Privacy Policy

1. The short version

• You can use most of the app without an account. If you create one, we keep the details you give us to run it.
• The Downloader app itself stores and serves no files. We do not see what another app on your device does with a reference you open.
• We use no advertising or analytics software in the current version of the app.
• You can export or delete your data at any time.

2. What we collect and why

Account details

• Examples: your e-mail address or phone number, username, display name, first and last name if you give them, profile picture, time zone and language; how you signed up and with which provider; and, if your account was ever suspended, that fact and its reason
• Source: you, when you create or edit an account. If you sign in with Google or GitHub, we read from them, and keep, your account identifier there, your e-mail address, your name and your profile picture
• Purpose: creating and running your account and signing you in
• Lawful basis: performing our contract with you
• Retention: kept while your account exists. When the account is deleted, 30 days after you ask, your e-mail address, phone number, username, name, profile picture, bio and password are removed from the account record. The time and IP address of your last sign-in, and the reason you gave for leaving if you gave one, stay on the closed account record, with the rest of that record that no longer identifies you; no fixed period is set for them. The section "Deleting your account" lists what stays
• Recipients: Hetzner (hosting), Resend (the e-mails we send you), Twilio (text messages or phone calls that carry a sign-in code), Google or GitHub when you choose to sign in with them, and Gravatar (see "Profile pictures" below)

Consent and age records

• Examples: which version of the terms and of the privacy policy you accepted and when, and your confirmation that you are at least 13
• Source: you
• Purpose: being able to show what you agreed to
• Lawful basis: our legitimate interest in keeping proof of the agreement, and legal obligations where they apply
• Retention: kept while your account exists and after it is deleted, as proof of what was agreed. No fixed period is set
• Recipients: Hetzner (hosting)

Sign-in and security records

• Examples: your sessions, with the IP address, the kind of device, browser or app and operating system, the languages your browser accepts and the page you came from, your internet provider, and an approximate location (down to city and postal area, with coordinates) taken from the IP address; the time and IP address of your last sign-in, the time you were last active and the number of times you have signed in; the number of failed sign-in attempts and, after too many, the time until which the account is locked; devices you chose to trust, each with its IP address, city and country, a fingerprint of the device and the names of the device, its system and its browser
• Source: your device, automatically
• Purpose: keeping accounts secure, showing you where you are signed in, and stopping abuse
• Lawful basis: our legitimate interest in the security of the service
• Retention: a session ends when you sign out or when it expires. A known device we have not seen for 90 days is removed. Security and audit records are kept for up to seven years. 90 days after an account is deleted its e-mail address is removed from the records of what it did, though a record of a change our staff made to the account may still show it; they still hold the IP address and device details of each event
• Recipients: Hetzner (hosting) and Cloudflare (network security). The approximate location and the internet provider are supplied by Cloudflare with each request or, where Cloudflare gives none, worked out on our own servers from a database supplied by MaxMind; your IP address is not sent to MaxMind

The device identifier

• Examples: a random identifier that the app creates, or that our server issues the first time you open a reference. It is kept on your device and sent with the app's requests
• Source: the app or our server, automatically
• Purpose: applying fair-use limits per device instead of per network, and recognising your device
• Lawful basis: our legitimate interest in a secure and fairly shared service
• Retention: it stays on your device until you remove the app or clear its data. Where our servers keep a record of it, a visitor's record is removed after 180 days and a member's record is deleted with the account
• Recipients: Hetzner (hosting). It is not an advertising identifier and it is not sent to our error-reporting provider

Notification token

• Examples: the Firebase Cloud Messaging token of your device and the name of the device
• Source: your device, after you allow notifications
• Purpose: sending you the notifications you turned on
• Lawful basis: your consent, which you can withdraw by turning notifications off
• Retention: until you turn notifications off or remove the device from your account, or up to 30 days after the token stops working
• Recipients: Google (Firebase Cloud Messaging), which delivers the notification, and Hetzner (hosting)

