Privacy policy

The Zajil program

What it connects to:

• The sites of the files you download, as any browser does: the server sees your computer's IP address and the request for the file. With a download that comes from the extension, its site's cookies go to its site alone (see the extension).
• GitHub, to learn of a new version: one request at start to the list of Zajil's releases, and nothing is downloaded. You can turn it off in Settings → “Updates” → “Check for a new version at start”.
• GitHub, to download the video tools (yt-dlp, FFmpeg and QuickJS-NG): once, when you ask for your first video, and only after you agree.
• The sites you ask for a video from, through yt-dlp, to learn the qualities there are and then to download the one you choose.
• “Site grabber”: reads the pages of the site you choose, and the pages of another site only if you add it. It always honours robots.txt, and never asks for a local or private address.

Zajil connects to no other server. We run no server that the program reaches.

What stays on your device only:

• The settings, the list of downloads, the queues, the categories and the program's logs.
• A state file next to each unfinished download, so Zajil can resume it. It holds the download link, and only your account on the computer can read it. A user name and password in the link are never saved in it.
• Cookies from the extension are not written to disk: they stay in memory until the download finishes or is removed. Except for a video: yt-dlp reads them from a temporary file in Zajil's data folder, deleted when it ends.
• Watching the clipboard is off from the start. If you turn it on, Zajil reads links from the clipboard on your computer only.

The browser extension

The extension connects to no server. It talks only to the Zajil program on the same computer, through Native Messaging, and the program accepts only our extensions' IDs.

Its basic permissions:

• downloads and downloads.uito see the downloads that start in the browser and hand Zajil those your settings choose, and so they do not show in the browser's downloads bar while they go to Zajil.
• contextMenusfor “Download with Zajil” and “Download video with Zajil” in the right-click menu.
• nativeMessagingto talk to the Zajil program on your computer.
• storageto keep the extension's settings in the browser.
• notificationsto tell you when a download stays in the browser, and why.

The optional permission “Allow Zajil on sites” (cookies, scripting and webRequest, on all sites): asked for only when you press, and you can take it back at any time in the extension's settings. Without it the extension works as it is. The browser will say the extension asks to “Read and change all your data on all websites”, as each site's cookies and videos need that site's permission. What the extension really reads is only this:

• A download link's cookies: for each download, only its link's site cookies, for its link only, and only when it goes to Zajil. For a video, its page's cookies, when you press or when the video button shows over it. They go to the Zajil program on the same computer, and from it to their own site only.
• Videos: only where a page's videos are and their addresses, and on YouTube where a playlist's title is. The addresses of the video playlists (HLS and DASH) a page loads stay in memory, for each tab, and are forgotten when it closes or opens another page. The extension watches these requests and never stops or changes them.
• Reading a video ahead: when the “Download video” button shows over a video, Zajil reads its page ahead, to have the qualities ready before you press: the page, the video's address (or the playlist the tab loaded for it) and the page's cookies go to Zajil, and Zajil asks the page's site for it. It reads a page at most once in ten minutes, and keeps what it read in memory only.
• Keys with a click (off from the start): of a link clicked with Zajil's keys, the extension learns only its address.

The extension never reads the pages' text or what you type in them. From private windows it notes nothing, takes no cookies, and sends nothing before you press.

What the extension keeps in the browser: its settings (file types, excluded sites and so on), a random ID for the browser so Zajil knows which browser it asks, and a random “ticket” for each download sent with cookies that has not finished, with a hash of its site, never its cookies, so Zajil can ask for its cookies again if resuming needs them after a restart. A ticket is forgotten when its download finishes or is removed, or after 30 days at most.

User data is not used or passed on for anything but the extension's own work: handing downloads to the Zajil program. It is not sold, not given to anyone, and not used for ads.

This site

• Static pages, with no cookies, no tracking, no analytics, no scripts from other sites and no outside fonts.
• It is hosted on GitHub Pages. As with any host, your request for each page passes through GitHub's servers to reach you, under GitHub's privacy statement.
• The download page asks GitHub straight from your browser for the latest release, to put each file's link in its button, with no cookies. The files themselves download from GitHub, under GitHub's privacy statement.
• The “Support Zajil” page has a plain link to Ko-fi only, with no script or frame from it. The Ko-fi page is a separate site, with its own privacy policy.
• The PayPal button on the same page is a plain link too, with no script or library from it. PayPal is a separate site, with its own privacy policy.

Contact and changes

For any question about privacy, write in Issues on GitHub. For security issues, use private reporting. If what Zajil does with data changes, this page changes in the same change, and the “Last changed” date at its top changes too.