Privacy Policy

1. Overview

StoriesDL is designed to do one job without building a profile of you. We do not require an account, we do not sell personal information, and we do not keep a history of the posts you download.

This policy explains what this website processes when you use storiesdl.com, why it is processed, and the choices you have.

2. Information we process

• Link you submit: the Instagram URL is processed to retrieve the public post. It is used for the extraction request and may appear in short-lived operational logs or error reports. It is not used to build an advertising profile.
• Request data: IP address, user agent, language preference, request ID, timestamps, and response status. We use these for rate limiting, abuse prevention, security, and aggregate reliability metrics.
• Derived network data: a truncated or hashed IP value may be used as a rate-limit key. We do not use it to identify you across other services.
• Consent choices: your cookie preferences are stored in your browser's local storage, not in a server-side profile.
• Contact messages: if you use the contact form, we process your name, email address, subject, message, and request metadata so we can reply.
• Advertising and analytics data: only if you consent. Google AdSense and any configured analytics provider may set cookies or receive device identifiers as described in our Cookie Policy.

3. Legal bases

Where the GDPR or similar law applies, we rely on the following legal bases: performance of a contract or steps at your request (providing the Service); legitimate interests (security, abuse prevention, service reliability, and improving the Service); consent (advertising cookies, analytics cookies, and optional third-party features); and legal obligation (responding to valid legal requests and keeping required records).

You can withdraw consent at any time through the privacy settings control or your browser settings. Withdrawal does not affect processing that happened before withdrawal.

4. Cookies and local storage

We use a small number of necessary cookies and browser storage entries to remember your language and your privacy choices. Advertising and analytics cookies are disabled until you allow them. The Cookie Policy lists the categories and providers in more detail.

5. How we use information

• Fetch public post data and return signed media links.
• Enforce rate limits and protect the Service from abuse, scraping, and attacks.
• Diagnose errors, measure aggregate uptime, and improve extraction reliability.
• Respond to support, privacy, abuse, and copyright requests.
• Show advertising that funds the Service, but only where you have consented.
• Comply with legal obligations and enforce our Terms.

6. Sharing and service providers

We do not sell personal information. We share limited data with service providers that help us run the Service, under contract and only for the purposes described here. Depending on the deployment, these may include:

• Hosting and network providers, including Cloudflare and our application host, for content delivery, security, and server logs.
• Redis or Upstash, for rate limiting, caching, and in-flight request deduplication.
• Google AdSense, for advertising where you consent.
• Google Analytics or Plausible, for aggregate analytics where configured and consented.
• Resend, for delivering contact-form messages.
• Apify or a similar extraction provider, when Instagram blocks our direct request and a fallback is required. Only the public post URL is sent.
• Professional advisers, auditors, or authorities where required by law or necessary to protect rights and safety.

7. Retention

Extracted post metadata is cached briefly to reduce load and is then discarded. Media files are streamed and are not stored on our servers. Operational logs are kept for a short period appropriate to security and debugging, then deleted or aggregated. Contact messages are kept for as long as needed to handle the request and any related legal obligation. Rate-limit counters and consent choices expire automatically.

8. International transfers

Our providers may process data in countries other than yours. Where required, we rely on appropriate safeguards such as Standard Contractual Clauses or an adequacy decision. You can contact us for more information about the safeguards used for a particular transfer.

9. Your rights

Depending on where you live, you may have the right to access, correct, delete, restrict, or object to processing of your personal information, to data portability, to withdraw consent, and to lodge a complaint with your supervisory authority. To exercise a right, email [email protected]. We may need to verify your request and will respond within the time required by law.

You can also object to direct marketing at any time, although we do not currently send marketing email.

10. Security

We use signed media tokens, strict host allowlists, request rate limits, security headers, and other controls designed to protect the Service. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. Please do not send passwords, private media, or sensitive personal information through the contact form.

11. Children

The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, contact us and we will take appropriate steps to delete it.

12. Changes to this policy

We may update this policy to reflect changes in the Service or the law. The revised version will be posted here with a new date. If a change materially affects how we use personal information, we will provide additional notice where required.

13. Contact

Privacy questions and other requests: [email protected].