Downly - Privacy Policy / 隐私政策

个人信息处理负责人：ZHU SHAOLONG，在中国以 Smartools 品牌运营 Downly。隐私联系邮箱：downly@smartools.cc。

1. 数据收集与使用

Downly 帮助用户将文件和支持页面上的媒体保存到本机. 本政策涵盖浏览器扩展及其配套桌面客户端. 电脑客户端目前仅支持 Windows, macOS 版暂不提供. 根据所用功能, Downly 会处理以下数据:

支持页面的媒体元数据: 在支持的页面上识别媒体流 URL、页面 URL、标题、封面及可用画质, 用于展示下载选项、预解析媒体信息和创建下载任务. 检测可随页面播放自动进行.
下载链接与请求信息: 用户右键选择 "用 Downly 下载" 时, 将链接 URL、当前页面 URL (作为 Referer)、建议文件名、匹配该链接的 cookie 和浏览器 User-Agent 转交本机桌面客户端.
可选的浏览器下载接管: "接管浏览器下载" 默认关闭. 开启后, 扩展读取符合接管条件的新下载的 URL、Referer、文件名及已知文件大小, 连同匹配链接的 cookie 和 User-Agent 交给桌面端. 桌面端确认接收后, 扩展取消对应的 Chrome 下载并删除该条 Chrome 下载记录; 未接收时尝试恢复浏览器下载.
站点 cookie: 用于支持服务的媒体信息 / 画质查询、预解析和下载, 或下载用户选定的链接. 支持服务的 cookie 名白名单与通用链接的 cookie 范围不同, 详见第 4 节.
统计与授权数据: 默认开启且可关闭的使用统计包含随机安装 ID (第 3 节); 桌面端激活、解除绑定和授权检查涉及激活码与设备相关信息 (第 6 节).

扩展不读取完整浏览历史或与下载无关的网页正文, 不请求精确位置, 也不以收集健康、财务或通信内容为目的. 下载 URL、文件名、cookie 或计算机名称本身可能包含个人信息; 它们按本政策所述功能处理, 不作为使用统计内容发送.

2. 单一目的与架构

本扩展的单一目的是: 帮助用户下载文件和支持页面上的媒体, 并保存到本机. 下载方式包括:

浏览器内下载: 对支持的播放页面和画质 (当前最高 720P), 在本机记录页面播放的音视频数据, 在浏览器内合并成 MP4, 通过 Chrome 下载保存. 媒体来自源站服务器; 合并在本机完成, 不上传到 Downly 服务器处理.
桌面客户端下载: 通过本机 Native Messaging 将媒体或普通文件链接交给单独安装的 Downly 桌面客户端, 由桌面端直接请求源站及其 CDN 下载. 用户还可选择开启浏览器下载接管.

以下缓存和文件处理在本机进行; 这不代表下载源站、统计服务和授权服务无需网络请求:

数据	用途	范围
媒体元数据	识别支持页面上的媒体, 展示下载选项	按标签页缓存于 `chrome.storage.session`, 浏览器关闭自动清空; 桌面端可短暂缓存预解析结果
媒体数据 (浏览器内下载)	在本机合并音视频并保存	合并期间暂存于扩展私有存储, 保存后删除; 下次运行清理时删除超过 24 小时的中断暂存文件
链接与任务信息	右键下载或开启接管后, 将下载请求交给本机桌面端	扩展不持久化这些下载请求; 桌面端保存本地任务记录 (见第 6 节)
Cookie	向匹配的源站请求媒体信息或用户可访问的下载内容	扩展不持久化所读取的 cookie; 桌面端的临时使用和任务保存范围见第 4 节

扩展与桌面客户端之间的 Native Messaging 通信仅限本机. 下载和媒体信息查询仍会连接源站服务器, 这些服务器会收到请求 URL、IP 地址及下载所需的请求头 (可能包含 Referer、User-Agent 和匹配的 cookie). 统计和授权请求另见第 3、6 节.

