Privacy Policy

Last updated: October 26, 2026

Video Downloader Plus ("we", "us", "our") is a video downloading platform that consists of a Chrome browser extension and a web application at vidow.io. This policy explains what data we collect when you use Video Downloader Plus to detect, download, cast, or save videos — and how we handle that data. It applies to everyone who installs the extension, visits our website, or creates a Video Downloader Plus account.

What Information Do We Collect?

When you use Video Downloader Plus's extension or web app, we may collect the following:

1.

Account information — if you sign up with email, your name, email address and password (stored only as a secure hash); if you sign in with Google, your name, email address and Google account ID, and, if you create your account with Google, a copy of your Google profile photo. We also store any profile photo you upload and your account settings, such as notification choices and two-step sign-in. This is used for authentication and account management.

2.

Payment information — payments are processed by Stripe, and we do not store your full card number. We keep the card brand, type, last four digits and expiry date, and records of your subscriptions, purchases, invoices, refunds and disputes, including the billing details on them. Where checkout asks for them, we also keep your billing address and VAT number.

3.

Information you share directly — anything you send us through the contact form, support emails, problem reports, or survey responses. When you use the contact form, we also attach your IP address, browser details and approximate country and, if you are signed in, your account ID and subscription details (plan, status, and trial or end dates) so we can help. Your answers to the survey shown when you uninstall the extension go only to our analytics provider, PostHog.

4.

Device and browser data — device type, operating system, browser, IP address, your approximate country (worked out from your IP address), your preferred language, and when you were last active. We use this to make the service work on your device and fix problems; to handle support requests (we attach your IP address, browser and country to the ticket); to enforce daily free limits and prevent abuse (your IP address is saved with each counted download or cast); to show prices in your local currency; to decide which offers, such as a free trial, are available in your country; and to measure which campaigns bring people to Video Downloader Plus.

5.

How you found us — when you arrive at vidow.io from another website or from a link with campaign tags, we note the page that linked you to us, the first page you opened, any campaign tags in the link (utm_ values) and any ad click IDs that Google, Meta (Facebook) or Microsoft add to their ad links (gclid, fbclid, msclkid). We also note which of our upgrade buttons you clicked. We keep this in your session.

  • If you create an account or choose a plan, we add your device type, browser and operating system and save it all with your account or purchase.
  • When you buy a plan, we also include it in the payment details we send to Stripe, where it stays with your payment records.
  • We use it to see which websites, searches and campaigns bring people who sign up or buy, and we don't send it to advertising networks.
  • If you click one of our buttons to install the extension, a cookie that lasts up to 24 hours links that click to the install.
6.

Website and app usage — our analytics provider, PostHog, records the pages you open on our website and web app, how long you stay on them and how far you scroll, and actions such as signing in, opening a download or cast page, saving to Watch Later, connecting Cloud Sync or buying a plan, including the domain of the website or video when you download, cast or save one. It uses a random ID stored in a cookie and in your browser's local storage. When you are signed in, it links this activity to your account ID, name, a partly hidden email address, country and plan.

7.

Source page URLs — when you download a video, open it in the Chromecast player, save it to Watch Later or report a problem, the address of the page where the video was found is sent to our servers. When you open the extension's popup on a page where it hasn't found an HLS stream (a common format for streaming video), it also sends that page's address so our servers can look up the video. We don't track your general browsing.

8.

Extension device key — a random UUID stored in chrome.storage.local. It supports extension activity, quota fallback, and account association when you sign in. It is also sent to our analytics provider, PostHog, when the extension opens one of our pages.

9.

Extension install, update and uninstall events — when the extension opens our welcome, update or goodbye page, that page sends the extension's device key, version and browser (and, on most of these pages, your operating system) to our servers. We add your approximate country based on your IP address, and link the event to your account if you are signed in. The same details go to PostHog, along with anything you type in the goodbye page's survey.

10.

Background sign-in check — from time to time, the extension checks with our servers whether you are signed in to Video Downloader Plus. If you are, it links its device key to your account and syncs your Watch Later list.

11.

Server quota cookie (vidow_device) — a random pseudonymous UUID cookie set by vidow.io. It is stored with download and cast quota records to preserve daily limits when the extension is reinstalled. Signed-in usage may associate it with your account. It is not used for advertising or cross-site tracking.

