What Down-Fret keeps, and where.
-
The browser demo
A file you open is read in the page and never uploaded. The demo loads no font, script or tracker from any other host, and the site loads none either, except the sign-up form's bot check: once you start to fill in the email field, it loads one script from Cloudflare at challenges.cloudflare.com.
The app counts six things per day: a file opened, a practice link made, a link opened in a browser other than the one that made it, a link made with the settings only because the file was too big, a file kept in the library, and a click on a buy link. Each count sends api.downfret.app the event's name, browser or desktop, the date and the app version, and nothing else: no file, file name, link or id. The service adds one to that day's number; its code writes neither your IP address nor your browser's name to storage or to its own log lines. Cloudflare, which runs the service, can record request details such as your IP address in its own request logs. The phone app sends no counts.
The app counts five things per day: a file opened, a practice link made, a link opened in a browser other than the one that made it, a link made with the settings only because the file was too big, and a file kept in the library. Each count sends api.downfret.app the event's name, browser or desktop, the date and the app version, and nothing else: no file, file name, link or id. The service adds one to that day's number; its code writes neither your IP address nor your browser's name to storage or to its own log lines. Cloudflare, which runs the service, can record request details such as your IP address in its own request logs. The phone app sends no counts.
-
The desktop app
Licence keys are checked offline on your own machine, and that check sends nothing about you. The app asks releases.downfret.app for a newer release in the background and downloads it from there when there is one. Those requests carry a random id kept in the app's data folder, and that server sees your IP address as it would for any download. The app also sends the usage counts described under the browser demo, the same four fields.
Down-Fret is free: there are no purchases, no payment provider and no licence keys, and the app makes no licence calls. It asks releases.downfret.app for a newer release in the background and downloads it from there when there is one. Those requests carry a random id kept in the app's data folder, and that server sees your IP address as it would for any download. The app also sends the usage counts described under the browser demo, the same four fields.
-
A purchase
You buy from the Down-Fret store. A payment provider runs it as the seller and handles your payment details under its own terms. The key is emailed through Resend, which receives your address, name and licence key in order to send it. The licence service, on api.downfret.app, stores your email, name, order id, licence key, which payment processor the order came through, whether it was a test order, the date the key was issued, your subscription id and the date your year runs to, and when it was emailed, re-sent or refunded, and nothing else about you. Records are kept until you ask for them to be deleted, so a lost key can still be re-sent.
-
A sign-up
The address, the date you typed it, the date you confirmed it, and whether the sign-up email and the download email were sent, nothing else. The address is emailed through Resend, which receives it in order to send: a confirmation link now, a note that the address is saved once you open it, and the email with the downloads when Down-Fret ships. Until you open the link, the address sits in a pending record that is kept for 7 days and then deleted by the service itself. When you start to fill in the email field, a bot check by Cloudflare loads from challenges.cloudflare.com and runs in your browser, and Cloudflare sees that request. Nothing is fetched from Cloudflare if you never touch the field.
-
Deletion
Write to licence@downfret.app from the address concerned and the records are deleted. An address that was never confirmed deletes itself after 7 days. A key already issued keeps working, because it is checked on your own machine, not against this service.
Write to licence@downfret.app from the address concerned and the sign-up record is deleted. An address that was never confirmed deletes itself after 7 days. The usage counts hold no address or other detail about you, so there is nothing in them to delete.
-
Who
Down-Fret runs this site and the licence service. Questions go to licence@downfret.app.
Down-Fret runs this site and the service behind the sign-up form and the usage counts. Questions go to licence@downfret.app.