3. 匿名使用统计与第三方

为了解使用情况和下载失败原因, 扩展默认发送匿名使用统计, 可随时关闭. 此处的 "匿名" 指不主动附带姓名、邮箱等身份资料; 随机安装 ID 是持久的假名标识符, 可将同一次安装的事件关联起来. Downly 不集成广告服务.

发送的内容: 随机安装 ID; 事件时间、扩展版本及更新前版本、界面语言、操作系统与处理器架构、浏览器类型、安装天数、桌面端是否可用及其版本; 下载的开始 / 完成 / 失败 / 取消及重试情况、站点类别、所选画质、耗时、文件大小 (取整到 MB)、分辨率、编码与失败原因分类; 下载按钮的展示 / 点击次数 (按天汇总)、隐藏操作、设置操作及推广入口点击.
统计不包含: 网址、媒体 ID、媒体标题、文件名、错误原文、cookie、浏览记录、激活码、机器哈希、计算机名称或姓名、邮箱等身份资料.
接收方: PostHog (posthog.com, 默认接收端 eu.i.posthog.com). 网络请求会向接收方暴露 IP 地址, 服务端可据此推导国家/地区; 扩展不在事件字段中主动附加 IP, 并请求 PostHog 不创建用户画像.
本地保存与关闭方式: 安装 ID、统计开关、计数及待发送事件保存在 chrome.storage.local. 点击扩展图标, 打开右上角设置, 取消勾选 "发送匿名使用统计" 后, 停止后续统计发送并删除本地待发送事件和计数. 关闭不会删除安装 ID 或已发送到 PostHog 的数据, 也不会关闭下载或桌面授权所需的网络请求.

4. Cookie 用途说明

cookies 权限用于向本机桌面客户端提供源站请求所需的 cookie, 范围分为以下两类:

支持服务的媒体查询与下载: 对已支持的媒体服务按 cookie 名白名单读取该服务所需的登录、会话、访问者及偏好 cookie (如 SAPISID、SID、LOGIN_INFO、PREF), 供桌面端媒体工具访问用户登录状态下可用的内容. 此读取也可能在支持页面检测到媒体后的自动预解析、悬停预解析或画质查询时发生, 不限于最终点击下载. 该路径不读取白名单以外的 cookie; 其他支持服务不因此获得这些 cookie.
普通链接 / 浏览器下载接管: 用户右键下载链接, 或开启默认关闭的接管功能后, 扩展通过 chrome.cookies.getAll({ url }) 读取匹配该下载链接的 cookie. 此路径不使用上述 cookie 名白名单, 可能包含匹配 URL 的登录、偏好或其他 cookie, 连同 User-Agent 交给本机桌面端. 通用下载引擎对每次请求 (包括跳转后的请求) 按域名、路径及 Secure 属性重新匹配, 不把 cookie 发给不匹配的网站. Cookie 可保存在本机任务记录中以支持继续下载, 直到下载完成或任务被删除时清除.

扩展不将读取的 cookie 持久化, 也不将它们发送给 PostHog 或 Downly 授权服务. 桌面端会为媒体工具临时使用 cookie 文件, 或按上述范围保存通用下载任务的 cookie, 并向匹配的源站发送所需 cookie.