12.

Video metadata — titles, thumbnails, quality labels and source domains when you download a video or upload it via Cloud Sync, and the page link, title and thumbnail when you add a video to Watch Later (we keep a copy of the thumbnail in our storage).

13.

Download and streaming activity — the quality and format you select, download session status, and whether the stream is HLS or DASH. While a download runs, the download page also sends diagnostics automatically (speed, stream format and errors). Used for download limits, fixing problems and service improvement.

14.

Free-limit log — each time you reach a free limit, for example on downloads, casts, tools or Watch Later saves, we record when it happened and which limit it was, with your account or the extension's device key. We use this to see how often people reach the free limits.

15.

Problem reports — when you click Report Issue on a download page, or Report in the extension when it finds no video, we receive the page address. For download problems we also receive the stream address, the video title, error details and your full browser details. We also record your IP address, your account if you are signed in, and, for reports sent from the extension, its device key. Requests for a new Cloud Sync provider are stored the same way.

16.

Files you open in the Cast Player — when you choose or drop a video file in the Cast Player, your browser uploads it to our cloud storage (Cloudflare R2) so your Chromecast can play it.

17.

Cloud Sync credentials — if you connect Google Drive, Dropbox, Amazon S3 or Cloudflare R2, we store, encrypted, the tokens or keys needed to upload files for you. We also store the connected account's email address, your folder and bucket settings, and a history of your uploads to that provider (file names, sizes and links to the uploaded files). Files go from your browser straight to your provider.

Stream detection runs inside your browser. The extension watches network requests and scans the pages you visit, on your device, to find HLS and DASH video streams. Apart from the install, update and uninstall notices, a periodic check of whether you are signed in (which also syncs your Watch Later list when you are), and the checks the popup makes when you open it (your remaining daily downloads and, on a page where no HLS stream was found, a lookup of that page's address), nothing is sent to Video Downloader Plus's servers until you take an action — downloading, casting, saving to Watch Later, reporting a problem or uploading via Cloud Sync. We never collect your browsing history.

How Do We Use Your Information?

Your data is used to operate and improve Video Downloader Plus and to understand how people find it:

•Processing video downloads, Chromecast sessions, and Cloud Sync uploads
•Managing your account, subscription, and download limits
•Responding to support requests and bug reports
•Sending account notifications and product updates
•Reminding you by email about a checkout you started but did not finish (you can turn this off in your notification settings)
•Detecting abuse, fraud, or policy violations
•Understanding how people use the service through product analytics (PostHog), linked to your account when you're signed in, so we can find problems and improve it
•Measuring which websites, searches and campaigns bring people who sign up or buy

We will never use your information for targeted advertising.

Who Do We Share Your Information With?

We never rent or sell your information.

We don't share your personal information except in these cases:

