This policy covers FlashDL for Instagram: the widget at insta.flashdl.one/embed/, wherever it is embedded, and this website.
What we process
The link or @username a visitor pastes. Our server uses it to fetch the public content and send the result back. It goes from our server to our own data service, which retrieves the public information from Instagram and keeps a short-lived cache to answer repeat requests faster. We don’t keep a history of lookups or downloads, and we don’t build profiles of visitors.
Technical data. Like any website, our servers receive each visitor’s IP address, browser type and the time of each request. Cloudflare, which runs our servers, uses this to deliver pages and protect against attacks. Our server logs record technical details such as errors, timings and which site a sponsor tab was opened from, and are kept for up to 7 days.
Small values in the browser. The widget stores the time it last opened a sponsor tab, so it can keep to one every 30 minutes. This website stores your light or dark choice if you change it. Neither value identifies anyone.
Messages you send us. If you email us or write on Discord, we keep the conversation as long as we need it to help you.
Cookies and analytics
The only cookies are the ones Google Analytics sets, described here.
We use Google Analytics 4 inside the widget and on this website to count, in aggregate, how often the widget loads, which kinds of content people look up (post, profile, Story or Highlight), downloads, and errors, along with the name of the site the widget is on. We never send Google Analytics the links, usernames or captions people look up.
Google Analytics loads after the widget is ready to use. It may set cookies named _ga and _ga_<ID>, which by default last up to two years. Inside the widget they are third-party cookies, marked SameSite=None; Secure. Safari blocks them there by default, and Firefox keeps them separate for each site. Google processes this data under its own privacy policy (opens in a new tab). You can opt out with Google’s opt-out add-on (opens in a new tab) or by blocking third-party cookies.
Who else receives data
- Instagram content servers. Most previews and all downloads load straight from Instagram servers to the visitor’s browser, so those servers receive the visitor’s IP address and browser details, as they would on Instagram itself. Profile pictures and Highlight covers pass through our server. The lookup itself is made by our server, not the visitor’s browser.
- Cloudflare hosts our website, widget and server.
- Google provides analytics, as described above.
- The sponsor. When the sponsor tab opens, it passes through our server with only the name of the site the widget is on. Once it opens, the sponsor’s own privacy policy applies.
We do not sell, rent or trade personal data, and we don’t share it for advertising.
For publishers
If your site uses a consent banner, list the FlashDL widget as a third-party service that uses Google Analytics. The widget sends us only your site’s name, never your page addresses. If you add the optional page link handshake, that address stays in the visitor’s browser.
Children
FlashDL is not meant for children under 13, and we don’t knowingly process their data.
Your choices and rights
We hold very little that could identify anyone. If you want to ask what we hold, or ask us to delete something, write to flashdl2026@gmail.com. Depending on where you live, you may have further rights under local law, and you can complain to your data protection authority.
Changes
If this policy changes, we update this page and the date at the top.
Contact
Email flashdl2026@gmail.com or Discord flashdl.