Privacy policy

Who is responsible

PostDown is run by its operator, who is also its privacy officer. Contact: support@postdown.app.

What we process and why

IP address: to apply the usage limits and protect the service from abuse. It is kept only in the server's memory, for up to 24 hours. The web server's access log keeps a shortened address (the first two parts of an IPv4 address, or the first 32 bits of an IPv6 address) for 7 days, for security.

Session cookie (__Host-pd): a code signed by the server so that only you can see and save your downloads. It holds a random identifier and when it was issued and checked, nothing about you. It lasts 2 hours and renews while you use the site; after 24 hours, or 2 hours without use, a new human check is needed.

Human check (Cloudflare Turnstile): when you open a page with the downloader or the report form, Cloudflare checks that a person, not an automated program, is using the site, so that the free service isn't drained by bots. It reads signals from your browser such as your IP address, TLS fingerprint and browser type. Most people see nothing; some are asked to tick a box. We receive only the result (whether it passed, for which page and when). Cloudflare does this on our behalf and also uses the signals to improve its bot detection, as described in its Turnstile Privacy Addendum (https://www.cloudflare.com/turnstile-privacy-policy/).

Language cookie (NEXT_LOCALE): remembers the language you chose, for 1 year.

Usage statistics (Google Analytics 4): cookies _ga and _ga_<id> let us count visits and see which pages are used, where visitors come from (the site or app that linked here) and their device type and approximate area (country or city). Google does not store your IP address in Analytics. The cookies last 13 months and the statistics are kept 14 months. In the EU/EEA, the UK and Switzerland these cookies are not set without your consent; there, Google receives only visits counted without cookies. To opt out anywhere, block cookies for this site or use Google's opt-out add-on (https://tools.google.com/dlpage/gaoptout).

The link you paste and the post's details: to fetch the post you asked for. They stay in the server's memory only while your download is prepared, at most 1 hour, and are never written to logs.

Previews: the photos on the results screen load straight from the platform's servers (for example Instagram's), so that platform receives your IP address and browser details under its own privacy policy. The files you save come from our server.

Downloaded files: stored on the server so you can save them, and deleted 1 hour after they're made.

Copyright reports: the name, email, role, description, links, message and signature you send through the takedown form, to handle the request and reply to you. The contact details are erased 1 year after the request is handled; the record of what was blocked stays while the block lasts.

Daily totals: numbers of downloads per platform and result. They contain no personal information.

Advertising

PostDown is free because it shows ads. The ads are chosen and served by the ad partners listed below, not by us. Ad partners and the vendors they work with, including Google, use cookies and similar technologies to serve ads based on your previous visits to this site and other websites, to limit how often you see the same ad, to measure ads and to prevent fraud. Google's advertising cookies let Google and its partners serve ads to you based on your visits to this site and other sites on the internet.

What they collect: your IP address, browser and device details, the pages you view here, the ads you see and tap, and cookie or advertising IDs. They collect it automatically and directly from your browser, keep it for as long as their own privacy policies say, and may process it in other countries, including the United States. PostDown doesn't pass them the links you paste or the files you download.

Your choices: where the law requires consent for ad cookies or personalised ads, we ask first in a consent message, and you can change your choice at any time with the consent tool on the site. Refusing turns off personalised ads, not ads: you'll still see ads chosen from the page rather than from information about you. You can also turn off personalised Google ads at https://www.google.com/settings/ads, opt out of many vendors' cookies at https://www.aboutads.info/choices or, in Europe, https://www.youronlinechoices.eu, and block third-party cookies in your browser settings.

Our ad partners, with their privacy policies and opt-out pages:

There are no ad partners at the moment.

Legal basis

We process this information because it's needed to provide the service you ask for and to keep it secure (for example Article 15(1)(4) and (6) of Korea's Personal Information Protection Act, and the equivalent bases in Brazil's LGPD and other laws). Copyright reports are also processed to meet legal duties around takedowns. Ads pay for the free service: where the law requires consent for ad cookies or personalised ads, they rely on your consent; elsewhere, on our legitimate interest in funding the service with ads.

Sharing

We don't sell or rent your information. Apart from the ad partners described under Advertising, and the hosting provider, Cloudflare's human check and Google Analytics below, we don't give it to anyone unless the law requires it.

Hosting and transfer abroad

The server is a virtual server in Tokyo, Japan, provided by Contabo GmbH (Aschauer Straße 32a, Munich, Germany; support@contabo.com). The information listed above is sent to and stored on it over an encrypted connection whenever you use PostDown, for as long as stated above, only to run the service. This transfer is needed to provide the service and is disclosed here as Korean law allows. If you don't want it, please don't use PostDown.

The human check is run by Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA), whose servers are in many countries, including the United States. The browser signals described above go to it when you start a session, only to tell people from automated programs.

Usage statistics are processed by Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA) with Google Analytics, on servers in the United States and other countries. The data described above goes to it as you browse, only to produce the statistics, and is kept 14 months.

How information is deleted

Information in memory is discarded automatically; downloaded files are deleted from disk; erased report details are overwritten in the database. Backups of the report database are kept for 30 days.

Your rights

You can ask to see, correct or delete your information, to restrict or object to its processing, and to withdraw consent. Because PostDown keeps almost nothing that identifies you, this mostly matters for copyright reports. Write to support@postdown.app; we reply within 10 days. You can also complain to your data protection authority, such as Korea's Personal Information Protection Commission or Brazil's ANPD.

Cookies

Cookies are small files your browser stores for a website. PostDown itself sets the session and language cookies and the Google Analytics cookies described above. You can block or delete them in your browser settings; without the session cookie, downloads won't work, and the site works the same without the others. Ad partners set their own cookies and similar technologies, as explained under Advertising.

Children

PostDown is for people aged 18 and over. If we learn that a child under 13 has given us personal information, we delete it.

Security

Connections use HTTPS; most information lives only in memory; downloads run in isolated processes; and access to the server is restricted to the operator.

Users in India, Brazil, Indonesia and Mexico

India: the Grievance Officer is PostDown operator, support@postdown.app; complaints are acknowledged within 24 hours. Brazil: support@postdown.app is our channel for data subjects (canal de comunicação). Indonesia and Mexico: you can exercise your rights, including access, correction, cancellation and objection, by writing to support@postdown.app.

Changes to this policy

We will post changes on this page before they take effect, with a new date at the top.