1.
Infrastructure providers — hosting and email delivery services that help us run Video Downloader Plus.
2.
Payment processing (Stripe) — Stripe receives your name, email address and payment details, and your billing address when we ask for it. When you buy a plan, we also attach how you found us (see What Information Do We Collect?) to the subscription or invoice, so we can see which channels lead to purchases. We don't send these details to advertising networks.
3.
Product analytics (PostHog) — PostHog, our analytics provider, receives information from our website and servers:
  • Pages: the address and title of each page you view, how long you stay on it and how far you scroll down it, the page that referred you, and any campaign tags or ad click IDs in the link.
  • Events: sign-ups, sign-ins, checkouts, plan changes, payments and feature use. Events can also include the domain of the website or video server when you open a video to download, stream or cast it, or save it to Watch Later; coupon codes; the subject line of contact-form messages; and, for a failed payment, the card brand, type, country, last four digits, decline reason and amount.
  • The extension: when it opens one of our pages after you install, update or uninstall it, that page sends PostHog the extension's device key, version and browser. Your uninstall-survey answers go only to PostHog.
  • What links it to you: signed-out visitors are counted under a random ID. When you sign in, PostHog links that browser's activity to your account ID, including what you did in the same browser before you signed in. Your PostHog profile holds your name, a partly hidden email address (for example j***[email protected]), your country, how you signed up, and your plan and subscription status.
  • Cookie: PostHog receives your IP address and browser details, and stores an ID in a cookie (ph_…_posthog, which lasts up to a year) and in your browser's local storage.
  • Where it is kept: PostHog keeps this data in the United States. We don't use it for advertising.
4.
Error and performance monitoring (Laravel Nightwatch) — to find and fix problems, our servers send Laravel Nightwatch records of a sample of requests, plus errors and background jobs. A request record holds the full web address, which can contain the video and page addresses the extension sends us, your IP address, and your browser's user agent and other request headers. Passwords, cookies and authorization headers are not recorded. If you are signed in, the record also holds your account ID, name and email address.
5.
Customer support (BoldDesk) — when you use the contact form, we send BoldDesk, our help-desk provider, your name, email address, chosen topic, subject and message, together with your IP address, browser user agent and the country detected from your IP address. If you are signed in, we also send your account ID, Stripe customer ID, plan, subscription status, trial and subscription end dates, the date you created your account, and whether your account is premium, lifetime, email-verified or suspended, so we can answer without asking you for them.
6.
Cloud Sync providers — when you connect Dropbox, Google Drive, Amazon S3 or Cloudflare R2, your downloaded files are transferred directly to your chosen provider, and we don't store them on our servers. For Dropbox, after each upload Video Downloader Plus creates a Dropbox shared link to the file. Unless your Dropbox settings restrict sharing, anyone with the link can open the file. The link appears in your upload history and is stored with it. You can delete the link in Dropbox.
7.
Chromecast (Google Cast) — our cast pages load Google's Cast software from Google's servers, so Google receives your IP address and browser details when you open them. When you cast, the video address, title and thumbnail are passed to Google's media receiver on your Chromecast, which loads the video directly.
8.
Cast Player storage (Cloudflare R2) — when you choose or drop a file in the Cast Player, it is uploaded to our Cloudflare R2 storage behind a link that expires after 2 hours, so your Chromecast can play it. An hourly clean-up deletes the file once it is more than 2 hours old.
9.
Legal obligations — if required by law, regulation, or court order.
10.
Business transfers — if Video Downloader Plus is acquired, your data transfers with the same protections described here.

Security

Encrypted in Transit

All traffic between you and Video Downloader Plus is encrypted via HTTPS / TLS

Encrypted at Rest

Account data and Cloud Sync tokens are stored on encrypted infrastructure

Restricted Access

Only Video Downloader Plus staff accounts with admin access can use our admin tools. Most changes made there, such as suspending or deleting an account or signing in as a user to help them, are logged

No system is 100% secure. We protect your data with encrypted connections, hashed passwords and encrypted Cloud Sync tokens. If we discover a breach that affects your personal information, we will email affected account holders and follow the breach-notification laws that apply.

Your Rights

Regardless of where you live, you can exercise any of these rights by emailing [email protected]. We will respond within 30 days.

Access

Get a copy of all personal data Video Downloader Plus holds about you, including download history and account details.

Correction

Ask us to fix any inaccurate information we hold — for example, an incorrect email or name on your account.

Deletion

Delete your account in Settings, or ask us to delete it and the personal data linked to it. Deleting your account cancels your subscription and deletes the Cloud Sync tokens and keys we stored. To remove Video Downloader Plus's access completely, also remove it from the connected apps in your Google or Dropbox account, or delete the access key you created for Amazon S3 or Cloudflare R2. Some records are kept after deletion, as described under Data Retention.

Portability

Receive your data in a structured, machine-readable format so you can transfer it to another service.

California Residents

CCPA

If you live in California, the CCPA gives you extra rights. Video Downloader Plus does not sell your personal information and never has.

Category How we collect it Why we use it
Identifiers (email, name) Account sign-up (email or Google), checkout, contact form Account management, support, billing, product analytics
Pseudonymous quota identifiers Extension storage and Vidow responses Daily download and cast limits, abuse prevention, and counting installs, uninstalls and active extensions (device keys are also sent to our analytics provider, PostHog)
Internet / network activity Extension usage, page URLs when you download, cast, save or report a video or open the popup on a page where no HLS stream was found, pages you open on vidow.io, and the page or ad link that brought you to vidow.io Stream detection, download processing, diagnostics, product analytics, measuring our marketing
Device / browser data Automatically from your browser Compatibility, debugging, abuse prevention
Commercial information (your plan, purchases, invoices, refunds and disputes) At checkout and from Stripe Billing, refunds and fraud prevention
Payment details (card brand, last four digits and expiry date; Stripe holds the full card number) From Stripe Showing and managing your payment methods
Billing address and VAT ID At checkout or in billing settings, when we ask for them Invoices and tax
Profile photo Copied from your Google account or uploaded by you Shown on your account
General location (your country, worked out from your IP address) From your IP address Pricing currency, free-trial availability and analytics

