You can use a public-link downloader in a private window, but do not expect anonymity. Private mode changes local history and cookie storage in the browser. The file you save still goes to a disk, and the downloader still receives the request and processes the URL on its server.
FAST-VID uses an anonymous first-party session, a short-lived download token and server-side media processing. It does not accept imported cookies or platform logins. This guide separates browser-local privacy from server-side processing and explains the actual session boundary.
What private browsing does and does not hide
Private or incognito windows generally avoid saving local browsing history and discard cookies and site data when the private session ends. The exact behaviour depends on the browser and its settings. It is useful for reducing local traces on a shared device.
Private mode is not anonymity. Websites still receive requests, your network provider or administrator may still see connection metadata, and an employer or school device may still be managed. Mozilla, Google and Apple all describe private browsing as a local privacy feature, not a guarantee that activity is invisible to everyone.
| Private mode usually changes | Private mode does not guarantee |
|---|---|
| Local history after the session | That websites cannot see the request |
| Cookies stored in the private session | That your ISP or network administrator sees nothing |
| Some form and site data retention | That a downloaded file is deleted |
| Local download-list entries in some browsers | That a server forgets the request immediately |
Downloaded files can outlive the private window
A file written to the download folder is a separate copy on disk. Closing the private window does not reliably erase it. Mozilla explicitly says files downloaded in a private window are saved, although their entries are not kept in the Downloads Library after private browsing ends.
Other browsers have their own download-list behaviour, so check the file manager rather than assuming the file vanished with the session. On a shared device, delete the downloaded file yourself and empty the download folder or trash where appropriate.
This is also why private mode is not a substitute for cleaning up sensitive media. The browser history is one thing; the MP4 in Downloads is another.
Cookies and the FAST-VID session
FAST-VID does not require an account. Its web app creates an anonymous first-party browser session so jobs and file links stay associated with the browser that started them. In production, the session cookie is named __Host-ydl_session and is set with HttpOnly, Secure, SameSite=Lax and Path=/ attributes. Local development may use a non-Secure cookie name.
The raw session token is not stored in the database; only a hash is stored. The CSRF token used for state-changing requests is returned in an API response and sent in a request header; it is not a separate cookie.
A private window keeps its cookie in the private cookie jar. When the private session closes, that local cookie is normally discarded. The server-side session record has its own expiry and cleanup schedule, so the two are not the same lifetime.
FAST-VID session lifetime and download tokens
The current source defaults the session lifetime to 24 hours from creation. The cookie uses that session lifetime; activity updates a last-seen timestamp but does not necessarily extend the fixed expiry. Deployment configuration can override these defaults, so treat the values below as the current build's defaults, not a permanent promise.
| Item | Current default | What it means |
|---|---|---|
| Browser session | 24 hours | Anonymous session record and cookie lifetime |
| Download token | 300 seconds | Short-lived, job- and session-bound file authorization |
| Preview token | 1,200 seconds | Separate short-lived authorization for MP4 preview |
| Completed job and temporary media | 30 minutes after completion | Cleanup removes the job row and its temporary folder unless a stream is active |
| Rate-limit counters | Roughly 48 hours | Used for abuse limits; not a download-history promise |
A download token is verified against the job and session. It is not a general public file URL, and it is not valid without the matching browser session cookie. If a token expires, request a new one while the job is still available; if the job has been cleaned up, the file is gone and the download must be started again.
Because a new private window has a new cookie jar, it cannot present the old session to FAST-VID. The old job may still exist on the server until cleanup, but the new private session cannot authorize it. This is a session boundary, not a claim that the server instantly forgets the request.
Server-side processing, logs and retention
FAST-VID's worker contacts the supported source from the server environment through its configured egress path. That is separate from your browser-to-FAST-VID connection and from your local browser session. A source sees the server's network request, not your private-mode cookie.
The privacy draft lists job records, the submitted URL, title, selected format, status, timestamps, filename and size, session and job identifiers, a visitor IP, worker identifier and sanitized metadata. Completed media is temporary and is not intended as a permanent library. The draft also says FAST-VID does not import platform login cookies, log in to YouTube, TikTok or Instagram, or bypass DRM, paywalls or private content.
Operational logs can include timestamps, request paths, response status, client IP, user agent and request or response headers, depending on the reverse proxy and server logging configuration. The current configuration redacts X-CSRF-Token, Authorization, Cookie and Set-Cookie values, plus the token, preview_token and download_token query values. Other request headers may still be recorded, so this is not a no-log or complete-anonymity claim.
Log retention is not fixed by the repository: the privacy draft says it depends on the server and Docker logging configuration. Do not read the 30-minute media cleanup as a promise that every log entry disappears in 30 minutes.
Closing the window and shared-device precautions
Close the private window when you are finished, then check the download folder and remove the file if it should not remain. If the file was saved to a shared Downloads folder, closing the browser alone is not enough.
Do not rely on private mode to protect a shared device from a determined local user. Use the device lock, a separate OS account where available, and explicit file deletion. Clear the browser's private session if it offers that control.
If you started a job in a private window and closed it before saving, the job may still be processing or waiting for cleanup. You cannot recover its authorized download link from a new private session; start a new request only if you still need the file and the source permits it.
Practical privacy limits
Private browsing is a useful local control, not a complete privacy system. It does not hide your activity from websites, your employer or school network, your ISP, or a server that receives your request. It does not make a VPN unnecessary, and a VPN would not change FAST-VID's server-to-source request path.
FAST-VID is a generic public-link downloader. It outputs MP4 video, MP3 audio and conditional M4A audio, with a maximum final output of 500 MB. It does not accept login credentials, imported cookies, private or member-only content, or DRM-protected media.
Use private mode to reduce local history, then manage the file and the request deliberately. Do not use it as a promise of anonymity or as a way to evade access controls.
Frequently asked questions
Does incognito hide downloads?
No. A file already saved to disk can remain after the private window closes. Private mode mainly affects local history and session data.
Why did my download link expire in private mode?
Download tokens are short-lived and tied to the session. Closing the private window discards the session cookie, and the token may also reach its expiry.
Are cookies required for FAST-VID?
Yes, FAST-VID uses an anonymous first-party session cookie to associate jobs and file links with the browser. It does not import platform cookies.
Does private browsing hide my activity from my ISP or employer?
No. Private mode is primarily local browser-session privacy. Network operators, managed devices and websites may still see requests.
Does FAST-VID keep files for 30 minutes?
The current code defaults completed jobs and temporary media to a 30-minute retention after completion, but deployment configuration can change it and logs have separate retention.
Sources and references
- Mozilla: Private Browsing
- Google Chrome Help: Browse in private
- Apple: Browse privately in Safari on Mac
- FAST-VID: Privacy Policy draft
- FAST-VID: Cookie Policy
Try FAST-VID
Open the FAST-VID downloader if you need a supported public link. Use private mode for local session privacy, then manage the saved file and understand that FAST-VID still processes the request on its server.