Privacy policy

Who is responsible

The controller is ISaveServices, which runs isaveall.com. For any question about your data, or to exercise your rights, use the contact form.

What we process when you paste a link

To find the file, our server receives the link you paste along with technical data from your request: your IP address, your browser (user agent) and the time. Our server then uses that link to query the source platform.

There are no user accounts, and the downloader doesn't ask you for any personal data.

What we don't keep

We don't store the files you download. When a file has to be converted (MP3, GIF, ZIP, a photo slideshow or a video joined from a stream), it is processed in the server's temporary memory while it transfers and deleted when it finishes or when you stop the download. We don't write the full link you paste to our logs, and our databases never hold your IP in plain text.

How long we keep each item

Abuse counters. To limit how many requests each visitor makes, we keep a salted hash of your IP (for IPv6, of its /64 block), never the IP itself, with the time of each request. The per-minute counter deletes itself 60 seconds after your last request, and the daily one 24 hours after your last request. If you pass a reCAPTCHA check, we note it under the same hash for 30 minutes. Concurrent-download slots disappear a few minutes after the download ends, and the use count of each download link after 15 minutes.

Result cache. The result for each link (the file addresses on the platform, the title and the author) is kept for 10 minutes so the lookup isn't repeated when someone pastes the same link. It is stored under a hash of the link and holds neither your IP nor anything about you. Photo lists for a carousel or slideshow are kept for up to 27 minutes, until the last download link that can use them has expired.

Download links. When a download goes through our server, the button carries a signed, encrypted link that expires after 15 minutes.

Usage statistics. Per day and per platform we count attempts, successes, errors, the engine used, total time and data transferred. These are counts only, with no IP and no link, and they are deleted after 60 days. We also count contact messages per day and type, with no IP, for 48 hours.

Application logs. Our services log each lookup with the platform, the result and how long it took; the converter logs only the platform's domain. These logs hold neither your IP nor the link. They rotate by size (about 30 MB per service), so they are overwritten after days or weeks depending on traffic.

Web server logs. The access log records your IP address truncated (the last number of an IPv4 address set to zero; for IPv6 only the /64 block, the first half of the address), the date, the page requested without parameters, the response code, size and response time, and your browser (user agent). If a request is slowed down or refused for coming in too fast, it appears in the access log like any other, with your IP truncated, and stays out of the error log. Only server errors (for example, the service is down or slow, the connection drops or an upload is too large) record your full IP with the request in the error log. Everything is deleted after 15 days at most.

Contact form

If you write to us, we keep the message type (general, copyright or abuse), your email, the link if you add one, your message, the date and time, and a hash of your IP with a salt that changes every day, so two messages sent on different days don't carry the same value. We use this only to reply and to handle claims. It is saved in a file on our server, it is not forwarded by email or to anyone else, and each message is deleted after 365 days.

Third parties

Source platforms. Files come from the servers of TikTok, X and the other platforms. When the download is direct, your browser connects to those servers and the platform sees your IP, just as it does when an image preview loads. When the download goes through our server (to force it on mobile or to convert it), our server receives it from the platform and passes it on to you without keeping it.

Cloudflare. All traffic to isaveall.com goes through Cloudflare, which provides our network and protection against attacks. Cloudflare sees your IP, your browser and the requests you make, including the link you paste, and keeps cached copies of our pages. Downloader responses and downloads are sent with an instruction not to be cached. Cloudflare handles this data under its own privacy policy.

Google reCAPTCHA. We ask for a Google reCAPTCHA v3 check only if you run many lookups in a row (more than 6 a minute). Its script loads only then: Google receives your IP and data about your browser, and our server sends Google your IP to verify the result. Google handles this data under its own policy.

Google Analytics 4. We use Google Analytics 4 to count visits and see which pages are used. It loads on every page once the page has finished loading, without asking for your consent first, and sets the _ga and _ga_<ID> cookies. Google receives each page you visit and technical data about your browser and device; we don't send it the link you paste. Advertising features are switched off. According to Google, Analytics 4 does not store IP addresses. You can block it as the cookie policy explains; the site works the same without it. We don't sell data.

Data outside the EU

Cloudflare and Google are US companies, so the data they receive may be processed outside the European Union.

Cookies and local storage

Our application sets no cookies of its own. The Google Analytics cookies are stored on our domain and, if you're asked for a check, Google may set reCAPTCHA cookies. Your theme choice (light or dark) is kept in your browser's local storage and never leaves your device. The cookie policy has the details.

Your rights

You can ask to access, correct or delete your data, or object to its use, through the contact form. Most of what we keep doesn't identify you directly and deletes itself within minutes or days; what we can easily find are your contact form messages. You can also lodge a complaint with the data protection authority in your country.

Children

isaveall has no accounts and doesn't ask for your age. If a minor has written to us through the form and you want the message deleted, ask us through the same form.

Changes to this policy

If what the service does changes, we will update this page and its review date. Last reviewed: November 10, 2026.