Privacy Policy

1. What we collect

Account: your email address and sign-in records (sessions, API keys you create — stored only as hashes).
Downloads: the links you submit, file names and sizes, status, timestamps and what each download cost.
Payments: amounts, dates, payment method and the payment provider's reference. We never see or store card numbers or PayPal logins; crypto payments are identified by the provider's invoice.
Wallet: the ledger of credits and charges on your account.
Technical data: IP address, browser type and request logs, processed by our servers and by Cloudflare to deliver the site and protect it from abuse.
Messages you send to support.

2. Why we use it

to provide the service: fetch, verify and deliver your files, and keep your download history;
to bill correctly and keep accounting records;
to send sign-in links and service emails (no marketing email without your consent);
to prevent fraud, abuse and copyright infringement, and to meet legal obligations.

3. Cookies and browser storage

We do not use advertising or analytics cookies or tracking scripts. When you sign in, your session token is kept in your browser's local storage so you stay signed in; signing out removes it. Cloudflare may set strictly necessary cookies to protect the site.

File hosts and partner download services receive the link being downloaded — from our servers, not your device, and without your email or identity.
Payment providers (crypto processor, PayPal via our payment partner) process your payments under their own privacy policies.
Infrastructure providers: Cloudflare (network and security), our hosting provider, and our email delivery provider (to send sign-in links).
Authorities when the law requires it or to report illegal content.

We do not sell or rent personal data.

5. How long we keep it

Downloaded files: deleted from our storage shortly after their 72-hour link expires.
Sign-in links expire after 15 minutes; sessions after 30 days of validity.
Download history and account data: while your account exists.
Payment and wallet records: as long as accounting and tax law requires, even after an account is deleted.
Server logs: for a limited period for security and troubleshooting.

6. Your choices and rights

You can ask us for a copy of your data, to correct it, or to delete your account. Depending on where you live (for example under the GDPR) you may also object to or restrict certain processing and complain to your local data-protection authority. Email [email protected] from your account's email address and we respond within 30 days.

7. Security

Traffic is encrypted in transit. Sign-in tokens and API keys are stored only as hashes, credentials for the premium accounts we operate are encrypted at rest, and access to production systems is restricted. No system is perfectly secure; if a breach affects your data we will tell you.

8. Children

DebridMaster is not intended for children and we do not knowingly collect their data.

9. Changes

We will update this page if our practices change; the date at the top shows the latest version.