Right to Know / Access

Request what data Video Downloader Plus holds about you (up to 2 requests per 12 months)

Right to Delete

Ask us to delete your account and personal data. Some records are kept, as described under Data Retention

European Union Residents

GDPR

If you are in the EU or EEA, the GDPR provides you with additional protections. We rely on these legal bases: contract, to provide Video Downloader Plus, your account and anything you buy; legal obligation, to keep tax and accounting records; and legitimate interests, to keep Video Downloader Plus secure and prevent fraud and abuse, to measure how Video Downloader Plus is used (including the product analytics described above) and which campaigns bring people to it, to send service emails such as the daily-limit notice, and to remind you, sometimes with a discount, when you leave checkout without finishing. You can turn off checkout reminders in Settings → Notifications, and you can object to any processing based on legitimate interests by emailing [email protected]. You may exercise any of the rights below at any time:

Right of access
Right to rectification
Right to erasure
Right to restrict processing
Right to object to processing
Right to data portability

Video Downloader Plus will never share your personal information with third parties for their own marketing. If you believe we have not handled your data correctly, you have the right to lodge a complaint with your local data-protection authority.

Extension Permissions

Chrome requires extensions to declare every permission they need upfront. Here is exactly what Video Downloader Plus asks for and why:

webRequest

Inspect network requests to identify HLS and DASH video streams on the current page. This is how Video Downloader Plus detects downloadable content. For a detected video, the extension also keeps on your device a copy of the request headers your browser sent, including the page it came from and any cookies sent with it, so the video can be fetched the same way.

tabs

Read the current tab's URL and title so Video Downloader Plus can label detected streams and open the download page.

storage

Persist your extension settings, Watch Later list, and download preferences locally in Chrome.

declarativeNetRequest

Adds temporary rules that change request headers. When the extension checks a stream it found, for example to read its playlist and work out its quality and size, it sends those requests with the page's address and, when needed, the cookies your browser sent. While a Video Downloader Plus download or cast page is open, it adds rules for that tab only. They send the saved headers, including those cookies, with requests for the video's pieces and relax the video site's CORS and framing protections for them, so your browser can download or cast the video. These headers and cookies stay in your browser and are not sent to our servers.

host_permissions

Broad site access is needed because videos can appear on any website.

  • What it reads: on the pages you visit, the extension watches network requests to find video streams. A script it runs in each page and embedded frame also looks for video and audio elements and links to video files, and reads the page's title and preview image (from the page's metadata or a video's poster image) to label what it finds. These scripts read pages but don't change them. The extension also adds a small script to Video Downloader Plus's own download and cast pages so they can work with it.
  • Your actions: the extension sends information to our servers when you download, cast, save to Watch Later or report a problem.
  • When you open its popup: if you're not Premium, it checks your remaining daily downloads, sending its device key, and if it hasn't found an HLS stream (a common format for streaming video) on the page, it sends us the page's address so we can look up the video.
  • In the background: it checks whether you are signed in to Video Downloader Plus and, if you are, links its device key to your account and syncs your Watch Later list.
  • Install, update and removal pages: when you install or remove the extension, and the first time you open it after a major update, a Video Downloader Plus page opens that sends the extension's random device key, its version and your browser (and, on most of these pages, your operating system) to us and to our analytics provider, PostHog. We also record your country, based on your IP address, and, if you are signed in, link these records to your account.
downloads

Optional — only requested if you enable the custom download-folder setting. Lets Video Downloader Plus save files to a specific directory instead of the browser default.

Cookies & Communication

Cookies

vidow.io sets the session cookie and XSRF-TOKEN on your first visit, whether or not you sign in. The session cookie holds a random, encrypted ID for your visit. On our servers, that session keeps you signed in and stores a few details, such as the link or campaign that brought you here. XSRF-TOKEN protects forms against forged requests. A remember-me cookie is set when you sign in with Google, or with a password and Remember me ticked. It keeps you signed in for up to 400 days, or until you sign out.

vidow.io also sets the pseudonymous vidow_device cookie for daily download and cast limits and abuse prevention. It is not used for advertising or cross-site tracking.

