Privacy

Last updated 2026-08-01

What VidKeep stores and what it does not. Short version: no link history; the free tier needs nothing at all, and Pro needs your email to deliver the key and give access back if you lose it.

What we do not collect

The free tier needs no account and no email at all. We place no advertising pixels, we never sell data, and we do not build a profile of you across other sites. If you never pay and decline the cookie banner, we never learn anything that identifies you.

If you buy Pro

Buying Pro asks for your email, and it exists for one reason: your licence key lives in your browser, and clearing browser data would otherwise lose the access you paid for, with no way for us to identify you or give it back. The address is where the key is sent and how you restore access later. Required since 14 August 2026: a purchase that cannot be recovered is worse than no purchase at all.

What we then store, and nothing beyond it:

• Your email address — to send the key, to remind you a week before the plan ends, and to let you sign in at your account page
• A password — only if you choose to set one, and only as a scrypt hash; we cannot read it, and you can remove it at any time
• Sign-in times — when the account was created and last used
• Sign-in links — stored as a hash, single use, expiring in 30 minutes

The legal basis is performance of the contract: it is how we deliver what you bought. There is no profiling and no marketing — we send transactional email only.

Keys bought before that date, when the field was optional, keep working exactly as before. Such a key can be linked to an address at any time from your account page — we send a confirmation link there first, so nobody can attach a key that is not theirs.

Deleting your account

One button on the account page. It erases your email address, your password hash and your sign-in links from our side.

Licences you paid for keep working — deletion removes the link to you, not the thing you bought. Save your key before deleting, because afterwards we will have no way to find it for you.

Your links

The link you paste is used to read the media and is not stored. When something fails, our error log records the type of failure together with a truncated SHA-256 hash of the link — a fingerprint that lets us count how often a failure happens without revealing what was requested. The link itself is not written down anywhere.

Your files

Most downloads go straight from the source to your device and never touch our server. When a quality requires video and audio to be merged, that is done on our server: a temporary file is created, sent to you, and deleted immediately afterwards. Nothing is archived and there is no library of past downloads.

What is stored in your browser

Three things in local storage, all removable by clearing site data:

• vk_license — your Pro licence key, so the browser stays unlocked
• vk_lang — the language you picked, so the site stops guessing
• vk_theme — light or dark preference

And one cookie, set only if you sign in to your account:

• vk_session — a signed token that keeps you signed in for 90 days; it holds your account number and nothing else

These are functional, not analytical. Nothing about them is transmitted for profiling, and the cookie is set only after you deliberately sign in — which is why there is no consent banner for it.

Analytics, only with your consent

The first time you visit, a banner asks whether we may use two analytics services — Yandex Metrika and Google Analytics — to see aggregate numbers such as which pages get read and roughly how many people visit each day. Nothing loads before you answer: no request to either service leaves your browser until you click Accept.

Declining changes nothing about how the tool works — every download feature stays identical. If you click Decline, or simply close the banner, no analytics runs and no cookie from either service is set. You can change your mind at any time from the small cookie icon in the corner of the screen, which reopens the same choice.

Accepting sets a Yandex Metrika cookie and a Google Analytics cookie in your browser. Both see your IP address, browser and device details, and the pages you view — standard web-analytics data, not your license key or email. Yandex processes this in Russia, outside the scope of an EU adequacy decision; Google processes it in the US under its own standard contractual clauses. Neither service is configured for advertising or remarketing on this site.

The legal basis is your consent (GDPR Art. 6(1)(a)); withdrawing it is exactly as easy as giving it.

Payments

Pro is paid in USDT through USDPAY, our payment processor. They handle the crypto checkout and tell us only that a given order was paid. We never receive your wallet keys. A licence key is anonymous: it identifies a paid plan, not a person.

Infrastructure

The site is served through Cloudflare, which processes connection data such as IP addresses in order to route and protect traffic, under their own privacy terms.

Who else touches the data

Each party is here for one job:

• Cloudflare — routes and protects traffic; sees connection data such as IP addresses
• USDPAY — runs the crypto checkout; tells us only that an order was paid
• the hosting provider — the server runs in Kazakhstan, where merged files exist for seconds
• Yandex Metrika, Google Analytics — aggregate usage statistics, only if you accepted the cookie banner; see “Analytics, only with your consent” above

Kazakhstan is not covered by an EU adequacy decision, so transfers there rely on the standard contractual clauses. In practice what reaches the server is a link and, briefly, a media file — not an identity.

How long anything is kept

• Media files: deleted immediately after they are sent — seconds
• Error log (failure type + truncated hash): rotated, kept no longer than needed to fix the fault
• Licence records: the key, its plan and its expiry — kept while the licence is valid, since that is what proves you paid
• Email address, if you left one: kept while the licence is valid and for 12 months after it ends, so a returning customer still finds their history; then erased
• Sign-in links: 30 minutes, then dead whether used or not
• Links you paste: never written down

You do not have to wait for any of these: deleting your account erases your email and password immediately.

Your rights

If the GDPR applies to you, you have the rights of access, rectification, erasure, restriction, portability and objection, and the right to complain to your national supervisory authority.

Because we hold no account and no personal profile, there is usually nothing to export or erase — a licence key identifies a paid plan, not a person. If you believe we hold data about you, write to [email protected] and we will answer.