BulkDownloader

BulkDownloader Privacy Policy

Effective date: October 28, 2026

This policy explains how BulkDownloader handles your information when you use our Chrome extension, website and API.

Who We Are and How to Contact Us

Warmath, a sole trader based in France, operates BulkDownloader. Warmath is responsible for the processing described in this policy. For support or privacy requests, contact support@getbulkdownloader.com.

Scope of This Policy

This policy covers data handled by the BulkDownloader extension, website and API. Instagram and any other third-party sites you visit have their own policies. Planned features described below are not currently available.

Information We Access and Collect

The extension reads the Instagram ds_user_id cookie to identify the numeric viewer ID of the person currently signed in to Instagram. This is the viewer, not necessarily the author of the content being downloaded. We do not store your Instagram user ID. We only process a derived identifier from your Instagram session to enforce usage limits. This identifier is not proof of a verified product identity or a unique person.

In your browser, the extension reads the current Instagram page URL and source information, and content metadata such as author IDs and usernames, content and media IDs, shortcodes, media URLs, media types, dimensions and publication times. Where present, it also reads captions, location names, interaction counts, collection names and series details to prepare and organize downloads.

Our API processes the derived identifier and receives download task information, including the target, mode, selection and applicable date selection, request identifiers, task authorization activity and result statistics for successful, failed or skipped files. Some task targets and operation identifiers contain author, username, content or media identifiers; these are not purely anonymous statistics. This information is used to manage service usage and task processing.

If you submit feedback, we receive its type and message, a request identifier, source context and extension version. Your message may contain personal information you choose to include. Do not include passwords, authentication cookies, tokens or sensitive payment information.

How We Use Your Information

We use the data described here to retrieve content you can access, prepare and organize browser downloads, manage service usage and task processing, prevent duplicate task settlement, apply your preferences and respond to feedback or technical problems. The API has a diagnostic endpoint for restricted event, version, scene, error-code and count fields; diagnostic events are not currently sent automatically by the extension or website.

Instagram Sessions and Media Processing

The extension uses csrftoken and page tokens such as LSD and DTSG in your browser when requesting content from Instagram. The browser sends the applicable session cookies to Instagram itself. We do not read or collect your Instagram password. Instagram authentication cookies and tokens are not sent to our servers. Our API processes only the derived session identifier described above for this purpose.

Media is fetched from Instagram and processed, downloaded or packaged into ZIP files in your browser. These media files do not pass through our servers. Local processing does not mean that task information stays entirely on your device.

Browser Permissions and Local Storage

Host access to www.instagram.com supports the download panel, source identification and requests using your Instagram browser session. Access to *.cdninstagram.com retrieves media directly. Access to the API origin fixed in your build supports service requests. Access to the website origin supports the product login bridge, whose content script is restricted to /login/*. Access to www.googleapis.com is already declared for the implemented Drive integration; it is not a permission requested only after connection. Product sign-in and Drive are not currently available.

chrome.storage.local stores language, image/video quality, media filters, naming rules, cover and JPEG date preferences, and onboarding status. chrome.storage.session is used by the product-account implementation for environment, account, login-flow and access/refresh credentials, restricted to trusted extension contexts; this is not an available sign-in feature.

IndexedDB stores local tasks, source URLs and identifiers, viewer IDs, task proofs and grants, selections, naming settings, media URLs and identifiers, filenames, status and Chrome download identifiers. The implementation also has records for planned tracking drafts and Drive recovery. After task settlement, compaction removes the viewer ID, request proof, grants and operation/output details, but retains task summaries including source, target and intent information. Preferences, drafts and retained summaries have no uniform automatic expiry.

The Origin Private File System (OPFS) holds temporary ZIP and media-processing files. Cleanup targets the associated output files; interruptions or cleanup failures can leave temporary files behind. This cleanup does not delete files already saved to your computer. You can clear local extension data in your browser; downloaded files remain on your computer.

Accounts and Optional Integrations

Product account sign-in is not currently available. Downloads to your computer do not require a product account. Google Drive is planned and not currently available. Custom date ranges and incremental sync are planned and not currently available. Payments are not currently available. Authentication and payment providers have not been connected.