The vidow_device browser copy expires 395 days after its latest renewal. Clearing Vidow site data removes it; uninstalling the extension does not because website cookies and extension storage are separate. Blocking it makes quota checks fall back to other available identifiers.

vidow_locale remembers your language for up to 12 months. It is set when the site shows you a language other than English (for example because of your browser's language) or when you pick a language. vidow_install_diag is set for 24 hours when you click one of our buttons to install the extension. It holds a random ID that tells us which of our pages led to the install, and it is removed once the extension reports the install from the same browser. sidebar_state remembers whether the dashboard sidebar is open. It is set when you open or close the sidebar and kept for 7 days.

ph_…_posthog is the analytics cookie of PostHog, our analytics provider (see Who Do We Share Your Information With?). It is set on your first visit, whether or not you sign in, and kept for up to a year.

JWT: when you are signed in, we set this cookie for vidow.io and all its subdomains so you can comment on our blog without signing in again. It holds your name, email address, profile-picture link and account ID. It is signed but not encrypted, lasts up to 200 hours, is renewed while you use the site signed in, and is not removed when you sign out. Because it is sent to every vidow.io subdomain, BoldDesk, which runs our help desk at support.vidow.io, also receives it when you visit that site.

We also keep some things in your browser. In local storage: your download settings, theme, sidebar state, dismissed tips and PostHog's analytics data. In IndexedDB: the progress of Cloud Sync uploads to S3-compatible storage, so they can resume, including the file name, size and upload position. In session storage: a few checkout details while you pay. While a stream download is being put together, the download page stores the video in your browser's private file storage. It deletes it when you cancel or restart the download. Otherwise, it deletes any stored video more than 3 hours old the next time you open a stream download page, and every 30 minutes while one is open. A video left behind when you close the tab stays in your browser until then, or until you clear site data for vidow.io.

Stripe's payment script, which we load only on our checkout and Billing pages, may set its own cookies for fraud prevention (see Stripe's privacy policy). The cast pages load Google's Cast script from Google's servers so your browser can find your Chromecast.

Emails

We send emails about your account, security and billing. Examples are password resets, email verification, two-factor changes, subscription, payment and trial notices, and a notice when you've used your free downloads for the day (which also suggests upgrading). You can't turn these off while you have an account. If you start checkout and don't finish, we may send up to three reminder emails over about three days, once per account. The second and third include a discount code. You can turn these off at any time in Settings → Notifications (Recovery offers). We may also occasionally email you about product updates or service issues. To stop those, use the unsubscribe link if the email has one, reply to the email, or write to [email protected].

Chrome Web Store User Data Policy

Video Downloader Plus complies with the Chrome Web Store User Data Policy, including the Limited Use requirements. In practice, that means:

•Data collected by the extension is used only to provide and improve Video Downloader Plus — stream detection, downloads, Chromecast, Cloud Sync.
•We do not transfer user data to third parties for advertising or any unrelated purpose.
•We do not use or transfer user data to determine creditworthiness or for lending.
•People at Video Downloader Plus with admin access can open individual records, for example a download's page and video address, the IP address and browser used, and the account it belongs to, and can sign in as a user to help them. They do this only to answer your support requests and problem reports, to investigate fraud, abuse or security problems, or when the law requires it. Otherwise our staff look at this data only in aggregate, for example counts of downloads per site.

Data Retention

Here are the retention periods and criteria:

