A browser-based downloader can feel private because there is no app to install. That does not make it anonymous. The service still processes a URL on a server, sets a session, records a job and may write operational logs. The source platform may see a request from the server rather than from your browser.
This article separates general privacy concepts from FAST-VID's current draft policy. Where the implementation or legal review is incomplete, it says so instead of filling the gap with a reassuring claim.
The URL itself can be sensitive
A video URL can reveal a title, a post or video identifier, a channel, a timestamp, a region or a signed parameter. Some links contain access tokens or tracking parameters. Pasting a link into a downloader sends that URL to the service and may cause the worker to contact the source.
A link in a private message or a private dashboard can be sensitive even when the media is not secret. A URL that works only because you are signed in is also a poor fit for a public-link downloader. FAST-VID does not import platform cookies or log in to sources, so it cannot reproduce a private session.
Remove unnecessary tracking parameters when practical, but do not assume that removing them makes the link anonymous. The host, path and content identifier may still be meaningful.
What online services can observe
- Request data: the URL, timestamp, browser user agent and network address.
- Session data: a cookie or token that links requests to the same browser session.
- Job data: the selected format, status, file size and timestamps.
- Temporary files: a copy of the media while it is being delivered.
- Logs: request paths, status codes and selected headers, depending on the infrastructure.
Cookies are not automatically tracking cookies. A first-party session cookie can be essential to keep a job associated with your browser. Logs are separate: they may record a request even when no cookie is present.
FAST-VID's session and cookie behavior
FAST-VID does not require an account. It creates an anonymous first-party session. The production cookie is named __Host-ydl_session and is configured as HttpOnly, Secure, SameSite=Lax, with Path=/ and no Domain attribute; its default lifetime is 24 hours. The database stores a hash of the session token rather than the raw token.
The CSRF token used for state-changing requests is returned by the session API and sent in the X-CSRF-Token request header. It is not a separate cookie. Blocking or deleting the session cookie can make existing jobs and file links inaccessible, because the service can no longer associate them with the old session.
What FAST-VID's privacy draft says it processes
The current Privacy Policy draft describes:
- Session data: a random session identifier, a hash of the session token, a hash of the visitor IP address, creation and last-seen times, and an expiry time.
- Job records: the source URL, title, selected format and output type, status, timestamps, filename and size, job and session identifiers, worker identifier, visitor IP address and sanitized metadata.
- Temporary media: the completed output, stored only for preview or download.
- Rate-limit data: hashed session or IP keys, counters, time windows and daily usage counters.
- Operational logs: timestamps, request paths, response status, client IP address, user agent and selected headers recorded by the reverse proxy or application.
Completed media has a default retention of about 30 minutes after completion. Download tokens default to 300 seconds and preview tokens to 1,200 seconds. Rate-limit and daily usage counters are described as roughly 48 hours before cleanup. These are configured defaults, not a promise that every deployment uses the same values.
Logs and redaction
The current configuration redacts the X-CSRF-Token, Authorization, Cookie and Set-Cookie header values, plus the token, preview_token and download_token query values. That matters because a reverse proxy can record request headers even when the application does not. Other request headers, such as user agent, referer, origin and accept, may still appear in the proxy log, so redaction is not the same as anonymous logging.
Log retention depends on the server and Docker logging configuration and is marked for operator review. Backup and backup-retention policies are not defined in the repository. Do not assume that an operational log disappears on the same schedule as a temporary media file.
Third parties and platform cookies
FAST-VID loads optional Google Tag Manager analytics only after an affirmative analytics choice; it does not load advertising scripts or tracking cookies. It does not import login cookies from YouTube, TikTok, Instagram or another source platform. The source platform sees the worker's public request, not your browser's source-platform session.
The privacy draft says FAST-VID does not sell personal data. It identifies hosting, media-processing, email and infrastructure providers as possible processors, but the specific provider identities and any international-transfer arrangements are marked for operator review. Those details are not guessed here.
What is still unresolved
- The legal entity, registered address, jurisdiction and data controller identity are not finalized.
- Legal bases for processing and jurisdiction-specific privacy rights require review.
- Operational-log retention and backup policy are undefined.
- Log redaction covers the configured sensitive headers and token query values, but other request metadata can still be recorded.
- There is no self-service account or data-deletion tool. Requests are handled manually through support, with no guaranteed response time.
- The privacy policy is a draft, not a certification of compliance.
These are not minor footnotes. They determine how much anonymity or control a user can reasonably expect. Read the live draft rather than relying on a summary.
Practical privacy advice
- Use the official FAST-VID domain and check the address before pasting a link.
- Do not submit links that contain passwords, session tokens, private dashboard URLs or personal information.
- Do not paste platform cookies or credentials into any downloader.
- Use a private browser window or a separate profile if you do not want the URL in your normal history; remember that the server still processes it.
- Clear the site's cookies after you have saved the file if you want to end the local session, but understand that this does not immediately erase server-side job records or logs.
- Avoid downloading sensitive material on a shared or public computer.
- Use the support address for questions, but do not send passwords, cookies, CSRF tokens or other secrets.
- A VPN changes the apparent network route; it does not make a server-side service anonymous.
Frequently asked questions
Is FAST-VID anonymous?
It uses an anonymous session rather than an account, but it still processes URLs, IP-related data, job records and logs. That is not the same as complete anonymity.
Does FAST-VID use tracking cookies?
The current Cookie Policy describes the essential first-party session cookie and the optional, consent-gated Google Tag Manager analytics choice. Optional analytics is not loaded before an affirmative choice. Check the live policy for current details.
How long are files kept?
The default temporary-media retention is about 30 minutes after completion. Download and preview tokens are shorter-lived. Production settings and cleanup timing can vary.
Can I delete all my data?
There is no self-service deletion tool. The privacy draft says requests can be sent to support and are handled manually, with no guaranteed response time.
Does a VPN make me anonymous?
No. It can change the apparent IP address and route, but the service still processes the request and may keep logs. VPNs are not an anonymity guarantee.
Sources and references
- FAST-VID Privacy Policy — current draft on sessions, jobs, retention and logs.
- FAST-VID Cookie Policy - session cookie and optional consent-gated Google Tag Manager analytics.
- MDN: HTTP cookies — general cookie behavior.
- FTC: Online security — general consumer privacy and safety guidance.
Try FAST-VID
Open the FAST-VID downloader from the official domain, submit only public links you are authorized to use and read the live privacy drafts before treating the service as anonymous.