follow you around the web.
If you switch light and dark, the choice is stored in your browser as downaro-theme in localStorage. If you pick English, Arabic, or French in the language switch, the last click can be remembered as downaro-lang. Those keys never leave your device unless you copy them. Clearing site data clears them. We cannot read them from here.
Google AdSense, when its script loads, may set additional cookies or use similar storage. Those belong to Google, not to a second Downaro profile. That is described in the advertising section below, not hidden here.
Advertising
Downaro uses Google AdSense so the site can stay online. That is a Google product sitting on our pages. It is not a Downaro gallery and it is not a download. We do not put an ad on the Download button, and we do not dress a banner as a quality picker. If an ad ever sits too close to a file link, write to hello@downaro.com and we will move it.
Google may set cookies or use similar technologies to choose ads, measure them, and stop fraud. We do not get a feed of “this person pasted this Reel.” The pasted URL stays in the resolver request. The ads system sees that you opened a Downaro page, not the Instagram or TikTok address you typed.
Google explains how it uses data on sites that show its ads: How Google uses information from sites or apps that use our services. You can also use Google’s ad settings. The publisher line we declare for this domain is in ads.txt.
Contact messages
The form asks for a name, an email, a topic, and a message. A hidden field catches bots; humans should leave it empty. If the send works, the server mails the operator using the host’s mail transport. The body includes the IP the request arrived from, so a flood can be told from a person.
That mail sits in an inbox until someone reads it. We do not auto-reply. We do not turn the form into a marketing list. Product questions and broken public links belong there. A formal copyright notice is better in email, on the copyright page, so the wording and the attachments stay in one thread.
You can skip the form and write to hello@downaro.com. Same inbox. If you include a URL, treat it as part of the message: we will see it because you sent it, not because we scraped your phone.
Files and signed downloads
When a public file is there, the page lists qualities or images. The download itself is a same-origin path such as /api/file, with a signed token. The token tells our server which public media URL to fetch, and for how long that permission lasts. Those tokens expire in minutes, not months. They are not a public library, and they are not a share page for the next visitor.
Some YouTube jobs keep a short-lived work file on disk so a package can be prepared. That file is hashed, time-limited, and not listed on the site. When the time is up, it is useless.
Once you choose a quality, the bytes go to your browser’s download flow. On iPhone, Safari often drops the file in Files, not Photos. That is a browser habit. The iPhone guide finishes that last step if the camera roll is empty. After the file is on your disk, we cannot reach into the phone and delete it. We also cannot promise every Reddit clip arrives with sound already mixed — Reddit often stores picture and audio as two files, as the Reddit sound guide explains.
What we do not want
We will never ask for an Instagram, TikTok, Facebook, X, Pinterest, Reddit, or YouTube password, a session cookie from those sites, or a two-factor code. If a page that looks like Downaro asks for those, close it. It is not us.
- No platform logins. The tool only reads what a logged-out visitor can see.
- No payment cards. There is no checkout.
- No uploads from your camera roll. You paste a URL; you do not attach a file.
- No member profiles, and no “sync my history” switch.
- No ads dressed as download buttons, and no sale of a paste list.
We also do not want children’s email addresses as a product feature. There is no kids’ mode and no school account. The site is a helper for people who can accept the terms. We do not ask for a date of birth because we do not create profiles.
Other companies
When you ask us to resolve a link, our server may request a public page or public JSON from that platform. Instagram, TikTok, Facebook, X, Pinterest, Reddit, YouTube, and the CDNs behind them then see a request from our servers — not a login as you. Their privacy rules apply to what they already published. We cannot edit those rules, and we cannot delete the post on their site.
Hosting is with the operator’s host (currently Hostinger). That company sees the usual server traffic. Email, when the form works, uses the host mail transport. If a message fails, the contact page tells you to use the address above instead. Ads are served by Google AdSense, as the advertising section above says.
Signed downloads fetch media from the host that already advertised the file. We do not open that path to arbitrary websites. Private networks and hosts we do not support are refused on purpose.
Platform names and marks on the tool cards are identification only. We are not Meta, TikTok, X Corp., Pinterest, Reddit, Google, or Apple. Mention is not a partnership.
Analytics
Analytics is disabled by default. This release can load Plausible only when the operator deliberately enables the analytics master flag and supplies a Plausible domain. The tool works without analytics, and the current production configuration keeps the master flag off.
For Downaro's four custom events — tool submit, tool success, tool error, and download click — the client creates a new allowlisted properties object containing only a recognized platform, the page language (en, ar, or fr), and, for errors, a generalized category. It does not copy pasted video URLs, download tokens, contact details, sensitive query parameters, or arbitrary caller properties into that object. A provider can still receive ordinary request information and any standard page data its own script collects; those details must be reviewed and recorded here before Plausible is enabled.
GA4 is not available in this release. The site does not read a GA4 measurement ID, load the Google tag, call gtag, or add Google Analytics origins to its security policy. We kept it locked off because Google tags attach default page-location and referrer parameters to events and can collect automatic or Enhanced Measurement events based on data-stream settings that were not independently verified. A future GA4 change requires a separate code, property, consent, privacy, and network review before deployment.
How long things stay
Rate-limit files are short-lived. Signed download tokens expire in minutes. A YouTube work file is written with a short expiry and then stops working. Host access logs follow whatever retention the host already uses; we do not run a second, prettier copy of those logs as a product feature.
Contact messages stay in the inbox until they are handled. A copyright thread may sit longer than a one-line product question, because a notice needs the wording intact. We do not operate a user-account database, so there is no profile to archive and no annual “export my Downaro data” button.
A file you saved is on your device for as long as you keep it. Clearing our cookies does not remove an MP4 already in Files.
If you want something deleted
Write to hello@downaro.com or use the contact form. Say what you sent and when, if you know. We can look at a contact thread that is still in the inbox, and at rate-limit files we still have. We can refuse a path if a notice requires it.
We cannot delete a Reel from Instagram, a TikTok, a Facebook post, an X media tweet, a Pin, a Reddit video, or a YouTube upload. Those companies have their own forms. We cannot reach a file already on your phone. We cannot invent an account export for an account that does not exist.
If a law where you live gives you rights about mail you sent us, write and we will look at what we still have. We will not pretend a two-sentence auto-reply is a formal legal process we have not built.
When this page changes
If we activate the optional analytics integration, change host, change how ads run, start asking for something we do not ask for today, or find a sentence here that was too thin, the date at the top will move. We will not email every visitor. There is no account list to email.
Using the paste field, a platform page, the contact form, or the API after that date is use under the new text. If you do not want that, stop pasting links.
Related pages
The terms say what you may paste. The copyright page is the notice process. About is the product in ordinary sentences. Contact is the form.
Privacy questions that are not a rights notice can go to hello@downaro.com. A specific URL and what you expected beats a one-line “delete everything.”