Privacy Policy
Last updated: October 2, 2026
1. Who is responsible for your data
The controller of the personal data described in this policy is [TO COMPLETE: legal entity name], [TO COMPLETE: address], which operates SocialDownload: the website socialdownload.fr (the “Website”) and the SocialDownload desktop application (the “Desktop App”), together the “Service”.
For any question about your data or to exercise your rights, write to privacy@socialdownload.fr.
2. In short
- We collect what the Service needs to work, to be paid, and to stay fair and secure. Nothing more.
- No advertising, no sale of data, no third party trackers.
- IP addresses and browser fingerprints are stored only as salted hashes, and erased on a fixed schedule.
- Card payments are handled by Stripe: we never see your full card number.
- If you sign in with Google, we receive only your name, email address and profile picture link, and use them only to create your account and sign you in (see section 4).
3. Data we collect
| Category | Data | When |
|---|---|---|
| Account | Email address, first name, last name. Your password is handled by Supabase Auth and stored only in hashed form. If you sign in with Google, the information Google shares with us is described in section 4. | When you create an account |
| Orders | Product, amount, currency, status, dates, Stripe session and payment references. Card details are collected by Stripe; we never see full card numbers. | When you buy a credit pack or a license |
| Credit history | Each movement of your credit balance (purchase, download, automatic return, adjustment) with the resulting balance. | When your balance changes |
| License and devices | Your license, its status and its activations: device name, platform, app version and a hash of the machine identifier (never the identifier itself). | When you activate, refresh or release the Desktop App |
| Download logs | At most the title of the media, never the media itself and never its link: platform, title, selected formats and quality, date and time, result, and the country derived from your IP address by our host. No IP address, fingerprint or device identifier is attached to this log. | For each download on the Website |
| Anti abuse signals | A salted hash of your IP address; a salted hash of a browser fingerprint computed from canvas and WebGL rendering, screen, timezone, language and hardware characteristics; a random device identifier stored in a cookie and in your browser's local storage. | When you use the download tool on the Website |
| Security logs | For the restricted administration area: salted hashes of the IP address, fingerprint and device identifier, browser type, country and result of each access attempt. | When someone tries to access the administration area |
| Messages | Your email address and the content of your message. | When you write to us |
We do not keep the media you download: files are streamed to you as they are prepared and are not stored on our servers afterwards. The Desktop App downloads directly on your computer. It contacts our servers for your account and license (sign in, activation, refresh, release); it does not send us the links you download or the files. If you let it use your browser session, that session is read on your computer and never sent to us.
We measure audience and performance with Vercel Web Analytics and Speed Insights. They do not use cookies and only give us aggregated statistics, such as pages viewed, referring sites, countries, device types and loading times.
4. Sign in with Google
You can create a SocialDownload account and sign in with your Google account, using the “Continue with Google” button on the Website. This is optional: you can also use an email address and a password.
Data we receive from Google. When you choose “Continue with Google” and accept on Google's consent screen, Google shares with us only the basic sign in information: your email address and whether it is verified, your name, the link to your profile picture, and the identifier of your Google account. We do not request access to your Gmail, Google Drive, contacts, calendar, YouTube account or any other Google data, and we never receive your Google password.
How we use it. We use this information only to:
- create your SocialDownload account, or link the sign in to the account that already uses the same email address;
- sign you in and keep you signed in;
- show your name and email address on your account page, and link your orders, credits and licenses to your account;
- send you messages about your account and purchases, and answer you when you contact us.
We copy your email address, first name and last name into your account profile. We do not use your profile picture.
What we never do. We do not sell data received from Google, we do not use it for advertising, we do not share it with anyone except the providers that host the Service on our behalf (Supabase and Vercel, see section 7) or when the law requires it, and we do not use it to develop, improve or train artificial intelligence or machine learning models. Nobody reads it, except with your consent, for security reasons, to comply with the law, or in aggregated form for our internal operations.
SocialDownload's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Storage and protection. This information is stored by Supabase Auth, our authentication provider, and in our database, which is protected by row level security and accessed only over encrypted connections (HTTPS).
Retention and deletion. We keep this information as long as your account exists. To delete your account and the information received from Google, write to privacy@socialdownload.fr from the email address of your account: we delete it within one month, except the order records we must keep for accounting. You can also remove SocialDownload's access at any time from the permissions page of your Google account; this stops Google sign in but does not delete your SocialDownload account.
Google processes your sign in as an independent controller, under the Google Privacy Policy.