What you post in the community

• Examples: posts, replies, requests, reactions, your bio, and reports you make about other people's posts
• Source: you
• Purpose: showing your posts to other people, and keeping the community within its rules
• Lawful basis: performing our contract with you, and our legitimate interest in moderating the community
• Retention: kept while it is posted. A post or reply that you delete is hidden from everyone at once, and its text is erased 90 days later; the record that it existed, and any moderation decision about it, stay without the text. A post or reply that we remove is hidden at once, and its text is kept in our moderation records, with no fixed period. When your account is deleted, your posts and replies and the reports you sent, with the notes you wrote in them, stay, with your name removed and no longer linked to your account; a post or reply you deleted is still erased when its 90 days end. Your reactions are deleted
• Recipients: other people using the service, because posts are public; Google, whose Cloud Natural Language service checks the text of posts and replies for abuse and whose Cloud Translation service detects the language of a text and translates it for readers in another language; Hetzner (hosting)

The content policy acceptance record

• Examples: that you accepted the content policy before a reference was handed over: the version of the policy, the time, your IP address, the language of the app, and your account or, for a visitor, your device identifier
• Source: your device, when you accept
• Purpose: being able to show which version of the policy was accepted
• Lawful basis: our legitimate interest in keeping that proof
• Retention: a visitor's record is removed after 180 days. A member's record is deleted with the account
• Recipients: Hetzner (hosting)

Your saved titles and your reports

• Examples: titles you save to your list, and reports you send about a title or a reference
• Source: you
• Purpose: giving you your list on your devices, and fixing wrong or broken entries
• Lawful basis: performing our contract with you
• Retention: your saved titles and the record of a report are deleted with your account. A report also opens a request with our support desk, and that request is kept with our support records, for which no fixed period is set yet
• Recipients: Hetzner (hosting)

Your collections

• Examples: your collections, with their titles, descriptions and the notes in them, and the collections of other members that you save
• Source: you
• Purpose: keeping your collections on your devices, and showing a collection to other people when you make it public or share its link
• Lawful basis: performing our contract with you
• Retention: deleted with your account, except a collection that another member has saved and that was not private: it stays reachable by its link, with its title, description and notes, without your name, and is no longer listed
• Recipients: Hetzner (hosting), and other people for a collection you make public or share by its link

Your sign-in history

• Examples: a record of each time you sign in
• Source: our servers, automatically, when you sign in
• Purpose: keeping a record of the use of your account
• Lawful basis: our legitimate interest in the security of your account
• Retention: 90 days, then removed, and deleted with your account. Write to support@downloder.app to have it cleared sooner
• Recipients: Hetzner (hosting)

Diagnostics

• Examples: crash and error reports: what went wrong, the version of the app, the model of the device and its Android version. We set the reports up to carry no account details and no device identifier
• Source: the app, automatically, when an error happens
• Purpose: finding and fixing faults
• Lawful basis: our legitimate interest in an app that works
• Retention: Sentry deletes reports after the retention period of our plan
• Recipients: Sentry (Functional Software, Inc.), in its European Union region

Messages you send us

• Examples: e-mails to our addresses, and the name, e-mail address and text of a copyright notice or a report
• Source: you
• Purpose: answering you, and acting on notices
• Lawful basis: our legitimate interest in answering you, and legal obligations for notices
• Retention: we have not yet set a fixed period for these messages. They are kept until we delete them, and you can ask us to erase yours
• Recipients: Hetzner (hosting); Google, whose Cloud Translation service detects the language of each message when it arrives and translates it when needed; and, for e-mail, the provider that carries the mail

3. Profile pictures

If you have not uploaded a profile picture, we check whether a Gravatar exists for your e-mail address. To do that a hash of the address, not the address itself, is sent to Gravatar (Automattic Inc., United States). A picture found this way, or one from Google or GitHub, is copied to our own storage. Until that copy exists, the picture is loaded straight from Gravatar, Google or GitHub, so the browser or app of a person who sees your picture contacts that provider.

4. Advertising

Advertising is how the Downloader is meant to be paid for. The current version of the app shows no ads and contains no advertising software, so no advertising data is collected and the app does not read the advertising identifier of your device.

5. What the app does not collect

The app does not ask for your location, your contacts, your photos, your camera or your microphone. It does not record which other app you open a reference with, or what that app does.

