What we can see

Only two things talk to our server

Opening a page on our site requests that page and its styles, scripts and images — the same request any website makes. Your browser's normal request data (page address, browser version, IP) is what our host, Cloudflare, sees. Beyond serving the page, we ourselves send nothing back and build no profile of you (how Google’s ads and analytics collect data is in section 5). The one exception is the feedback page: when you press Send, the fields you filled in are posted to our mail endpoint and emailed to us. Nothing leaves the page until you press it. That email is used only to reply to you and fix the problem, nothing else; once it’s handled, tell us and we’ll delete it. The links shown after you send feedback are chosen from what you typed in that one request — computed once, not stored, not used to track you. The other is the extension reading its configuration: every few hours it fetches a public configuration file from vgrab.net (today it holds the block list, see section 6). The request carries no cookies, no parameters and nothing about you, the pages you open or your downloads; Cloudflare sees only the same routine information, such as your IP address and browser version. We only look at how many times a day the file is read, to estimate how many people use VGrab, not at who read it.

Cloudflare’s privacy policy

The video address never leaves your browser.

The download runs in the extension. All it pushes to this page is: parts done, bytes saved, current speed, task state, the title, where the file was saved, and the original address of the chosen stream (shown on the card so you can check it; it only reaches the clipboard when you press Copy). This page sends none of that to any server. The only third-party script on it is Google Analytics, which reports the page URL (containing just a random task id), the title and page-view events, and does not read the text on the page.

No sign-up, no account.

No login, no email, no profile.

Scripts are unobfuscated. Check for yourself.

This page's scripts ship as written, not crushed into something unreadable. Open DevTools, watch the network tab, and confirm point two yourself.

The home page, blog and similar pages carry the Google ads script and Google Analytics.

Every page on this site (including the downloads page the extension opens) counts visits with Google Analytics; pages other than the downloads and feedback pages show ads with Google AdSense. They use cookies to collect anonymous visit data (which pages you viewed, approximate region, browser type) and which ads were shown and clicked, which Google uses under its own privacy policy; the site itself collects no personal information about you. Visitors in the EU, UK and similar regions see a consent prompt first, and the choice is stored only in their own browser. The downloads page opened by the extension carries no Google ads; if another ad provider is ever placed there, it will be named here. They can’t see what you download — video addresses never enter the data this page can send. Don’t want to be counted? Google offers an opt-out tool, linked below.

How Google uses data from ads · Google privacy policy · Opt out of Google Analytics

What the extension stores on your computer

Four things, all local, never uploaded, all cleared when you uninstall: your settings (quality, save folder, parallel downloads); download history (title, size, time, save path); progress of unfinished downloads, so you can resume; and the block list read from vgrab.net (sites added at their operators’ request).

Why the extension needs access to all websites

The extension recognizes video by format, not by site, so it can’t list in advance where you’ll use it. It discovers the playing video by watching network requests — only each request’s address and type — and doesn’t record which sites you visit or upload anything. It looks at a page only when you open it and click the extension; if you don’t click, it does nothing.

Fetching a video carries your login state for that site

Some videos are only visible once you're signed in (member posts, course sites, private embeds). When VGrab fetches the playlist and the segments, the browser attaches your login state for that site by its own rules — exactly the same request your browser makes when you press play on the page — so it only ever reaches content you can already see. The extension does not read, store or modify your cookies, and there is nowhere for it to send them: the login state stays between your browser and that website. If you'd rather it didn't, open the page in an incognito window.

Not for children

This tool and this site aren’t for anyone under 13, and we never knowingly collect anything from children.

Where your data goes, in one paragraph

In the extension, it reads and never sends. It inspects network requests and the current page in your browser to work out whether there is a saveable video. Detection, downloading, merging and writing to disk all happen on your own computer. The extension itself sends no bytes to any server, and carries no analytics and no error reporting. The one exception is reading a public configuration file from vgrab.net every few hours (see section 1), and that request carries nothing about you. On the website, two things produce data. First, when you press Send on the feedback page, the text you wrote, any screenshots you attached, and the site name plus the address of the page you were on that the extension passes along (the form has a “send full address” checkbox; untick it and only the site name stays; the video address is never included) are emailed to us; until you press Send, the report is not sent to us. Second, every page of the website (including the downloads page the extension opens) loads Google Analytics, and pages other than the downloads and feedback pages also load Google AdSense; both work with cookies under Google's own privacy policy. VGrab's use of user data adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements. There is no third place.

A page opens when you install or uninstall

When you first install VGrab, your browser opens an “installed” page on our website that shows how to pin VGrab to the toolbar. When you uninstall VGrab, your browser automatically opens a page on our website asking why. The addresses of these two pages carry only the extension's version number and whether it was installed from the store or from the package on this website. It contains no pages you visited, nothing you downloaded, and no identifier that could single you out. Answering is optional: if you'd rather not, just close the page. Only if you click an option or type something yourself is that content sent to us, through the same route as the feedback page. We count how many times these two pages are opened to know how many installs and uninstalls there are, without looking at who opened them.

Your rights, and changes to this policy

We hold no data about you, so there’s nothing to show, correct or delete — except feedback emails (they contain only what you type and the screenshots you attach on purpose); tell us and we’ll delete yours. This policy gets updated from time to time; the date is at the top, and using the tool after a change means you accept it.