Streamgrab: Video Downloader for MP4, HLS & M3U8 Streams: Privacy Policy

Last updated: 2026-10-14

Who we are

Streamgrab is a browser extension published by Exochard, the publisher named on its store listings. Exochard decides what data Streamgrab handles and is responsible for it. Contact: [email protected]

This policy covers the extension, the Streamgrab API it talks to (hosted on Cloudflare at exotools-api.exochard.workers.dev; older versions call gigscope-api.exochard.workers.dev, which forwards to it) and the website https://streamgrab.pages.dev. It describes every kind of data Streamgrab collects, how it is used, where it is stored, how long it is kept and who it is shared with. Streamgrab collects no data that is not listed here.

What the extension does

Streamgrab watches the network requests your browser makes while you browse, to notice video files, HLS playlists and DASH manifests. It reads the type and size of the responses, never their content, and never blocks or changes the requests of the pages you visit. When you press Download, it fetches the video from the server that hosts it and saves the file to your download folder, or, with Pro on Chrome and Edge, to a folder you chose in Options. In Chrome and Edge, that download request carries the page's address (origin only) as Referer, as the page itself would send it, and a hidden page inside the extension joins the downloaded pieces into one file.

Summary of the data Streamgrab handles

• Authentication information: your Pro licence key, sent to the Streamgrab API to check it.

Streamgrab does not collect your browsing history, health, financial or payment information, location, or the content of the pages you visit. It does not sell data, does not use it for advertising, and does not use it to decide creditworthiness or for any purpose unrelated to finding and saving the videos you ask for.

Data stored only in your browser

These stay in your browser's extension storage and are never sent to us:

• Your settings: filename template, default quality, the yt-dlp shell, the browser name yt-dlp reads cookies from, and the live part length.
• The list of videos found on each open tab. It is kept for the browser session and removed when the tab navigates or closes.
• The list of downloads of this session.
• The collection: for each stream you add, the page address, the page title and the stream address, up to 500 streams. It is kept across browser restarts until you remove the stream or clear the collection. A copy of the streams still waiting is kept in a second entry for older versions.
• Collection entries that could not be read: up to 50 entries and 256 KB of their raw page address and title text, kept until you clear them.
• The dates of your free trial and a clock check that keeps the trial and pass dates honest.
• A random install id, made when the extension was installed and used for the licence check.
• Your Pro licence key and the pass end date, if you activate Pro.
• Files of the download in progress, in your browser's private storage (the origin private file system): the pieces fetched so far and the file being joined. They can reach the size of the video. They are removed when the file is saved, when the download is cancelled or removed, and at the next start of the extension after a crash.
• Your save folder, a Pro setting on Chrome and Edge: the folder you chose in Options, kept as a handle in your browser's IndexedDB. Files are written into it on your device and nothing about it is sent anywhere.

Uninstalling the extension deletes all of it.

Permissions

• webRequest and access to all sites: see the type and size of the responses a page makes, to notice video. The page's own requests are not blocked or changed.
• declarativeNetRequestWithHostAccess (Chrome and Edge): the page's address (origin only) is sent as Referer on the extension's own download requests, so the video server accepts them.
• webRequestBlocking (Firefox): the same Referer is added to the extension's own download requests by a request listener. The page's own requests are not changed.
• offscreen (Chrome and Edge): a hidden page joins the downloaded pieces into one file, because the background worker cannot.
• downloads: saves the finished file to your download folder, when no save folder is set.
• File System Access (Chrome and Edge, Pro): writes the finished file into the save folder you chose. The folder is picked by you, and nothing is sent.
• scripting: when you open the popup, it reads the page's video element on your device: its poster image or one frame drawn to a canvas, to show a picture beside the stream in the list. The picture stays in the popup, is not stored and is not sent anywhere. It also puts a Download button on a video, only on a page where a video was already found.
• storage: keeps the data listed above in your browser.

Data that leaves your browser, and why

Licence check (authentication information)

• What is sent: your licence key, the product name, and a random id made when the extension was installed.
• When: when you activate Pro, and at most once a day after that. The free trial starts and ends on your device and sends nothing.
• Why: to confirm the key is valid with Payhip, the seller of record for Pro passes, and to count each browser once, so entering the key again in the same browser never takes a second of its 3 seats.
• Where it is kept: the Streamgrab API keeps the list of install ids that use a key, filed under a one-way hash of the product name and key; the key itself is not stored. The list expires 400 days after the key was last checked.

Video requests (not sent to us)

• What happens: when you press Download, the extension requests the video, playlist or segments from the server that hosts them, as your browser would when playing it.
• When: only when you press Download.
• Where it goes: to the server that hosts the video only. The addresses of the pages you visit and of the videos you find are never sent to us. The downloaded file is saved where you choose and is never sent to us.

Uninstall page

When you remove the extension, the browser opens https://streamgrab.pages.dev/bye. The page sends nothing: it offers a link to leave a review in your browser's store and a link to email us.

Website roadmap page

The roadmap page at https://streamgrab.pages.dev/roadmap shows planned and shipped changes. Loading it asks the API for the list of items and sends only the product name. The website sets no cookies. It counts page views with Cloudflare Web Analytics, which sets no cookies and keeps nothing that identifies you.

When you buy a pass

You buy Pro on Payhip, which handles the payment, your name, your email address and the licence key under its own privacy policy. Payhip then sends the Streamgrab API a notice about the order. The API keeps the product code of the pass, the price, the currency, whether a coupon was used and the order number for 35 days, plus a daily count of sales for 400 days. Your name, email address, network address and licence key are not stored by Streamgrab.

Who we share data with

We share data only with the services that run Streamgrab, and only for the purposes above:

• The servers that host the videos you choose to download, which receive the requests described above.
• Payhip, to check licence keys and sell passes: https://payhip.com/privacy
• Cloudflare, which hosts the Streamgrab API and the website: https://www.cloudflare.com/privacypolicy/

We do not sell or rent data, do not share it with advertisers or data brokers, and do not transfer it for any other purpose. We would disclose data only if the law requires it.

How data is protected

All traffic between the extension, the Streamgrab API and the services above uses HTTPS. The Streamgrab API keeps licence keys and network addresses only as one-way hashes.

Your choices and rights

• See or delete your local data: uninstall the extension, or clear its data in your browser's extension settings.
• Free a licence seat or ask about your data: write to us at [email protected]. We answer within 30 days.
• If you live in the EU or the UK, you also have the rights the GDPR gives you, including the right to complain to your data protection authority.

Children

Streamgrab is a general-purpose tool and is not directed at children under 16. We do not knowingly collect data from them.

Changes to this policy

When this policy changes, we update this page and the date at the top. A change that adds a new kind of data ships only with an extension update whose store listing describes it.

Contact

Exochard, [email protected]