Privacy Policy

Introduction

This Privacy Policy explains how DownSub ("DownSub", "we", "us", "our") collects, uses, shares and protects personal information when you use app.downsub.com, the DownSub API and the DownSub browser extension (together, the "Service").

The public subtitle website at downsub.com is covered by its own Privacy Policy, available at downsub.com/privacy.

If you have any questions, email us at contact@downsub.com.

Information we collect

We collect the following information:

• Account information: your email address and display name. If you sign up with an email and password, your password is handled by our authentication provider and stored only as a salted hash. If you sign in with Google, we receive your Google account identifier, email address, name and profile picture.
• Billing information: payments are processed by Stripe. We receive your plan, subscription status, trial and renewal dates, invoices, billing country, and the card brand, last four digits and a card fingerprint (a token that identifies a card without revealing its number). We never receive or store full card numbers.
• Content you submit: video links, audio and video files you upload, subtitle text you ask us to translate or summarize, and your choices such as target language and output format.
• Results we generate: transcripts, subtitles, translations, summaries and rendered videos created for you.
• Usage and credit information: which features you use, credits charged, target language, video title and ID, number of subtitle lines, and timestamps.
• API and extension requests: the endpoint called, request parameters (such as a video link), response status, credit usage and your IP address.
• Technical information: your IP address, browser type, device and operating system, pages visited and referring page. We also use a bot-protection check to confirm that sign-ins and contact form messages come from real people.
• Error diagnostics: when something goes wrong, we collect error reports. For a small sample of sessions, and for sessions in which an error occurs, we record a session replay showing how the page behaved. All text is masked and all images and media are blocked in these replays.
• Messages you send us: your email address and the content of your message.

How we use your information

We use personal information for the following purposes:

• To provide the Service: creating your account, processing the videos, files and subtitles you submit, delivering results, and managing credits and subscriptions. This is necessary to perform our contract with you.
• To process payments and keep billing records, as required by our contract with you and by tax and accounting laws.
• To keep the Service secure and to prevent fraud and abuse, including repeated use of free trials with the same card. This is based on our legitimate interests.
• To diagnose errors and improve reliability, based on our legitimate interests.
• To understand how the Service is used through analytics, based on our legitimate interests or, where the law requires it, your consent.
• To send transactional emails, such as receipts, account deletion confirmations and important Service notices, and to answer your messages.
• To send product emails about your account: a welcome message, tips while you get started, credit balance alerts, subscription changes and, now and then, news and offers. You can turn these off at any time in Preferences or with the unsubscribe link in every such email. Receipts, account deletion confirmations and security notices are always sent.

We do not sell your personal information, and we do not use your content to train our own AI models.

AI features

AI summaries, AI translation, comment analysis and AI subtitle generation are performed by third-party AI model and speech recognition providers. We send them only the content needed to produce the result you request, such as transcript or subtitle text, a video link, or audio to transcribe. We never send them your account details.

• Language models: we use paid commercial API plans. Under these terms, the provider does not use your content to train or improve its models. It may keep requests for a limited period, solely to detect abuse and misuse.
• Speech recognition: our primary speech recognition model runs on infrastructure that does not keep audio or results after processing and does not use them for training.
• Speaker identification and fallback transcription: when you request speaker labels, or when our primary model detects no speech, the audio is processed by a separate speech recognition provider under its own terms, which may allow it to use submitted audio to improve its services.

AI-generated results can contain errors. Please review them before relying on them.

Subtitle translation

Free subtitle translation in the browser extension uses Chrome's built-in on-device translator when it supports the language pair, so the text does not leave your device.

Otherwise, the subtitle text is sent to app.downsub.com and translated by a third-party machine translation service. It is sent without your account details, and our servers do not store it.

What we store and what we don't

Some features process your content without storing it. Others keep results for a short time so you can download them.

• Not stored: subtitle text sent for free translation, and subtitle text and translations processed by AI translation in the browser extension or the API. They are processed in memory and returned to you.
• Stored for a short time: output files from background tasks on app.downsub.com, such as transcripts, AI translations and rendered videos, are kept for 7 days so you can download them. Your task list, including AI summaries, is kept for 30 days.
• Logs: our logs are designed to record request details, such as the video link or title, language, credits, status and, for API requests, your IP address. They are not designed to record the text of subtitles, transcripts or translations.
• Cache: to make repeated requests faster, publicly available subtitles retrieved from video platforms are cached by video for up to 3 days, and public video details for up to 4 hours. The cache is not linked to you and never contains your uploaded files or AI results.

