Privacy Policy — Kepsy
This policy covers the Kepsy browser extension for Google Chrome, Microsoft Edge and Mozilla Firefox. The extension and this policy are the same on all three browsers and all three stores.
At a glance
- If you never sign in, the extension sends us nothing.
- If you sign in, our sign-in provider Clerk handles the sign-in, and we keep your email address and your plan. If you buy Pro, we also keep the order. Nothing else.
- Clerk stores your sign-in data in the United States. A sign-in lasts 7 days, then you sign in again.
- We never receive your card number or your bank login. Card payments go to Lemon Squeezy, and bank transfers go through your own bank.
- We never learn which pages you visit or which videos you save.
- Downloads go straight from the site you are on to your device, never through our server.
- There are no analytics, no ads and no tracking.
1. What the extension does
Kepsy finds the media that the page you are viewing already plays or fetches. It lists that media in the extension popup and saves it to your device when you click download. All of this runs in your browser: the extension reads the page's own network activity, downloads the bytes, and writes the file to your Downloads folder through the browser's download API.
2. What we collect
Only what an account needs:
| Data | Why | Where it goes |
|---|---|---|
| Your email address | To sign you in with a six-digit code sent by email, or with Google. There is no password. | Clerk, our sign-in provider, and our own account server |
| Your sign-in session (a session token and the cookies Clerk sets for it) | To keep you signed in for 7 days and to prove to our server which account is asking. | Clerk, and your own browser. Our server only checks the token and does not store it. |
| Your plan (free or pro, its status, an optional expiry date) | To lift the free daily limit for accounts that have a paid plan. The plan belongs to the account, so it follows you to every browser where you sign in. | Our own account server |
| Your IP address | Only to rate-limit the first request that links a sign-in to an account, so one sender cannot flood it. It is kept as a request counter, never beside your email address. | Our own account server |
| Your orders (pass, amount, currency, payment method, order number, and the times it was created and paid) | To turn on Pro after you pay, to renew it, and to keep the accounting records that the law requires. | Our own account server |
| Card or bank details | None. We never receive your card number or bank login. The payment provider takes your card details, and your bank handles the transfer. | Nowhere on our side |
An account is only needed for the paid plan. You buy it in the extension popup: you pick a pass (30 or 365 days) and a way to pay. You pay once and the plan does not renew by itself. If you never sign in, the extension sends us nothing at all.
Signing in is the same for a free account and a paid one, and Clerk runs it. You type your email address and the six-digit code that Clerk sends you in the extension popup, or you choose Google. Google sign-in opens the Kepsy sign-in page on our website, where Clerk sets its cookies, and the extension reads that session. Our server never sees your code. It receives only the session token, which lets it ask which plan the account has.
3. What we never send to our servers
- we never send video, media or page URLs. The extension reads them in your browser and downloads the bytes from the site you are on. Our server never learns which site you visited or which video you saved.
- We never send filenames, file contents or anything you downloaded.
- We never send your browsing history, the pages you open or the tabs you have.
- We never send the titles, durations or sizes of detected media.
The extension makes only these requests to our server: read your plan, list the passes on sale, start a checkout (the pass and the payment method you picked), read the status of your order (the order number), and delete your account when you ask. The plan request has no request body and no account field. Our server identifies you only from your session token, which it verifies before it answers. Sign-in itself goes to Clerk, not to our server.
This is a statement about the extension that we publish, not a guarantee about every possible client. The published extension has no field in these requests that could carry a media URL. A modified copy of the extension could send anything to any server. It still could not make our server reveal anything about your downloads, because our server never receives that information.
4. What the extension stores on your device
| Stored where | What | Sent to us? |
|---|---|---|
| Extension local storage | Your Clerk sign-in session, the cached plan (read again every 10 minutes), and the free daily download counter | The session token is sent each time the extension talks to our server, because it proves which account is asking. The cached plan and the counter are never sent. |
| Extension session storage | The media detected in each tab, the download records for each tab, the batch queue, and the payment details of an order you have not finished paying (the QR code, the transfer note and the order number) | No. This storage is cleared when the browser session ends. |
The free daily counter lives only on your device and is not tied to an account. You can reset it when you clear the extension's data. We accept that limit so that we do not have to count your downloads on a server.