5. 权限完整说明

权限	用途
`webRequest`	只读观察网络请求, 按支持页面范围筛选可下载媒体流 URL (HLS / DASH / MP4 等); 此监听器不修改、拦截或重定向请求
`downloads`	保存浏览器内生成的文件、设置可读文件名、跟踪下载状态; 用户开启接管后读取符合条件的新下载信息, 暂停 Chrome 下载, 桌面端接收后取消并删除对应 Chrome 记录, 或在交接失败时尝试恢复 / 重新开始浏览器下载
`storage`	用 `chrome.storage.session` 缓存各标签页媒体信息; 用 `chrome.storage.local` 保存设置 (含接管和统计开关)、随机安装 ID、计数与待发送统计
`tabs`	读取标签页 URL 关联媒体与来源页面; 标签页关闭时清理缓存
`scripting`	准备下载时在相关标签页读取 og:image / video.poster, 用作下载界面的封面
`cookies`	见第 4 节的支持服务白名单与通用链接两种范围
`declarativeNetRequestWithHostAccess`	当前版本仅用于清理旧版本遗留的动态请求规则
`nativeMessaging`	与本机 Downly 桌面端交换下载任务、媒体查询、cookie 及状态信息; 此通信通道不经过互联网
`contextMenus`	在链接右键菜单增加 "用 Downly 下载", 仅显示于链接上下文
`host_permissions <all_urls>`	识别支持页面经动态跨域 CDN 提供的媒体, 发起所需的跨域媒体请求, 并读取用户右键下载或开启接管后的下载链接所匹配的 cookie. 媒体检测按支持页面筛选; 通用链接下载可涉及其他网站

6. 配套桌面客户端与授权服务

桌面客户端需单独安装, 直接连接文件 / 媒体源站及其 CDN 下载, 在本机保存下载文件、任务 URL、文件名 / 路径、进度、设置和运行日志. 任务记录可由用户在桌面端管理或删除; 删除任务不一定删除已保存的文件. 桌面端不把下载文件内容上传给授权服务.

本地授权记录: 桌面端保存试用开始时间、激活码、签名授权凭证及上次检查时间. 试用开始时间还保存在另一处本机用户配置目录, 可能在卸载重装后保留.
联网激活: 激活时向 https://downly.smartools.cc/v1/activate 发送激活码、本机生成的加盐机器标识哈希和计算机名称 (最多 64 个字符). 哈希根据操作系统机器标识生成, 无法读取时使用本地备用标识; 原始机器标识不上传. 哈希仍是可关联设备的标识符, 计算机名称也可能包含个人信息.
服务端记录与用途: 授权服务由 Cloudflare 托管, 保存激活码 ID、机器哈希、计算机名称和激活时间, 用于绑定设备、统计激活数量、执行设备数量上限及处理撤销授权. 达到设备上限时, 可向持有同一激活码的客户端返回已绑定的计算机名称.
解除绑定与检查: 解除绑定时向 /v1/deactivate 发送激活码和机器哈希, 服务端删除对应设备绑定. 已激活客户端通常离线校验签名凭证, 并按约 7 天的间隔尝试向 /v1/check 发送激活码和机器哈希检查是否撤销; 网络失败时可能稍后重试. 服务端可保留激活码撤销状态及原因. 这些授权请求独立于扩展统计开关.

授权服务及其托管平台会接收网络请求所带的 IP 地址等连接信息. 当前公开购买入口尚未开放; 以下说明购买开放后的支付数据处理, 不表示结账已启用.

付款与订单: 付款由 Waffo Pancake 处理. 创建结账时, Downly 向 Waffo Pancake 发送商品标识、随机订单号、金额、币种和付款结果页地址. Waffo Pancake 及其支付合作方按结账页面说明处理付款资料; Downly 的结账服务不收集或保存完整银行卡号或安全码.
订单记录: Downly 在 Cloudflare 托管的数据库保存订单号、创建及付款时间、金额、币种、支付状态、结账会话标识和发放的激活码; 如你向 Downly 提供邮箱, 也会保存到订单或支持记录. 我们接收 Waffo Pancake 的支付状态通知并核验, 用于确认付款、交付授权、查询订单和处理付款争议或退款.
网站本地存储与支持: 语言选择与最近未完成订单号保存在浏览器本地存储, 以记住语言及恢复订单查询; 激活码显示后清除该未完成订单号, 你也可通过清除网站数据删除. 联系支持时, 我们会处理你提供的邮箱、订单信息和问题说明. 请勿发送完整银行卡号、安全码或不必要的敏感资料.
保存与权益: 订单、授权及支持记录用于提供服务、排查问题、处理争议及履行适用法律要求, 按这些用途所需的期间保存. 可通过下方邮箱申请访问、更正或删除; 对依法或处理未解决争议必须保留的记录, 我们会说明保留原因.

