Privacy Policy
Last updated: 2026-10-01
The short version
- No accounts. No sign-ups. Nothing to log into.
- We keep operational logs just long enough to run the service safely, then delete them.
- Downloaded files are deleted shortly after you fetch them.
- We display ads from third-party ad networks and use Google Analytics for aggregate traffic measurement. Both set cookies and collect some data about you — only after you give consent — see the sections below for exactly what and why.
- We do not sell your personal data.
Data we collect ourselves
| Data | Why | Retention |
|---|---|---|
| URL submitted | To fetch the media you asked for | Not stored after the job finishes |
| IP address | Rate limiting, abuse prevention, legal compliance | 24 hours in access logs, then deleted |
| User-Agent & timestamps | Operational debugging | 24 hours in access logs |
| Downloaded file | Delivered to you via a one-time link | Deleted 1 hour after the job completes |
| Error logs | Diagnose crashes | 7 days maximum, scrubbed of IPs and URLs |
Advertising
Nabby is free to use. To cover server, bandwidth, and development costs, the Service displays advertisements provided by third-party ad networks and ad exchanges (collectively, "Ad Partners"). These Ad Partners are independent businesses, not Nabby, and they operate under their own privacy policies.
What Ad Partners typically receive
- Your IP address (abbreviated or full, depending on the network and your region).
- Your approximate location (country or city) derived from your IP.
- Your device type, operating system, browser, screen size, and language.
- The URL of the Nabby page you are viewing (not the URLs you submit for download).
- A cookie, local-storage entry, or similar identifier used to recognize your browser across sessions and across other websites that use the same ad network.
- Interaction signals (which ads you saw, clicked, or dismissed).
What Ad Partners do not receive from us
- The URLs you paste into Nabby.
- The files you download.
- Your email address, name, or any account identifier (we don't have any).
- The content of your downloads at any stage.
Which Ad Partners
The specific Ad Partners in use at any given time will be listed below. Each links to that partner's privacy policy and opt-out instructions. If no partner is listed here, the Service is currently running without advertising.
- Ad partner list will be added once a provider is contracted.
Interest-based advertising
Ad Partners may use the data they collect from Nabby, combined with data they collect from other sites, to build a general profile of your interests and show you more relevant ads. You can usually opt out through the Ad Partner's own site, or through industry opt-out portals:
- YourAdChoices (US / DAA)
- Your Online Choices (EU / EDAA)
- NAI Opt-Out (US / NAI)
Cookies and similar technologies
Nabby itself does not set tracking cookies. Our Ad Partners do.
- Strictly necessary — a short-lived technical cookie or session identifier may be used to run the service. This is exempt from consent requirements.
- Advertising cookies — set by Ad Partners to show ads, measure performance, and prevent fraud. For users in the EU/UK/EEA, these are only set after you give consent via the cookie banner on your first visit. You can withdraw consent at any time through the "Cookie preferences" link in the footer (coming soon with the ad launch).
- Analytics cookies — set by Google Analytics (see Analytics section below). For users in the EU/UK/EEA, only set after you give consent via the cookie banner.
Analytics (Google Analytics 4)
We use Google Analytics 4 (GA4), provided by Google LLC, to understand aggregate traffic patterns — which pages are visited, how long sessions last, and what referrers bring visitors to the Service. GA4 is loaded only after you accept cookie consent. If you decline consent, no analytics script is loaded.
- Property ID:
G-1PXV1K2M5X. - Privacy configuration: IP anonymization is enabled; Google Signals (cross-device tracking) is disabled; ad-personalization signals are disabled.
- Data processed by Google: IP address (anonymized), approximate location, device type and browser, pages viewed, time on page, referrer URL, and events (button clicks, downloads).
- Retention: we use the shortest retention window supported by GA4 for user and event data.
- Google's own policies: Google Privacy Policy and Google Ads data controls.
- Opt-out: you can decline consent on the cookie banner, use the Google Analytics Opt-out Browser Add-on, or enable Do Not Track / Global Privacy Control in your browser.
Who sees what
- Source sites (TikTok, Reddit, Vimeo, etc.) see our server's IP making the fetch, not yours.
- Our hosting and CDN providers (currently Hetzner and Cloudflare) see traffic as part of operating the Service and are bound by their own data-protection commitments.
- Ad Partners see the data described in the Advertising section above.
- Google (as Analytics processor) sees the data described in the Analytics section above.
- No one else. We do not sell, barter, or rent personal data to any third party.
Legal basis (GDPR)
Where you are in the EU, UK, or EEA, we process personal data on the following legal bases:
- Legitimate interests (Art. 6(1)(f)) — for abuse prevention, rate limiting, security logs, and running the service.
- Consent (Art. 6(1)(a)) — for non-essential cookies and interest-based advertising. You give this via the cookie banner and can withdraw it at any time.
- Legal obligation (Art. 6(1)(c)) — for responding to lawful requests from authorities.
Your rights (GDPR / CCPA)
You have the right to access, correct, delete, port, or object to processing of your personal data, and to withdraw consent at any time. Because we don't collect persistent identifiers tied to you by default (no accounts, short IP retention), there is usually very little data to produce or delete. For Ad Partner data, exercise your rights directly with the partner — their policies are linked above. For data we hold, email [email protected].
Legal requests
If we receive a lawful subpoena, court order, or similar binding legal process from a competent authority, we will comply with the minimum required. Because of our short retention windows, there is usually nothing to produce.
International transfers
Our hosting is in the European Union (Hetzner, Helsinki). Cloudflare operates a global network and may route traffic through servers outside the EU under Standard Contractual Clauses. Google Analytics processes data on Google infrastructure, including servers in the United States, under Standard Contractual Clauses and Google's additional safeguards. Ad Partners frequently process data in the US or other jurisdictions under their own transfer mechanisms (SCCs or equivalent).
Children
The Service is not directed at children under 16 (or the applicable age of digital consent in your country). We do not knowingly collect data about them. If you believe a child has provided data, contact us and we will delete it.
Changes
If this policy changes materially, we will update the "Last updated" date and post a notice on the Service for at least 14 days before the change takes effect. Continued use after a change constitutes acceptance.