Privacy Policy

Who is responsible for your information

IGDown is operated by Baljit, an individual operator based in New Delhi, India. References to “IGDown,” “we,” “us,” or “our” mean Baljit operating the IGDown service. For applicable privacy laws, Baljit is the data controller or Data Fiduciary responsible for the processing described in this policy.

Privacy questions and requests can be sent to support@igdown.pro with the subject “Privacy request.” Postal location: New Delhi, India. Email is the designated and fastest contact channel because IGDown does not operate public customer-service premises.

Scope of this policy

This policy applies to igdown.pro, its public downloader, support pages, and related web routes controlled by IGDown. It does not govern Instagram, Meta, YouTube, TikTok, Facebook, X, Pinterest, downloaded media hosts, or other third-party websites and services, which apply their own privacy terms.

IGDown is an independent service and is not affiliated with, sponsored by, or endorsed by Instagram, Meta, or another supported platform. Do not submit private links, credentials, session cookies, direct-message content, or information that you are not authorized to provide.

Categories of information processed

IGDown is designed without public user accounts. The information processed depends on how you use the service and can include the following categories:

• Submitted content data: a public media URL, its platform and route, public post or reel identifier, and any public metadata or media addresses returned by the source platform.
• Technical and network data: IP address, request timestamp, browser and device type, user agent, requested route, referrer when supplied, response status, request identifier, performance measurements, and security diagnostics.
• Download data: the public media host, file type, and transient request details needed to proxy or deliver the selected public file.
• Support and legal correspondence: email address, name, message, attachments, URLs, and any information you voluntarily include in a support, privacy, security, or copyright request.
• Preference and analytics data: the analytics-consent choice stored in your browser, and page, device, approximate location, referrer, and interaction information collected by an enabled analytics service as described below.

How information is collected

Information is collected when you submit a URL, request a preview or download, browse the website, choose an analytics preference, or contact IGDown. Some technical data is supplied automatically by your browser, network, hosting provider, and security infrastructure.

Public media information is obtained from the URL you provide and from the relevant publicly accessible source platform or media host. IGDown does not ask for or intentionally collect Instagram login credentials.

Purposes and legal bases

IGDown processes information only for specified operational, security, support, measurement, and legal purposes. Depending on the law that applies, the legal basis is performance of the service you request and these Terms, your consent, legitimate interests that are not overridden by your rights, or compliance with legal obligations.

• Service delivery: validate and normalize a supported public URL, retrieve the public source, resolve available media, create a preview, and deliver a requested file.
• Security and reliability: rate-limit abuse, prevent malicious requests, investigate failures, protect infrastructure, and maintain service availability.
• Support and administration: answer questions, investigate reports, maintain correspondence, and enforce the Terms of Service.
• Optional measurement: use Google Analytics only after consent, and use cookieless Vercel Web Analytics or Speed Insights only when explicitly enabled for the deployment.
• Legal compliance: respond to valid rights requests, legal process, copyright notices, disputes, fraud, or security incidents.

Automated processing

IGDown automatically validates URLs, detects supported platforms, extracts public media, caches short-lived results, applies rate limits, and returns errors or previews. These operations decide whether a request can be processed technically; they do not make decisions that produce legal or similarly significant effects about an individual.

If an automated control incorrectly blocks a legitimate public request, contact support@igdown.pro with the request time, non-sensitive URL, browser, and visible error. Never send a password, authentication cookie, or two-factor code.

Recipients and service providers

IGDown discloses information only as needed for the purposes above. Recipients can include Vercel or another hosting and delivery provider; Google when consented Google Analytics is enabled; Webshare or a replacement proxy-network provider for public-source requests; the relevant source platform and public media host; email and support providers; professional advisers; and authorities when disclosure is legally required.

A submitted URL or public media address may be sent through hosting, proxy, extraction, and source-platform infrastructure to complete the request. Providers process information under their own terms or contractual obligations. IGDown does not give them permission to use submitted URLs for their independent advertising purposes.

International data transfers

IGDown is operated from India, while hosting, analytics, proxy, email, source-platform, and media-delivery providers may process information in India, the United States, Europe, or other countries where they operate. Those countries may have privacy laws different from those in your location.