•Account data — kept while your account exists. When you delete your account, we delete your account record right away, together with your profile, Watch Later list, Cloud Sync connections and upload history, the list of browsers you are signed in on, your subscription and saved-card records in our database, and the download- and cast-limit, sign-up source and purchase source records linked to your account. Some records are kept, as the next two entries explain.
•Records kept after you delete your account — billing records (invoices, payments, refunds, disputes and fraud reviews, including the copies Stripe sends us), which we keep for tax and accounting; our account activity log, which keeps your sign-in history and a note of the deletion with your name and email address; our server logs, which record the deletion with your email address; a record of announcement emails we sent you, with your email address and first name; and problem reports, extension events, the free-limit log and download sessions, which are no longer linked to your account but can still contain your IP address or country, the extension's device key and page addresses. Your profile photo file and the Watch Later thumbnails we stored are not deleted either.
•Copies held by our service providers — Stripe keeps your customer record, including any card saved there, and your payment and invoice records; PostHog keeps your analytics profile (with your name and partly hidden email address) and the events linked to it, including one that records the deletion of your account; Laravel Nightwatch keeps what it received for the retention period set in our account; BoldDesk keeps your support conversations; and our email delivery provider may keep records of the emails we sent you, such as your email address and whether each one was delivered, for its own retention period. Deleting your account doesn't delete these copies. Email [email protected] to ask us to delete any of these records, or to ask our providers to delete their copies, where the law allows.
•Stream detection data — kept only inside the extension. It is removed when you close the tab, and anything left over that is more than 24 hours old is cleared when the extension next starts.
•Popup lookups — kept only inside the extension: the page address it sent us and the video details our servers returned for it. They count as expired after 1 hour, or 5 minutes if no video was found, and expired ones are deleted the next time the extension's background process starts, which it does often, for example when your browser starts. Closing the tab doesn't remove them.
•Watch Later entries — retained until you remove them or delete your account. Thumbnail copies we stored for them are not deleted at that time.
•Download and cast records — when you download or cast a video, we store the page address, stream address, title and thumbnail. For downloads we also store the video's length and size, your IP address, browser details and extension device key. Download records, with the diagnostics sent during the download, are deleted about 90 days after they were created or last reopened, and cast records about 90 days after they were created. The thumbnail copies we make for our download pages are not deleted with the records.
•Download and cast limit records — the date, the quality (for downloads), a hash of the video address (for casts, so the same video isn't counted twice) and the identifiers used for daily limits (your account, extension device key, quota cookie and IP address) are kept while your account exists. Records not linked to an account are covered under Anonymous quota records.
•Free-limit log — kept with no fixed time limit.
•Problem reports — kept with no fixed time limit, as are requests for a new Cloud Sync provider.
•Support requests — kept in our help desk (BoldDesk) with no fixed time limit.
•Cloud Sync tokens and keys — deleted from our database when you disconnect the provider or delete your account, together with that provider's upload history. We don't revoke them with the provider, so Video Downloader Plus may still be listed as a connected app in your Google or Dropbox account until you remove it there; for Amazon S3 or Cloudflare R2, delete the access key you created.
•Cast Player uploads — the playback link stops working after 2 hours, and an hourly cleanup deletes files more than 2 hours old.
•Sign-in records — for each browser where you sign in, we keep its IP address, browser details and last activity time so you can review your sessions. When you sign out of a browser, or use Log out other sessions in your settings, a daily cleanup deletes its record about 90 days later. Records for browsers you never signed out of are kept while your account exists.
•Account activity log — sign-ins, sign-outs, password resets, email verification, and changes to your name, email address, saved card type and last four digits, or two-step sign-in are logged and kept with no fixed time limit, including after you delete your account.
•Sign-up and purchase source records — kept while your account exists.
•Extension events — kept with no fixed time limit.
•Extension device key — the copy in chrome.storage.local is normally removed when you uninstall the extension. Copies already sent to our servers with downloads, casts, reports or extension events are kept as described for those records.
•vidow_device browser cookie — expires 395 days after its latest renewal. Clearing Vidow site data removes the browser copy; uninstalling the extension does not.
•Anonymous quota records — retained indefinitely for quota enforcement and abuse prevention unless deleted following an applicable verified request. Clearing browser data does not delete records already stored on our servers.

Children Under 13

Video Downloader Plus is not directed at children under 13. We do not knowingly collect personal information from anyone under 13. If you believe a child has provided us with personal data, please contact us and we will promptly delete it.

Changes & Contact

Policy Updates

We may revise this policy as Video Downloader Plus evolves. If we make a material change, like collecting a new category of data, we'll update the date at the top of this page and, if you have an account, email you before the change takes effect. If you use the extension without an account, please check this page from time to time. Continued use of Video Downloader Plus after a change means you accept the updated policy.

Questions?

If anything in this policy is unclear, reach out — we're happy to explain.

[email protected]