5. Why we use it and on which legal basis
| Purpose | Legal basis |
|---|---|
| Providing the Service: delivering downloads, managing accounts, credits, licenses and device activations, customer support | Performance of the contract (our Terms of Service) |
| Processing payments and keeping track of orders | Performance of the contract |
| Signing you in with your Google account, when you choose to | Performance of the contract, at your request |
| Enforcing the free daily allowance, preventing fraud and abuse, limiting request rates | Legitimate interest: keeping a free tier open to everyone without requiring an account, and protecting the Service |
| Securing the administration area | Legitimate interest: protecting the Service and your data against unauthorized access |
| Aggregated statistics on audience, performance and downloads (by platform, by country) | Legitimate interest: understanding and improving the Service |
| Handling copyright notices and abuse reports | Legitimate interest, and legal obligations where they apply |
| Keeping accounting records (orders, invoices) | Legal obligation (Article L123-22 of the French Commercial Code) |
| Answering requests to exercise your rights | Legal obligation |
Where we rely on legitimate interest, we have checked that it does not override your rights: the anti abuse signals are hashed, used only for the purposes above, never for advertising or to follow you on other websites, and erased on the schedule set out in section 9.
6. How the free allowance works
The free tier allows one download per day without an account. To prevent the same person from taking it again and again, we check three signals before each free download: the random device identifier kept in a cookie and in your browser's storage, the hash of your browser fingerprint, and the hash of your IP address (for IPv6, of its network prefix). If any of them has already used the day's free download, the free download is refused, and you can use credits or the Desktop App instead.
The fingerprint is derived from technical characteristics of your browser and device. We only store a hash of it, made with a secret salt, which cannot be turned back into those characteristics. The same applies to your IP address.
This check is automated, but it only decides whether a free download is available today. It has no legal effect on you and does not similarly significantly affect you within the meaning of Article 22 of the GDPR.
7. Who receives your data
Your data is accessible only to us and to the service providers below, which process it on our behalf and on our instructions (processors), under contracts that meet the requirements of Article 28 of the GDPR.
| Provider | Role | Location | Safeguard for transfers |
|---|---|---|---|
| Supabase | Database and authentication | London, United Kingdom | Adequacy decision of the European Commission for the United Kingdom |
| Vercel | Hosting, audience and performance measurement without cookies | United States | EU Standard Contractual Clauses and EU US Data Privacy Framework |
| Stripe | Payment processing | Ireland and United States | EU Standard Contractual Clauses and EU US Data Privacy Framework |
Stripe also acts as an independent controller for the processing it carries out for its own legal obligations, such as fraud prevention and anti money laundering checks, under its own privacy policy.
We may also disclose data when the law requires it, for example to a court or a competent authority. We never sell your data and never share it for advertising.
8. Transfers outside the European Union
Some of our providers are located outside the European Union. Transfers to the United Kingdom rely on the adequacy decision of the European Commission. Transfers to the United States rely on the EU US Data Privacy Framework and on the Standard Contractual Clauses adopted by the European Commission. You can ask us for information about these safeguards at privacy@socialdownload.fr.
9. How long we keep it
| Data | Retention period |
|---|---|
| Free allowance counters | 35 days |
| Download logs | 12 months. They contain no network or browser identifier. |
| Security logs of the administration area | 180 days |
| Account, credit history, license and device activations | Until you ask us to delete your account, except data we must keep as accounting records |
| Orders and invoices | 10 years, as required by accounting law |
| Device identifier in your browser | 1 year for the cookie; until you clear your browser data for local storage |
| Information received from Google (section 4) | As long as your account exists; deleted with it |
| Messages | As long as needed to handle your request and its follow up |
10. Security
Data is encrypted in transit (HTTPS). Access to the database is restricted by row level security and server side controls. Passwords are hashed by Supabase Auth. License keys are stored hashed and encrypted. IP addresses and fingerprints are stored only as salted hashes. The administration area is protected by several layers of access control.
11. Your rights
Under the GDPR and the French Data Protection Act (loi Informatique et Libertés), you have the right to:
- access your data and receive a copy of it;
- have inaccurate data corrected (rectification);
- have your data erased;
- restrict its processing;
- receive the data you provided in a structured, machine readable format (portability);
- object at any time, on grounds relating to your particular situation, to processing based on our legitimate interest;
- give instructions on what happens to your data after your death (post mortem directives, Article 85 of the French Data Protection Act).
To exercise these rights, write to privacy@socialdownload.fr, from the email address of your account if you have one. We answer within one month. This period can be extended by two months for complex requests, in which case we tell you why. If we have reasonable doubts about your identity, we may ask for additional information.
Anti abuse signals are stored as hashes, so we can only link them to you from the identifiers they were computed from, for example a request made from the same browser and network. If you object to these signals, we can no longer offer you the free tier, but credits and the Desktop App remain available.
You can also lodge a complaint with the French data protection authority, the CNIL (3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr), or with the supervisory authority of your country of residence in the European Union.
12. Children
The Service is not directed at children under 15, and we do not knowingly collect their data. If you believe that a child under 15 has created an account, contact us and we will delete it.
13. Changes to this policy
We may update this policy. The date of the latest version is shown on this page, and we inform account holders of any significant change by email. Our use of cookies and similar technologies is detailed in the Cookie Policy.