Privacy Policy

What this policy covers

This policy covers https://twitdownloader.dev and the download API it uses at cdn.twitdownloader.dev, both run by Twitter Downloader as an independent project. Privacy questions can go to hello@twitdownloader.dev and you will get a personal reply.

When you look up a post

Your browser trims the pasted link down to the post's ID number and passes that to our API at cdn.twitdownloader.dev, which then requests the post from X. X receives that request from our server rather than from your device, and nothing about you is included in it.

What comes back is the post's text, its author and the list of media files attached to it, which your browser then displays on the page. No record of the posts you looked up is kept by us.

When you download a file

Behind every Download button is a link to our API. The API collects the file from X's media servers and streams it straight through to you as a download, without writing it to disk or keeping it, so X sees our server asking for the file rather than you. Each link holds the file's location on X's servers plus a file name, and it can only ever fetch from X's own media servers.

When you save a broadcast

Replays of broadcasts do not exist on X as one file you can download. Instead, the API hands your browser a signed list of the replay's pieces at the quality you picked, and relays each piece from X's broadcast servers whenever your browser requests it. Pieces outside your time range are never fetched, and the API holds on to none of them.

Joining the pieces into an MP4 happens in your browser, on your own device. Desktop Chrome and Edge save the result directly into a file you choose. Other browsers first assemble it in this site's private browser storage, pass it to your Downloads, and remove their copy roughly ten minutes afterwards; if a closed tab left a copy behind, it is cleared the next time you visit. We never receive the MP4 itself.

What loads directly from X

A few parts of the results card are loaded from X directly, not through our server, much as an embedded post would be on any other website:

• The post's thumbnail, plus one for each video or photo when the post holds more than one.
• The preview picture for a broadcast, served by X from its broadcast servers (pscp.tv).
• The View on X link, if you choose to open it.

Your browser sends these requests to X's servers (pbs.twimg.com, video.twimg.com, pscp.tv and x.com), and those servers can see your IP address, as every site you visit can. We tell browsers to share no more than our domain name with them, so the full page address holding your post link is never passed on. What X does with these requests is covered by X's own privacy policy.

Request logs at Cloudflare

Cloudflare, which hosts the site and the API, keeps brief logs of requests that help us notice errors and abuse. An entry records when a request arrived, which address was asked for (for a lookup or download this includes the post or file address), whether it succeeded, and the technical details Cloudflare adds to every request, for example browser type and rough location. The logs serve only to keep the service running; we never use them to build up a picture of what anyone downloads, and Cloudflare removes them automatically after a short period.

What we never ask for or record

• Your name, email or password, as there is no sign-up.
• Access to your X account. You are never asked to log in to X, and we never log in for you.
• Any list of the posts you check or the files you save.
• Page-view counts, heatmaps or similar analytics.
• Ad IDs, retargeting scripts or tracking pixels from social networks.

What this site saves in your browser

There are no cookies. Your browser's localStorage holds a single entry, xdl-appearance, written once you press the theme button so that your choice of light or dark mode sticks. Only this site's pages can read it, and it never leaves your browser. Finding a post does not put it into the page address, which means your browser history lists only the downloader's own pages. When you open a link that already carries a post (as ?url=…), the page reads that part and then strips it from the address bar straight away.

In browsers that have no save dialog, the MP4 being assembled during a broadcast save is held in this site's private browser storage, inside a folder called xdl-replays. Nothing goes in there except files you requested, and they are removed on the schedule set out earlier.

Cloudflare as our host

Both the website and the server behind it are hosted by Cloudflare. It handles requests for us, under its own data processing terms, in order to serve pages, operate the downloader, stop attacks and keep everything stable.

Some guides point to other sites, for example the X Help Center or Apple Support. After you click through, their privacy practices apply rather than ours.

UK, EU and EEA data rights

We handle request data because it is needed to give you the pages and files you request, and because running a safe, dependable service is a legitimate interest of ours. Your saved theme exists only because you picked one, and it stays in your browser without ever reaching us.

Under data protection law you can ask for a copy of any personal data we have about you, have it fixed or erased, object to how it is used, and complain to the regulator in your country. Because there are no accounts or name-linked records, we seldom have anything to hand over, though if you email us we will check.

Children under 13

This downloader is built for a general audience, and children under 13 are not its intended users. Whatever a visitor's age, we collect nothing personal from them apart from the request data covered earlier on this page.

How changes are announced

Any significant edit to this policy gets a new date at the top and a short note on this page explaining what changed. If analytics, adverts or other data collection were ever planned, we would announce them here before turning them on.