Privacy Policy
Last updated: April 20, 2026
This Privacy Policy ("Policy") describes what data we collect, why, and how we protect it. By using Download.ru ("Service"), you agree to this Policy.
1. What Data We Collect
1.1. Data You Provide
- Account: email address, username, password (stored as a bcrypt hash; the original password is never stored).
- OAuth login: when signing in via Google, VK, Yandex, Facebook, X (Twitter), or WebMoney, we receive your identifier and public name from the provider. We never receive your password from third-party services.
- Uploaded files: file name, size, type (MIME), checksum (SHA-1, CRC32), upload date.
- Payment data: card details are processed by the payment provider. We do not store card numbers.
1.2. Data We Collect Automatically
- Technical data: IP address, browser type and version, operating system, request date and time.
- Cookies: session cookies for maintaining authentication. Login is not possible without them.
- Analytics: we use PostHog to analyze Service usage (which features are used, how often). Analytics data does not contain the contents of your files.
- Activity log: file operations (upload, download, delete, share) are recorded for the user's activity history.
1.3. Data We Do NOT Collect
- Contents of encrypted (E2E) files — they are inaccessible to the server.
- Device geolocation.
- Contacts, SMS, or call history.
2. Why We Process Data
| Data | Purpose |
|---|---|
| Email, password | Registration and authentication |
| OAuth identifier | Social login |
| Files and metadata | Storage, preview generation, antivirus scanning, access control |
| IP address, User-Agent | Security, abuse prevention, debugging |
| Analytics (PostHog) | Service improvement, understanding which features are in demand |
| Activity log | User activity history, incident investigation |
3. Client-Side Encryption (E2E)
The Service provides client-side AES-256-GCM encryption. When using this feature:
- The file is encrypted on your device before being sent to the server.
- The encryption key is derived from a password you set. This password is never transmitted to the server.
- The server stores an encrypted data block. Decrypting it without your password is impossible — neither for us, nor for any third party.
- If you lose your encryption password, file recovery is impossible.
4. Data Storage and Protection
- Files are stored in object storage (OpenStack Swift) with access controls.
- Passwords are stored as salted bcrypt hashes. Original passwords are never stored and cannot be recovered.
- All connections are protected by TLS (HTTPS). Unencrypted HTTP connections are not used.
- Access to server infrastructure is restricted and monitored.
5. Third-Party Data Sharing
We do not sell personal data.
We may share data in the following cases:
- Payment providers: for processing subscription payments (transaction data only, not file contents).
- OAuth providers: during third-party login (Google, VK, etc.) — we exchange only identifiers for authentication.
- Analytics (PostHog): aggregated usage data (without file contents or personal data).
- Legal requirements: if required by applicable law (court order, warrant).
6. Cookies
The Service uses the following types of cookies:
| Type | Purpose | Duration |
|---|---|---|
| Session | Maintaining authentication | Until logout |
| Preferences | Interface language, display settings | 1 year |
We do not use advertising cookies and do not track you on third-party websites. You may disable cookies in your browser settings, but this will prevent authentication.
7. Mobile App
The Download.ru mobile app requests the following permissions:
- Photo library — for automatic photo sync (only with your consent).
- Device storage — for uploading and downloading files.
- Network — for communicating with the server.
- Background mode — for continuing sync when the app is minimized.
The app does not collect geolocation, contacts, SMS, or call data.
8. Your Rights
You have the right to:
- Access your data — all information is available in your profile and via API.
- Correct inaccurate data — in profile settings.
- Delete your data — see Data Deletion.
- Download your files — via the web interface, WebDAV, or API.
- Withdraw consent — by deleting your account.
9. Children
The Service is not intended for persons under 16 years of age. We do not knowingly collect data from minors. If you believe a child has created an account, please contact us and we will delete it.
10. Policy Changes
We reserve the right to update this Policy. For material changes, we will notify you by email. The current version is always available on this page.
11. Contact Us
For questions regarding personal data processing: support@download.ru