7. 用户权益与联系

用户可关闭使用统计或浏览器下载接管, 并随时在 chrome://extensions/ 移除扩展. 移除扩展会清除其浏览器存储, 不会删除桌面端文件、独立保存的试用记录或服务端记录.
可在桌面端解除设备绑定; 有关访问、更正或删除授权记录及其他隐私问题, 请联系 downly@smartools.cc. 为定位记录可能需要提供相关激活码 ID 等信息.

8. 政策变更

本政策若有更新, 将更新本页日期并通过版本说明公告. 依法需要另行告知或取得同意时, 我们会按适用要求处理.

Data controller: ZHU SHAOLONG, an individual operating Downly under the Smartools brand in China. Privacy contact: downly@smartools.cc.

1. Data Collection & Use

Downly helps users save files and media from supported pages to their device. This policy covers the browser extension and its companion desktop client. The desktop app currently supports Windows only; a macOS version is not available yet. Depending on the features used, Downly processes the following data:

Media metadata from supported pages: media stream URLs, page URLs, titles, thumbnails, and available qualities, used to display download options, prepare media information, and create download tasks. Detection can occur automatically as media plays.
Download links and request information: choosing "Download with Downly" on a link passes its URL, the current page URL (as Referer), a suggested filename, cookies matching the link, and the browser User-Agent to the local desktop client.
Optional browser download takeover: "Take over browser downloads" is off by default. When enabled, the extension reads the URL, Referer, filename, and known file size of eligible new downloads and passes them with matching cookies and the User-Agent to the desktop client. After the desktop client accepts, the extension cancels the corresponding Chrome download and removes that Chrome download record; otherwise it attempts to restore the browser download.
Site cookies: used for media information / quality queries, preparation, and downloads on supported services, or for downloading a user-selected link. Supported-service cookie name allowlists and generic link cookie access have different scopes, explained in Section 4.
Statistics and license data: usage statistics are enabled by default, can be turned off, and include a random install ID (Section 3); desktop activation, deactivation, and license checks involve an activation code and device-related information (Section 6).

The extension does not read your full browsing history or page text unrelated to downloading, request precise location, or seek to collect health, financial, or communication content. Download URLs, filenames, cookies, or computer names may themselves contain personal information; they are processed for the functions described here and are excluded from usage statistics.

2. Single Purpose & Architecture

The extension's single purpose is to help users download files and media from supported pages and save them to their device. Download methods include:

In-browser download: for supported playback pages and qualities (currently up to 720P), the extension records the audio and video the page plays, merges it into an MP4 locally, and saves it through Chrome. Media comes from source servers; merging takes place on the device without uploading it to a Downly server for processing.
Desktop client download: local Native Messaging passes media or ordinary file links to the separately installed Downly desktop client, which requests the download directly from the source and its CDNs. Users may also enable browser download takeover.

The following caching and file processing take place locally; source downloads, analytics, and licensing still require network requests:

Data	Purpose	Scope
Media metadata	Identify media on supported pages and display download options	Cached per tab in `chrome.storage.session`, cleared on browser close; the desktop client may briefly cache prepared media information
Media data (in-browser download)	Merge audio and video locally and save the result	Temporarily kept in the extension's private storage and deleted after saving; interrupted staging files older than 24 hours are removed the next time cleanup runs
Links and task information	Pass download requests to the local desktop client after a right-click action or when takeover is enabled	The extension does not persist these download requests; the desktop client keeps local task records (Section 6)
Cookies	Request media information or accessible download content from matching source sites	Cookies read by the extension are not persisted by it; desktop temporary use and task storage are described in Section 4

Native Messaging between the extension and desktop client stays on your device. Downloads and media information queries still contact source servers, which receive the request URL, IP address, and required request headers (potentially including Referer, User-Agent, and matching cookies). Analytics and license requests are described in Sections 3 and 6.

