Privacy Policy
This page describes what the public site actually stores. It matches the current product, not a planned one.
What a check stores
When a code is checked, DownloaderChecker stores the code, the public result of the HTTP check, redirect hops that are safe to keep, and the time of the check. That history is what the code page and the admin console read. Private network addresses are not shown on the public page.
Analytics
DownloaderChecker keeps first-party counts in its own database: homepage views, checks started, completed, and failed, result views, copies, external clicks, forced rescans, and report events. These are daily totals. They do not include destination URLs, and they are not sent to a third-party analytics vendor.
IP addresses
Raw visitor IP addresses are not stored as a permanent profile. Rate-limit counters live in Redis and expire with their window. A code report stores a hash of the submitter IP so abuse can be limited; that hash is cleared after 90 days. The report text itself can remain for review. Administrator audit logs store the IP address of the signed-in admin who performed an action. Operational logs may include request metadata for a short time and are not a visitor archive.
Reports and contact messages
A report stores the code, the reason, an optional description, and an optional email address. A contact message stores the name, email address, and message you submit. Do not include secrets or unnecessary personal details in a message.
Accounts, saves, and alerts
An optional account stores your email, a password hash, role, timezone, and whether email is verified. Saves and watchlists store the apps and codes you choose. Alert preferences and in-app notifications are stored so you can read them later. Email alerts are sent through the configured delivery provider. When no email API key is set, messages are written to the local log instead of an outside provider. You can unsubscribe from one watch, one category, or all email. Account deletion removes personal data. Security and audit history can remain without your account attached.
Developer verification
A developer may request access, invite organization members, and submit a claim that they control a website. Domain checks store a hash of a random token, the method, and the result. Membership roles and claim decisions are kept. A false claim, impersonation, or abuse can lead to suspension or revocation. A verified badge means control of the linked domain was checked. It is not a safety guarantee.
Cookies
The public checker does not require an account. Report and contact forms use a first-party cookie so the form can be matched to the browser that loaded it. Signed-in accounts and the admin console share one HTTP-only session cookie. There are no advertising cookies.
APK analysis
When a destination looks like an APK, DownloaderChecker may download it on the server, calculate SHA-256, SHA-1, and MD5, read the package metadata, and delete the temporary file. The APK is not stored for download and is not sent to the visitor's browser.
External security lookups
By default, no file hash is sent to an outside security service. If a security provider such as VirusTotal is explicitly enabled on the server, DownloaderChecker sends the SHA-256 of an APK to that provider and stores the summary it returns. The APK file itself is not uploaded. That lookup does not happen in your browser. A result from a provider is a report of what that provider returned. It is not a guarantee that a file is safe.
API, billing, and sponsorship
An optional API key is stored as a hash. Usage counts are kept for the billing period. Paid plans and sponsored placements do not change scanner status, hashes, certificates, warnings, availability, votes, or history. Billing status is updated from signed provider webhooks. When no billing API key is set, a local mock provider is used. Marketing email is off unless you opt in. You can revoke an API key. Account deletion removes personal data and does not publish other people's information.
What this site does not do
DownloaderChecker does not sell visitor data and does not send scanner results or destination URLs to an external analytics service. Checking a code does not install software on your TV or phone.