Privacy Policy

1. Controller

The controller responsible for data processing on this website is the operator named in the imprint. Nils Plützer c/o IP-Management #12828 Ludwig-Erhard-Str. 18 20459 Hamburg Germany Email: contact@nils-pzr.eu

2. Processing of submitted links

The URLs you enter are transmitted to the server and used to retrieve the requested media from the respective platform and prepare it for download. The resulting files are stored temporarily and deleted immediately after transfer. Without an account, submitted links are not stored permanently. With an account, your downloads are added to your history (section 5).

3. Server logs

When you visit the website, the server or hosting provider automatically processes technical access data (e.g. IP address, date and time, requested page, user agent). This data is used exclusively to operate the service securely and reliably (Art. 6(1)(f) GDPR) and is automatically deleted after a short period.

4. User account

When you create an account, I store your email address, your name, a hash of your password (never the password itself), your plan (Free or Pro) and when the account was created and changed. Each sign-in stores a session with IP address and user agent so you stay signed in and your account is protected against misuse. It is also stored whether your email address is verified; for sign-ins through a third-party provider also that provider's account ID and the granted permissions (scope). The confirmation link for your email address is a signed token that is not stored in the database. What is stored are short-lived entries for password resets and for the sign-in state of third-party sign-ins; they stay stored until they are used or looked up again after expiry. There is currently no automatic cleanup. The legal basis is the performance of the user relationship (Art. 6(1)(b) GDPR). Account data is kept until you delete your account; a session is invalid after 30 days without use; its record is deleted on sign-out, on password reset or with the account.

If you sign in with Google or GitHub, I store the data the respective provider sends when you sign in (usually name, email address and profile picture) as well as the technical access tokens of that sign-in. The provider's privacy policy applies to signing in there. These sign-in options are only offered when they are set up on the server.

5. Download history

While you are signed in, every download is saved in your history: link, platform, title, thumbnail address, format, quality and time. Within the application, only you can see your history. You can delete single entries or the whole history at any time; it is removed completely when you delete your account (Art. 6(1)(b) GDPR).

6. Daily limits and IP hash

To enforce the daily limits, I count downloads per day. For signed-in users this uses the account ID; these counters are deleted with the account. Without an account, a hash (SHA-256) is computed from your IP address and a secret key; only this hash, the date and the count are stored, never the IP address itself. The counters are deleted automatically after about 30 days. The legal basis is my legitimate interest in protecting the free service from overload and misuse (Art. 6(1)(f) GDPR).

7. Cookies and local storage

No tracking cookies are used. When you sign in, strictly necessary session cookies keep you signed in (up to 30 days without use or until you sign out; Art. 6(1)(b) GDPR). Your preferences for theme (light/dark), language and view are stored only locally in your browser (localStorage) and are never sent to the server.

8. Sending emails

For confirmation emails and password resets I use the service Resend. Your email address and the content of the email are transmitted to Resend so that the email can be delivered (Art. 6(1)(b) GDPR). Emails are only sent when this feature is set up on the server.

9. Account management (Better Auth Dash)

When this feature is set up on the server, data about accounts and sign-ins is transmitted to the service Better Auth Dash (dash.better-auth.com), which is used to manage and monitor accounts. The legal basis is my legitimate interest in secure and stable operation (Art. 6(1)(f) GDPR).

10. Hosting, database and platforms

The website and its database run on servers of Hetzner Online GmbH in Germany. When media is retrieved, server-side requests are made to the respective platform (e.g. TikTok, YouTube); thumbnails may be loaded directly from the platforms' servers into your browser. The privacy policies of the respective platforms apply to those requests. No analytics or advertising services are used.

11. Retention

In short:

• Account data: until you delete your account
• Download history: until you delete entries or your account
• Sessions (incl. IP address and user agent): until sign-out, password reset or account deletion; a session is invalid after 30 days without use
• Short-lived entries (password reset, third-party sign-in state): until used or looked up again after expiry; no automatic cleanup
• Daily limit counters: about 30 days (for accounts also until the account is deleted)
• Server logs: deleted automatically after a short period

12. Your rights

Under the GDPR you have the right to access, rectification, erasure, restriction of processing, data portability, and objection. You can delete your account and history yourself at any time. You also have the right to lodge a complaint with a data protection supervisory authority. For any request, an informal email to the address given in the imprint is sufficient.