5. Permissions and why each one is needed
The extension asks for the smallest set of permissions that lets it save a video. Each permission is used by code that ships inside the extension. The extension runs no remote code.
| Permission | Why the extension needs it |
|---|---|
webRequest | To see which media the page you are viewing loads. The extension reads request URLs and response headers only. It never blocks or changes a request. Without it, most players never reveal their media URLs. |
downloads | To save the finished file into your Downloads folder through the browser's download manager, and to know when a save is complete so the temporary file can be removed. |
storage | To keep your sign-in session, the cached plan, the free daily counter, the media list for each tab, download records and the batch queue on your device. |
cookies | To read the cookie that Clerk sets on the Kepsy sign-in page of our website. When you sign in with Google on that page, this cookie is how the extension learns that you signed in. The extension reads only that site's Clerk cookie, and never the cookies of any other site. |
unlimitedStorage | To hold a video while the extension assembles it. A stream arrives as many small pieces that are joined into one file before the browser saves it, and a long high-quality video can be several gigabytes. Nothing is kept after the file is saved, and pieces left by an interrupted download are removed after one hour. |
offscreen (Chrome, Edge only) | A service worker has no page, so it cannot download and join media by itself. A hidden extension page does that work. Firefox has no such API, so on Firefox the same code runs in the extension's background page. |
declarativeNetRequestWithHostAccess (Chrome, Edge only) | To set the Referer and Origin headers for one transfer at a time. Many media servers refuse a request without them and answer with an error 403. The rule covers only the media host, applies only while the transfer runs, and is removed when it ends. Firefox has no equivalent, so a host that requires these headers cannot be downloaded on Firefox, and the popup shows the network reason. |
<all_urls> host access | Media can be on any site, and the extension cannot know in advance which one you will use. It needs this access to read the current page's network activity and to fetch the media it lists. This access grants nothing about your accounts, your files or other extensions. |
The extension also runs two small scripts in the page you are viewing. They find media that never appears in the network activity. Both scripts ship inside the extension, and neither runs on the blocked hosts described in section 6. The extension does not read, store or send the content of your pages.
6. What the extension does not do
- It does not bypass DRM. Protected content shows the label
DRM protected content — not supported, and its download button is disabled. The extension cannot and will not decrypt protected media. - It does not work on platforms whose terms forbid downloads. A fixed list of blocked hosts means that nothing is detected or downloaded there, in any browser.
- It does not use analytics, telemetry, advertising or tracking. There is no third-party analytics SDK, no ad network and no usage reporting.
- It does not sell or share your data with anyone except the providers in section 7, and only for the purposes described there.
- It does not download through a server we control. The bytes travel directly from the site you are on to your device.
You are responsible for using the extension lawfully. Only download what you have the right to download, and respect the terms and copyright of the sites you visit.
7. Service providers
| Provider | Role | Data it receives |
|---|---|---|
| Our own account server | Stores accounts and plans, and is the only server of ours that the extension talks to. | Your email address, your plan, and a counter keyed by IP address for rate limiting. It checks your session token but does not store it. |
| Clerk | Runs sign-in: it sends the six-digit code by email, keeps the sign-in session (7 days) and tells our server when an account is deleted. Clerk stores this data in the United States. | Your email address, the sign-in code, your session, your IP address and browser details, under its own privacy policy |
| Signs you in only when you choose "Sign in with Google". | What Google shares with Clerk for the sign-in, which is your email address and name, under Google's own privacy policy | |
| SePay | Reads the bank transfers made into our bank account, so that a transfer with the right note turns on Pro by itself. | The amount, the transfer note and the sender name that your bank provides |
| vietqr.app | Draws the QR image for a bank transfer. | Our account number, the amount and the order code. It receives no email address. |
| Lemon Squeezy | Merchant of record for card and PayPal payments. It sells the plan to you and takes the payment. | Your email address, your payment details and your country, under its own privacy policy. Your card number goes only to Lemon Squeezy and never reaches our server. |
Clerk, Google, SePay, vietqr.app and Lemon Squeezy each handle your data under their own privacy policies. Bank transfer details come from your bank, not from the extension. We do not transfer your data to anyone else, and we do not sell it.
8. Retention and deletion
- Your email address and your plan are kept while your account exists.
- A sign-in session lasts 7 days. It stays on your device until it ends, you sign out, or you clear the extension's data. Clerk keeps your account and sessions until the account is deleted.
- The IP rate-limit counter is deleted one hour after its fifteen-minute window closes.
- The free daily counter and the media list for each tab exist only on your device. The media list is cleared when the browser session ends.
- Order records are kept for 10 years, because the Vietnamese Accounting Law requires it.
- To delete your account, open the extension popup, go to the Account screen and choose "Delete account". We delete the account at Clerk and on our server, with its sessions and its plan. You can also write to {{OWNER_CONTACT_EMAIL}} from the address you signed up with. Your orders stay for the 10 years, but they are no longer linked to your email address. We keep only the pass, the amount, the payment method and the dates.
9. Children
The extension is not directed at children, and we do not knowingly collect data from them. Free use requires no account at all.
10. Changes to this policy
If this policy changes, the effective date above changes too, and the new version is published at the same address. The extension's release notes also describe material changes.
11. Contact
Questions, requests and complaints: {{OWNER_CONTACT_EMAIL}}.
This policy describes what the published extension does. An automated test compares the permission table above with the permissions that each browser build declares, so the policy and the code cannot drift apart unnoticed.