Privacy Policy

1. Data required to provide the service

We do not request a name, account, phone number or payment. When the downloader is used, the service receives the submitted link, IP address, time, method, response status and technical request and job identifiers.

The URL remains in the temporary queue job only while needed for processing. Completed jobs and file tokens expire within ten minutes; preview jobs expire sooner. Application logs redact URLs, tokens, cookies and credentials.

2. Temporary files

The worker stores a file only to prepare its transfer. A successful download removes it, and a minute-by-minute cleanup removes any remaining file or directory older than ten minutes. Failed jobs remove partial artefacts.

3. IP limits and abuse prevention

The API allows at most ten download starts per minute per IP; that counter stays in process memory for about one minute. A default limit of five downloads per hour stores only a truncated SHA-256 hash of the IP in Redis and expires it at the end of the hourly window.

These controls serve the legitimate interest of keeping the service secure and available. They are not used for advertising or profiling.

4. Logs and retention

Raw Nginx access logging is disabled. API and worker logs contain time, event type, method, status, duration, random request or job identifiers and aggregate proxy state. They do not contain raw IPs, submitted links, query strings, tokens or credentials.

Infrastructure limits each service to three log files of up to 10 MB. Rotation is volume-based, so there is no fixed number of days: older records are replaced as the cap is reached. An event may be preserved longer only for abuse or security investigations or a legal obligation.

5. Browser storage and cookies

Recent history, theme and analytics choice stay in the browser’s localStorage. A production Secure, HttpOnly and SameSite=Strict cookie may authorise one file transfer and expires with the job within ten minutes. The service worker caches only the static shell, never APIs, links, jobs, tokens or files.

6. Optional analytics

Plausible and Google Analytics 4 load only when configured and after “Accept analytics”. GA4 is requested with IP anonymisation. “Essentials only” prevents loading and removes existing _ga cookies. Providers may process data outside the EEA under their terms; the service works without analytics.

7. Sharing and transfers

The worker contacts the selected platform through VPN providers. The platform sees the VPN exit request rather than the browser’s direct IP. Personal data is not sold, and information is disclosed to authorities only under a valid legal duty.

8. Your rights

Under the GDPR and, where applicable, the LGPD, you may request confirmation, access, correction, deletion, restriction or objection and withdraw analytics consent. You may also complain to the relevant data protection authority.

Because there is no account and data is short-lived or pseudonymised, a record may not be attributable to you. Send available context to contato@baixarvideos.online.