Where applicable law requires a transfer mechanism, IGDown relies on provider contractual safeguards, standard contractual clauses, adequacy decisions, or another lawful transfer basis. You may request available information about applicable safeguards by emailing support@igdown.pro.

Retention schedule

IGDown keeps information only for the shortest period reasonably necessary for the stated purpose, subject to legal, security, and dispute requirements. Current application-level retention is:

• Rate-limit entries keyed to an IP address are held in volatile server memory for approximately one minute and then expire, subject to normal pruning and instance lifecycle.
• Resolved public URL and media results are held in volatile server memory for approximately five minutes for general platforms and ten minutes for Instagram by default; a deployment can shorten or adjust these operational cache periods.
• IGDown does not operate a separate persistent database of submitted downloader URLs. Hosting and security request logs are retained under the configured hosting plan and provider controls for operational and security needs.
• Analytics data is retained according to the configured Vercel or Google Analytics account settings. Google Analytics user-level retention is configured through Google’s available retention controls.
• Routine support and privacy correspondence may be retained for up to 24 months after resolution. Security, fraud, copyright, and legal records may be retained for up to three years, or longer when required for an active claim or legal obligation.
• Browser local-storage preferences remain until you reset them, clear site data, or the browser removes them.

Cookies, local storage, and analytics

When a Google Analytics measurement ID is configured, Google Analytics is loaded only after you choose Allow analytics. If you decline, the Google Analytics script is not loaded. The choice is stored in local storage under igdown-analytics-consent. You can change it from the Cookie Policy or clear site data.

Cookieless Vercel Web Analytics and Speed Insights load only when the deployment variable NEXT_PUBLIC_ENABLE_VERCEL_ANALYTICS is explicitly set to true. Vercel can process page path, referrer, coarse location, browser, device, operating system, and performance measurements. Essential hosting and security processing occurs regardless of optional analytics consent because it is needed to deliver and protect the site.

No sale or targeted-advertising sharing

IGDown does not sell personal information, does not share personal information for cross-context behavioural advertising, does not offer financial incentives for personal information, and does not knowingly sell or share personal information of people under 18. Submitted URLs and support details are not licensed to data brokers.

Because IGDown does not sell or share personal information for targeted advertising, it does not currently provide a separate “Do Not Sell or Share” link. If these practices change, IGDown will update this policy and provide any legally required choice before the new processing begins.

Your privacy rights

Depending on your location and whether a law applies to IGDown, you may request confirmation or access, correction, deletion, restriction, objection, portability, withdrawal of consent, information about recipients and transfers, or review of a grievance. You may also have a right to complain to the Data Protection Board of India or the privacy regulator or supervisory authority in your place of residence.

Send requests to support@igdown.pro with the subject “Privacy request” and describe the right you want to exercise. IGDown may ask for information reasonably necessary to verify that the request relates to you, but will not ask for an Instagram password. Requests are handled without unlawful discrimination and within the period required by applicable law.

• Consent can be withdrawn for future Google Analytics collection by resetting or declining the analytics choice.
• Because downloader URLs and rate-limit data are transient and there are no public user accounts, IGDown may be unable to identify or retrieve data associated with a person after it expires.
• A request can be limited or refused when identity cannot reasonably be verified, data belongs to another person, or an applicable legal exception requires or permits retention.

Security and data minimisation

IGDown uses HTTPS in production, input validation, supported-host allowlists, request identifiers, access controls, rate limits, short-lived in-memory caches, restricted infrastructure credentials, and logging designed not to include raw client IP addresses or submitted downloader URLs at the application layer. No internet service can guarantee absolute security.

You can reduce risk by submitting only supported public URLs, removing unnecessary tracking parameters, keeping passwords and private links out of the service, using a current browser, and reporting suspected vulnerabilities privately to support@igdown.pro.

Children

IGDown is intended only for people who are at least 18 years old. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided personal information, contact support@igdown.pro so the report can be investigated and eligible information deleted.

Policy changes and contact

IGDown may update this policy when processing, providers, law, or the service changes. The effective and last-updated dates identify the current version. Material changes will receive reasonably prominent notice on the website or another notice method required by law before they take effect.

Questions, grievances, and privacy requests should be sent to Baljit, operator of IGDown, at support@igdown.pro. Location: New Delhi, India.