Privacy policy

The short version

• No telemetry, no crash reports, no accounts. The app does not phone home.
• A link you paste goes from this computer to the video host. There is no converter of ours in the middle.
• The app keeps your settings and your download queue in a file on this computer. None of it is uploaded.
• The app sets no cookies. This website uses Google Analytics cookies to measure visits, traffic sources, and which pages are useful.
• After first launch the only optional network call is a lookup for a newer official yt-dlp release. You can switch it off. A lookup does not install until you choose Update or Repair.

This policy covers the desktop app and this website, which follow different rules and are described separately below.

How you may use the app

This page is only what the app and this website do with data. Permitted use — that you save copies you have the legal right to access and keep — is on Terms of use.

What the app keeps on your computer

The app stores what it needs to work in its own data folder — Application Support on macOS, AppData on Windows. One file, state.json, holds your settings and your download queue.

• Settings: the folder you save to, your quality, recipe and caption defaults, whether optional yt-dlp update checks are on, and how many downloads run at once.
• Queue entries: the URL you pasted, the title and thumbnail address the host returned, the options you chose for that download, where the video was saved, and — if a download failed — a trimmed excerpt of the engine error, which can contain the URL.

The managed yt-dlp and ffmpeg binaries live in a bin folder beside that file.

None of this is transmitted anywhere. To clear one entry, remove it from the queue. To clear everything, including settings and the installed engine, use Reset app in Settings.

What the app sends over the internet

Four kinds of request leave the app, and each one has a reason you can point at.

• The video host you chose. Inspecting a link and downloading it are requests from this computer straight to that host.
• GitHub, for the engine. On first launch the app downloads the official yt-dlp release and verifies it against the published SHA-256 sums; the bundled ffmpeg is installed from the app itself. After that, optional checks look up a newer yt-dlp release at most once a day, and you can switch them off in Settings under Network checks. A lookup does not replace the installed yt-dlp until you choose Update or Repair. These requests never include the URLs you paste, and the app does not check for its own updates.
• Thumbnails. The preview and the queue show the artwork the host provided, which loads from that host.
• SponsorBlock, only while Remove sponsor segments is on. The engine asks that service which parts of a supported video are marked as sponsor segments.

What never leaves: usage analytics, crash reports, account details, and the URLs you paste. There is no analytics or crash-reporting code in the app to send them, and the running app never contacts this website.

For the path of a pasted link, read What stays on your computer.

Cookies

The desktop app sets no cookies. This marketing website is separate and uses Google Analytics cookies.

Google Analytics writes cookies such as _ga so it can distinguish visits and recognise a returning browser. These cookies may remain for up to two years unless you clear or block them. We use them only to understand this website’s audience, traffic sources, and page performance. We do not run an advertising tag.

Cookies work the other way round in the app. When a host says sign in is required, you can point the app at a browser profile (Chrome, Chromium, Brave, Edge, Firefox, or Safari) or at a cookies.txt file. The engine reads those on this computer and sends them to the host you are downloading from. The queue entry records which file you picked, never its contents, and nothing about them reaches us.

What this website measures

These pages load Google Analytics 4 so we can see which of them get read. Each page view sends the page you opened, the site that referred you, an approximate location Google works out from your IP address, and your browser, device, and language.

A click on Buy on Gumroad is recorded the same way, so we can see whether people who find these pages try to get the app. We do not use that event for advertising.

Analytics cookies let the reports distinguish visits and estimate new and returning readers. We collect this data solely to understand how people find and use this website, decide which pages are worth improving or writing, and measure whether the website is doing its job. We do not use it for advertising, and Analytics does not run inside the desktop app.

We do not send Google an account, an email address, or any identifier of our own, and we do not use the tag for advertising. Google processes the data on its own infrastructure, in the United States among other places, under its own privacy policy; it uses your IP address to derive that approximate location and does not report the address itself back to us. We see aggregated counts. Google holds the event-level data for 2 months.

That measurement covers this website only. It does not run inside the desktop app and it cannot see the links you paste there.

Services in the path

• Google runs Analytics 4 on this website, as described above. It has no part in the desktop app.
• Cloudflare hosts this website. Like any host, it processes what is needed to deliver a page, including your IP address.
• Gumroad is the one purchase and download channel for the app.
• GitHub hosts the official yt-dlp releases the app installs. It is not this app’s store or update channel.
• The video host you paste a link from, and SponsorBlock while that option is on.

Each of these has its own privacy policy, which governs what it does with a request that reaches it.

If you buy through Gumroad

The listing is not published yet, so there have been no purchases and there are no customer records. When it goes live, Gumroad handles checkout as merchant of record under its own privacy policy, and we receive the purchase record it passes to sellers — typically an email address and the country used for tax.

The app does not send telemetry, crash reports, or the URLs you paste to the store. Every downloadable app artifact publishes a SHA-256 checksum next to the download so you can check the file you received.

Your choices and your data

You can stop the website measurement at your end. Your browser’s tracking protection will block the tag, and Google publishes an opt-out add-on that turns Analytics off everywhere you go. Every page here works the same either way.

Google Analytics assigns a browser identifier, but we do not send Google your name, email address, or an account identifier of our own. We therefore cannot match an Analytics visit to your identity. Google’s privacy controls and the opt-out tools above govern the Analytics data associated with your browser.

Purchases are the one place that would change, and the listing is not live yet, so there are no customer records. Once it is, anything tied to a purchase can be reached through the contact-the-seller link on your Gumroad receipt, and Gumroad answers requests about checkout data itself.

Everything the app knows is already on your computer, so access and deletion are in your hands: open the file, remove a queue entry, or use Reset app in Settings.

Children

Neither the app nor this website is directed at children. There is no account to create and no profile to fill in. The website analytics described above applies to visits generally; we do not knowingly ask children for names, contact details, or other personal information.

Changes to this policy

If something material changes — a new network call, a different analytics tool, a store that hands us more data — this page changes with it and the date at the top moves. We do not bump that date without a real edit.

App changes are listed on What’s new.