3. Anonymous Usage Statistics & Third Parties

To understand usage and download failures, the extension sends anonymous usage statistics by default; you can turn this off at any time. Here, "anonymous" means that names, email addresses, and similar identity details are not deliberately attached; the random install ID is a persistent pseudonymous identifier that links events from the same installation. Downly does not integrate advertising services.

What is sent: a random install ID; event time, extension and previous version, UI language, operating system and processor architecture, browser type, days since installation, desktop availability and version; download start / completion / failure / cancellation and retry results, site category, selected quality, duration, file size (rounded to MB), resolution, codec, and failure category; download button impressions / clicks (aggregated per day), hide actions, settings actions, and promotional link clicks.
Excluded from statistics: URLs, media IDs, media titles, filenames, raw error messages, cookies, browsing history, activation codes, machine hashes, computer names, or identity details such as names and email addresses.
Recipient: PostHog (posthog.com, default endpoint eu.i.posthog.com). The network request exposes the IP address to the recipient, which may derive a country/region from it; the extension does not explicitly add an IP field to events and asks PostHog not to create person profiles.
Local storage and opting out: the install ID, preference, counters, and queued events are stored in chrome.storage.local. Open the extension popup, open settings at the top right, and uncheck "Send anonymous usage statistics" to stop subsequent statistics sending and delete locally queued events and counters. Opting out does not delete the install ID or data already sent to PostHog, or disable requests needed for downloads or desktop licensing.

4. Cookie Permission

The cookies permission supplies the local desktop client with cookies needed for source requests, with two different scopes:

Media queries and downloads for supported services: a cookie-name allowlist for supported media services selects the login, session, visitor, and preference cookies needed by that service (such as SAPISID, SID, LOGIN_INFO, and PREF) so the desktop media tool can access content available in the user's signed-in state. This may also occur during automatic preparation after media detection on a supported page, preparation on hover, or quality queries, before a final download click. This path excludes cookies outside the name allowlist; other supported services do not thereby receive these cookies.
Ordinary links / browser download takeover: after a user right-clicks a link to download it, or enables takeover (off by default), the extension uses chrome.cookies.getAll({ url }) to read cookies matching that download URL. This path does not use the cookie-name allowlist above and may include matching login, preference, or other cookies. They are passed with the User-Agent to the local desktop client. For each request, including redirects, the generic download engine matches domain, path, and Secure attributes again and does not send cookies to nonmatching sites. Cookies may be retained in the local task record for resumable downloads until the download completes or the task is deleted, when they are cleared.

The extension does not persist the cookies it reads or send them to PostHog or the Downly license service. The desktop client temporarily uses cookie files for its media tool or stores generic download task cookies as described above, and sends required cookies to matching source sites.

5. Permissions Reference

Permission	Use
`webRequest`	Observe requests read-only and filter for downloadable media stream URLs (HLS / DASH / MP4 etc.) from supported pages; this listener does not modify, block, or redirect requests.
`downloads`	Save files generated in the browser, set readable filenames, and track download state; when the user enables takeover, read eligible new download information, pause Chrome downloads, cancel them and remove their Chrome records after desktop acceptance, or attempt to resume / restart browser downloads if handoff fails.
`storage`	Cache per-tab media information in `chrome.storage.session`; store settings (including takeover and analytics preferences), the random install ID, counters, and queued statistics in `chrome.storage.local`.
`tabs`	Read tab URLs to associate media with source pages; clear cached data when tabs close.
`scripting`	Read og:image / video.poster in the relevant tab while preparing a download to provide its thumbnail.
`cookies`	See the supported-service allowlist and generic link scopes in Section 4.
`declarativeNetRequestWithHostAccess`	Currently used only to remove dynamic request rules left by older versions.
`nativeMessaging`	Exchange download tasks, media queries, cookies, and status with the local Downly desktop client; this channel does not use the internet.
`contextMenus`	Add "Download with Downly" to the link context menu, shown only for links.
`host_permissions <all_urls>`	Detect media served to supported pages by dynamically selected cross-origin CDNs, make required cross-origin media requests, and read cookies matching links downloaded through a right-click action or enabled takeover. Media detection filters for supported pages; generic link downloads can involve other sites.