DownSub browser extension

Scope: the DownSub browser extension is published by us through the Chrome Web Store and is governed by this Privacy Policy. It runs only on the video sites it supports (YouTube, Viki, iQIYI (iq.com), Netflix, WeTV, Bilibili and Bstation (bilibili.tv)), on the servers those sites use to deliver subtitle files, and on downsub.com and its subdomains. It cannot read or send content from any other website.

Permissions: storage saves your API key, profile, download history and preferences locally in chrome.storage.local, and the interface language for the current browser session in chrome.storage.session. downloads saves the SRT, VTT or TXT files you choose to download. scripting reads the video player's own data on the tab you are viewing to list the available subtitle tracks. activeTab identifies which supported video you are viewing when you open the extension. webRequest (observe-only) passively reads the subtitle URL requested by the YouTube and iQIYI players; nothing is blocked or modified. identity performs the sign-in handshake with app.downsub.com through chrome.identity.launchWebAuthFlow.

Netflix and WeTV: on these sites, a small script reads the list of subtitle tracks from the data the player loads during normal playback. The extension never accesses the protected video stream; it only downloads plain-text subtitle files.

Stored locally: the extension stores only your DownSub API key, a profile snapshot (email, plan and credit balance), recent download history and your settings in chrome.storage.local. Signing out removes your API key and profile snapshot. Uninstalling the extension deletes all of its local data.

Sent to our servers: subtitle files are fetched directly from the video site and saved on your device; they do not pass through our servers. Free translation works as described in the Subtitle translation section. Pro features (AI summary, AI translation, comment analysis and AI subtitle generation) send the relevant content with your API key to app.downsub.com only when you use them.

Not collected: the extension contains no analytics, tracking pixels or third-party SDKs. It does not collect your browsing history, bookmarks or keystrokes, does not run on websites other than those listed above, and does not load or run remote code.

Cookies and analytics

We use essential cookies to keep you signed in, and your browser's local storage to remember preferences such as language and theme.

We use Google Analytics 4, loaded through Google Tag Manager, to understand how the Service is used. It collects pages visited, interactions with upgrade offers (such as the feature and plan shown), device and browser information, and approximate location derived from your IP address, using first-party cookies named _ga and _ga_ followed by an ID. It also records which tools you use and what you download with them, such as the file format, language, video platform and whether the task succeeded, but never the video link, title or file name.

We do not send your email address, name or account ID to Google Analytics. Analytics event data is kept for no longer than 14 months, the maximum Google Analytics allows.

app.downsub.com does not show ads and does not use advertising cookies.

You can block or delete cookies in your browser settings, or install the Google Analytics Opt-out Browser Add-on. Blocking essential cookies will sign you out.

Service providers

We share personal information only with providers that help us run the Service, and only what each of them needs:

• Hosting, content delivery, storage and processing providers: run the Service and protect it from abuse.
• Authentication and database provider: user accounts and account data.
• Payment processor (Stripe): payments and subscription billing.
• Email delivery provider: transactional, product and marketing emails, and delivery and engagement reports (delivered, bounced, marked as spam, opened, link clicked). For this, our emails contain a tiny tracking image and links that pass through a tracking address; we record only whether and when an email was opened or a link in it was clicked.
• Error monitoring provider: error reports and session replays, as described above.
• Google: Google Analytics, Google Tag Manager and, if you choose it, Google sign-in.
• AI model and speech recognition providers: the content you submit to AI features, as described in the AI features section.
• Machine translation service: subtitle text for free translation, without your account details.
• Media retrieval providers: the link or ID of a public video, so that we can fetch its audio or subtitles. They do not receive your account details.
• Video platforms such as YouTube: our servers request public video information and subtitles from the platform that hosts the video.

Each provider processes data under its own privacy and security commitments. We do not sell or rent personal information. We may disclose information if required by law, or to protect the rights, safety and security of DownSub, our users or others.

