Privacy policy

Last updated: this policy tracks the current application behavior. Update it when you enable analytics, ads, or new subprocessors.

Who operates this service

YTSave is operated from the deployment you are using. Contact: Not configured yet. Set CONTACT_EMAIL in the server environment..

What we collect

Server logs

The application logs HTTP method, path, status code, duration, and a request id. Query strings that contain a media URL are not written as part of the path field, but a submitted URL is stored with the download job (see below). If a reverse proxy is enabled, the client IP is read from forwarding headers for rate limiting.

IP addresses

Client IP addresses are hashed and used to enforce per-network rate limits and concurrent download caps. Hashed IPs may be stored on job records for that purpose.

Download jobs

When you start a download, the service stores the submitted URL, chosen format, title you confirmed, job status, timestamps, and file metadata. Those submitted URLs are needed to fetch media from the source website. Temporary media files are written to local disk or configured object storage, then deleted after about 60 minutes.

Contact form

Name, email, category, and message are processed to respond to you. If outbound email is not configured, submissions are written to application logs so the operator can still read them.

Cookies

The downloader itself does not require cookies. If you enable a cookie-based analytics provider (for example Google Analytics), a consent banner is shown before that script loads. Cookieless providers such as Plausible or Umami, if enabled, are described here when you turn them on.

Current analytics setting: disabled.

Current advertising setting: disabled.

Analytics and advertising

By default both are off. Operators can enable them with environment variables. Download URLs and other user-entered media URLs must not be sent to analytics tools. If advertising is enabled, ad frames are labeled “Advertisement” and are not styled as download buttons.

Third-party services

• Source websites (YouTube and other supported platforms) receive requests from the server when you ask for media information or a download.
• Object storage, if configured (S3-compatible), holds temporary files.
• Redis and PostgreSQL hold queue state and job metadata.
• Optional analytics or ad providers, only if enabled in configuration.

Retention

• Media files: about 60 minutes after a successful download, then deleted.
• Job records: kept as needed for operations, debugging, and abuse prevention.
• Logs: retained according to the host’s log rotation.
• Contact messages: retained as needed to handle the request.

Your choices

You can use the site without creating an account. If a consent banner is shown, you can decline analytics cookies. To ask about deletion of a contact submission, use the contact form or the email above.