6. Who receives your data

• Hetzner Online GmbH: hosting of our servers and stored files. Germany and Finland, inside the European Economic Area
• Cloudflare, Inc.: network security and delivery in front of our servers, and the approximate location it attaches to each request. Worldwide
• Google LLC: Firebase Cloud Messaging, Cloud Natural Language, Cloud Translation, and sign-in with Google. United States
• GitHub, Inc.: sign-in with GitHub, if you choose it. United States
• Twilio Inc.: text messages and phone calls that carry a sign-in code. United States
• Resend, Inc.: the e-mails we send you. United States
• Functional Software, Inc. (Sentry): crash and error reports. European Union region
• Automattic Inc. (Gravatar): the profile picture lookup described above. United States
• MaxMind, Inc.: supplies the location database we use on our own servers. It receives no data about you

We do not sell your personal information, and we do not share it for cross-context behavioural advertising.

7. Transfers to other countries

Wambesha LLC is a company in the United States, our team works from Kenya, and our servers are in the European Union. Some of the providers listed above process data in the United States. For those transfers we rely on standard contractual clauses (with the UK addendum) or the provider's Data Privacy Framework certification where they are in place with that provider. For data about people in Kenya we follow the transfer rules of Kenya's Data Protection Act, 2019.

8. Automated decisions

Text you post in the community is checked automatically. A post can be refused when you send it, or hidden until a person on our team has looked at it, and repeated rule-breaking can lead to limits on posting that are applied automatically. A refusal tells you the reason at once. A post that is hidden, and a limit on posting, come with a statement of the reason, and you can appeal either to a person.

9. Children

The Downloader is not for children under 13, and you confirm that you are at least 13 when you create an account. If the law of your country sets a higher age for agreeing to the use of your data (16 in parts of the European Economic Area, 18 in Kenya), you need the permission of a parent or guardian until you reach it. If you believe a child has given us data without that permission, write to us.

10. Your rights

Depending on where you live, you have the right to:

• see the data we hold about you and receive a copy of it
• have wrong data corrected
• have your data erased
• have our use of your data restricted
• object to our use of your data where we rely on a legitimate interest
• receive your data in a form you can take to another service
• withdraw a consent you gave
• complain to a data protection authority

In the app you can export your data (Settings, then Export my data) and delete your account (Settings, then the Danger Zone section, then Delete account). For anything else, write to support@downloder.app. We answer within one month.

You can complain to the data protection authority of the country where you live. In Kenya that is the Office of the Data Protection Commissioner, and in the United Kingdom the Information Commissioner's Office.

We have not appointed a representative in the European Union or in the United Kingdom, and we have not yet completed registration with Kenya's Office of the Data Protection Commissioner.

11. Deleting your account

The page called Delete your account explains how to delete your account, the 30-day waiting period, what is deleted and what stays.

What stays after your account is deleted, and for how long:

• Your posts and replies in the community stay, with your name removed and no longer linked to your account, so that conversations still read. No fixed period is set. A post or reply you delete yourself is hidden from everyone at once, and its text is erased 90 days after you deleted it. A post or reply we removed keeps its text in our moderation records, with no fixed period.
• A collection of yours that another member has saved stays, unless it was private: it is reachable by its link, with its title, description and notes, without your name, and it is no longer listed. No fixed period is set.
• Reports you made about other people's posts stay in the moderation record, with the notes you wrote in them, no longer linked to you. No fixed period is set.
• The statement of reasons for a moderation decision about one of your posts stays in the moderation record, no longer linked to you. No fixed period is set. Warnings and posting limits are deleted with your account.
• The time and IP address of your last sign-in, and the reason you gave for leaving if you gave one, stay on the closed account record. The rest of that record also stays, without your details: for example when you were last active, how often you signed in, your time zone and language, how you signed up, and whether your account was ever suspended and why. The reason you gave for leaving is also kept in the record of the deletion and in the audit records. No fixed period is set, except seven years for the audit records.
• Security and audit records, with the IP address and device details of each event, are kept for up to seven years. Ninety days after your account is deleted, your e-mail address is removed from the records of what you did; a record of a change our staff made to your account may still show it.
• The record of which versions of the terms and of this policy you accepted, when, and your confirmation of your age, is kept as proof of what was agreed. No fixed period is set.
• Messages you sent to our support desk stay; no fixed period is set yet. You can ask us to erase yours.

12. Contact

Privacy questions and requests: support@downloder.app. Our postal address is at the top of this policy.

13. Changes

We may change this policy. When we make a material change we publish the new version and ask you to acknowledge it the next time you use your account. Each published version carries a version label.

14. Language

This document is written in English. Translations are provided for convenience. If a translation differs from the English text, the English text governs, unless the law of the country where you live says otherwise.