Data retention

We keep personal information only as long as needed for the purposes described in this policy. The maximum retention periods are:

• Account information: until you delete your account.
• Uploaded audio and video files: deleted automatically when processing finishes, fails or is cancelled. Any remaining copy is deleted automatically within 7 days.
• Generated files (transcripts, translations and rendered videos): 7 days.
• Task list entries, including AI summaries: 30 days after the task finishes, and never more than 60 days.
• Usage and credit history: 12 months.
• API request logs, including IP addresses and request parameters: 3 months.
• Free AI preview counters (your account ID and a keyed hash of your IP address, used to limit free previews): 2 days.
• Server and infrastructure logs: up to 30 days.
• Error reports and session replays: up to 90 days.
• Public subtitle cache: up to 3 days. Public video details cache: up to 4 hours.
• Database backups: created daily and kept for no more than 30 days.
• Billing records (invoices and transactions): as long as tax and accounting laws require.
• Card fingerprint, card brand and last four digits: 3 years from the last time the card was used at checkout, including after account deletion, to prevent repeated use of free trials with the same card.
• Support emails: as long as needed to handle your request and keep a record of our correspondence.
• Analytics data: no longer than 14 months.
• Email send log (recipient address, subject, template and delivery status): 12 months, and no more than 3 months after you delete your account.
• Email suppression list (addresses that bounced, reported our email as spam or asked not to be emailed): kept indefinitely, including after account deletion, so that we never email them again.

Deleting your account

You can delete your account at any time in Settings. We email you a confirmation link, valid for 1 hour, to confirm the request.

• Immediately: we cancel any active subscription and delete your login, profile, API key, credit balance, preferences, subscription records, task list and usage history.
• Within 3 months: remaining copies expire automatically on the schedule above. Generated files are deleted within 7 days, server logs and backups within 30 days, and API request logs and error reports within 3 months.
• Service providers: our providers delete or expire data on their own schedules, such as AI providers' short abuse-monitoring logs. Stripe keeps payment records as the law requires.
• Kept: billing records that the law requires us to keep, and the card fingerprint described above.
• Email: the send log is deleted within 3 months. If your address is on the suppression list, it stays there so that we never email it again.

If you can no longer access your account, email us and we will verify your identity and delete it for you.

Security

We protect your information with industry-standard measures:

• All connections to the Service use HTTPS.
• Passwords are handled by our authentication provider and stored only as salted one-way hashes. We never see or store your password in plain text. If you sign in with Google, we hold no password at all.
• Card payments are handled entirely by Stripe.
• Access to our databases and logs is restricted to the people who operate DownSub, and access controls limit each account to its own data.
• Your API key is sent only in an HTTPS request header. Generating a new key in Settings revokes the old one immediately. Treat your API key like a password.
• The browser extension keeps your API key in its own local storage, which websites and other extensions cannot read and which is not synced across devices. Signing out or uninstalling the extension removes it.

No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

International data transfers

Our account database is hosted in Singapore. Requests are processed on a global content delivery network, usually in a data center near you.

Our other providers, including payment, email, error monitoring, analytics, AI and hosting providers, process data mainly in the United States.

When we transfer personal information from the European Economic Area, the United Kingdom or Switzerland to countries without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses, with the UK Addendum where relevant, included in our providers' data processing terms, and on the EU-US Data Privacy Framework for providers certified under it.

Your rights

Depending on where you live, including the European Economic Area, the United Kingdom and some US states, you may have the right to:

• access the personal information we hold about you;
• correct inaccurate information;
• delete your information (you can delete your account yourself in Settings);
• receive a copy of your information in a portable format;
• object to or restrict certain processing;
• withdraw your consent, where processing is based on consent;
• lodge a complaint with your local data protection authority.

To make a request, email contact@downsub.com from the email address linked to your account. We respond within 30 days.

Children's privacy

The Service is not directed to children under 13, or under the minimum age required in your country (such as 16 in parts of the European Economic Area). We do not knowingly collect personal information from children. If you believe a child has given us personal information, contact us and we will delete it.

Changes to this policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page shows when it last changed, and we will tell you about material changes by email or in the Service. This policy may be available in several languages; if versions differ, the English version prevails.

Contact us

If you have questions about this Privacy Policy or your personal information, email us at contact@downsub.com or use our Contact page.