6. Companion Desktop Client & License Service

The desktop client is installed separately and downloads directly from file / media sources and their CDNs. It locally stores downloaded files, task URLs, filenames / paths, progress, settings, and application logs. Users can manage or delete task records in the desktop client; deleting a task does not necessarily delete saved files. The desktop client does not upload downloaded file contents to the license service.

Local license records: the desktop client stores the trial start time, activation code, signed license token, and last check time. The trial start time is also kept in a separate local user configuration location and may survive uninstalling and reinstalling.
Online activation: activation sends the activation code, a locally generated salted hash of a machine identifier, and the computer name (up to 64 characters) to https://downly.smartools.cc/v1/activate. The hash is derived from an operating system machine identifier, with a local fallback identifier if unavailable; the raw machine identifier is not uploaded. The hash still identifies a device across requests, and the computer name may contain personal information.
Server records and purpose: the license service is hosted on Cloudflare and stores the activation code ID, machine hash, computer name, and activation time to bind devices, count activations, enforce device limits, and handle license revocation. When the device limit is reached, registered computer names may be returned to a client holding the same activation code.
Deactivation and checks: deactivation sends the activation code and machine hash to /v1/deactivate, which deletes the corresponding device binding. Activated clients normally verify their signed token offline and attempt a revocation check at roughly seven-day intervals by sending the activation code and machine hash to /v1/check; failed network requests may be retried later. The server may retain license revocation status and reasons. These license requests are independent of the extension's analytics preference.

The license service and its hosting platform receive connection information such as the request IP address. Public purchasing is not currently open; the following explains payment data handling when purchasing becomes available and does not mean checkout is enabled.

Payments and checkout: Waffo Pancake processes payments. To create checkout, Downly sends Waffo Pancake the product identifier, random order ID, amount, currency, and payment result page address. Waffo Pancake and its payment partners process payment details as described at checkout; Downly's checkout service does not collect or store full card numbers or security codes.
Order records: Downly stores the order ID, creation and payment times, amount, currency, payment status, checkout session identifier, and issued activation code in a Cloudflare-hosted database. If you provide an email address to Downly, it is also retained in order or support records. We receive and verify Waffo Pancake payment status notifications to confirm payment, deliver licenses, look up orders, and handle payment disputes or refunds.
Website local storage and support: your language choice and most recent unfinished order ID are stored in your browser to remember your language and resume order lookup. The unfinished order ID is cleared when the activation code is displayed; you can also remove it by clearing site data. Contacting support involves processing the email address, order details, and issue description you provide. Do not send full card numbers, security codes, or unnecessary sensitive information.
Retention and rights: order, license, and support records are retained for as long as needed to provide the service, diagnose issues, resolve disputes, and meet applicable legal requirements. You can request access, correction, or deletion using the address below. We will explain if records must be retained for legal requirements or unresolved disputes.

7. Rights & Contact

You can turn off usage statistics or browser download takeover and remove the extension at any time through chrome://extensions/. Removing it clears its browser storage, but does not delete desktop files, the separately stored trial record, or server records.
You can deactivate the device in the desktop client. For access, correction, or deletion of license records and other privacy concerns, contact downly@smartools.cc. Information such as the relevant activation code ID may be needed to locate records.

8. Policy Updates

When this policy changes, we will update the date on this page and announce the changes in release notes. Where applicable law requires separate notice or consent, we will follow those requirements.