Before enabling an integration, we will update this policy with its data flows, provider details, permissions and disconnection instructions.

Information Sharing and Service Providers

Cloudflare provides website hosting, the Workers API and D1 storage. Website and API requests reach Cloudflare infrastructure, including network request data, submitted API data and stored service records. The API emits structured error logs, generally event names and error types, without intentionally logging request bodies, viewer IDs or tokens. Cloudflare’s standard infrastructure processing applies; ask support@getbulkdownloader.com for current details about infrastructure logs, processing regions and related arrangements.

Instagram/Meta is the content source and receives requests directly from your browser, including the session information needed by Instagram. Google would receive integration data only after Drive is enabled; Drive is not currently available. No payment or product authentication provider is currently connected. We will disclose providers before enabling those services.

Configured external tool, support or uninstall links can lead to other sites governed by their own policies. An uninstall link can include the product name and extension version. These links are disabled when no valid configuration exists.

Limited Use of User Data

BulkDownloader’s use of user data complies with the Chrome Web Store User Data Policy, including the Limited Use requirements.

We use user data only to provide or improve the user-facing features described in this Privacy Policy and our Chrome Web Store listing. We do not sell user data, use or transfer it for personalized advertising, or use or transfer it to determine creditworthiness or for lending purposes.

Data Retention and Security

Eligible task records become subject to cleanup after more than 90 days from the end of their service period and after their reporting window closes. Cleanup applies to settled, expired or pending tasks for the relevant viewer and removes associated operations. Later requests trigger cleanup; these are not guaranteed deadlines or scheduled deletion. Task cleanup does not delete the derived viewer record.

Feedback and stored survey responses have an expiry set to 30 days after creation; diagnostic records have an expiry set to 1 day. Later writes to the same category in the same environment remove expired records. Without those requests, expired records may remain. The presence of survey and diagnostic endpoints does not mean the current clients submit them automatically.

In the account implementation, login flows are valid for 5 minutes, access tokens initially for 1 hour and refresh-token families for 30 days, without extending the absolute family deadline on refresh. These are validity periods, not record deletion periods; account sign-in remains unavailable. The server stores hashes of product access and refresh credentials, while browser-session credentials are restricted as described above.

We keep records only as long as needed to provide the service and for legal obligations. This applies to derived viewer records and other service records without a specific deletion schedule, including account, commercial and integration records, logs and backups. Contact support@getbulkdownloader.com to request deletion. Security measures cannot guarantee that the service will never be compromised.

Your Choices and Privacy Requests

You can change extension preferences, stop using the extension or uninstall it. Clearing local extension data or reinstalling does not delete server records or reset service usage. Downloaded files remain under your control on your computer.

The account and integration implementations include sign-out, tracking reset and Drive disconnection, but those features are not currently available through a live product sign-in. Sign-out revokes the current session family without deleting the account or Instagram usage records. Tracking reset clears anchors and related history but retains a scope identifier. Drive disconnection clears current connection credentials, does not delete Google files and is not the same as revoking access at Google.

There is no self-service tool to delete all server data or export all personal data. To request access, correction, export or deletion of your information, or to ask about your applicable privacy rights and how to exercise them, contact support@getbulkdownloader.com. We handle requests in accordance with applicable law. See the current support information.

Website Cookies and Similar Technologies

Our website does not set cookies, including product authentication cookies, and its API client omits cookies. Functional pages use sessionStorage at the current website origin for product-session information. The website uses no analytics or advertising scripts and does not load remote fonts or tracking SDKs.

Cloudflare’s standard infrastructure processing applies; ask support@getbulkdownloader.com for current details about edge cookies, infrastructure logs and processing regions.

Children’s Privacy

You must be at least 15 years old to use BulkDownloader. The service is not intended for children under that age. If you believe a child under 15 has provided personal information, contact support@getbulkdownloader.com to request deletion.

Changes to This Policy

We publish updates on this page. For material changes, where reasonably possible, we will notify by email users who have contacted our support team. Email delivery cannot be guaranteed. Updated disclosures will reflect changes to permissions, data flows, service providers and feature availability.

Related document: Terms of Service.