Privacy Policy
Last updated:
1. Introduction
Simply-Debrid ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and safeguard your information when you use our service.
2. Data Controller
The data controller responsible for the processing described in this policy is:
- Entity: Simply-Debrid
- Contact:[email protected]
3. Information We Collect
Account Information
When you create an account, we collect:
- Email address
- Password (encrypted)
- Account creation date
Usage Data
We automatically collect:
- IP address (for security and rate limiting)
- Links generated (for usage tracking)
- Timestamps of activity
Payment Information
Payment processing is handled by third-party providers (Stripe). We do not store your credit card information. We only receive confirmation of successful payments.
Advertising Data
If you use Simply-Debrid without a Premium subscription, our advertising partners may collect data through cookies and similar technologies, as described in section 7. Premium users are not shown advertising and no advertising code is loaded for them.
4. How We Use Your Information, and Our Legal Bases
Under the GDPR we must tell you why we process your data and on what legal basis. We process:
- To provide and maintain the service (account creation, link generation, download history) — legal basis: performance of a contract (Art. 6(1)(b)).
- To process your transactions (Premium subscriptions, invoicing) — legal basis: performance of a contract (Art. 6(1)(b)) and legal obligation for accounting records (Art. 6(1)(c)).
- To prevent abuse and enforce rate limits (IP-based counting, security monitoring) — legal basis: legitimate interests (Art. 6(1)(f)) in keeping the service available and free from abuse.
- To communicate with you about your account (service notices, password resets) — legal basis: performance of a contract (Art. 6(1)(b)).
- To display advertising to non-Premium users, including personalised advertising where you have agreed to it — legal basis: your consent (Art. 6(1)(a)), collected through our consent management platform and withdrawable at any time.
- To measure usage of the site — legal basis: legitimate interests (Art. 6(1)(f)); our analytics provider does not use cookies and does not track you across other websites.
5. Data Retention
We retain your personal data only for as long as necessary to provide our services. Download history is kept for 30 days. Account data is retained until you request deletion.
6. Data Security
We implement industry-standard security measures including:
- Encryption of passwords using bcrypt
- HTTPS for all communications
- Regular security audits
7. Advertising and Google AdSense
Simply-Debrid is funded in part by advertising shown to users on the free tier. Premium subscribers are never shown advertising.
- Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this website or to other websites.
- Google's use of advertising cookies enables it and its partners to serve ads to you based on your visit to this site and/or other sites on the Internet.
- You may opt out of personalised advertising by visiting Google Ads Settings.
- You may opt out of the use of cookies by other third-party vendors at www.aboutads.info/choices.
- For more information about how Google uses data when you use our site, see How Google uses information from sites or apps that use our services.
In the European Economic Area, the United Kingdom and Switzerland, advertising cookies are only set after you have given consent through the consent banner described in section 10.
8. Third-Party Services and International Transfers
We use the following third-party services:
- Stripe: Payment processing
- Sirdata: Consent Management Platform (CMP n°92)
- Google AdSense: Advertising (for free users only)
- Umami: Privacy-focused, cookieless usage analytics
- PostHog: Product analytics, hosted in the European Union. Used to understand which parts of the service people use and where they run into problems. Without your consent it runs in cookieless mode: nothing is stored on your device and you are counted using a rotating, privacy-preserving identifier that cannot be linked back to you. With your consent it also records the pages you visit and the actions you take, such as generating a link. We do not record your screen: session replay is switched off. We record the domain of a link you submit (for example 1fichier.com), never the link itself.
Some of these providers are established outside the European Economic Area, or may process data in the United States. Where personal data is transferred outside the EEA, that transfer is governed by the European Commission's Standard Contractual Clauses and/or the EU–US Data Privacy Framework, together with any additional safeguards required by the provider's data processing agreement.
9. Cookies and Similar Technologies
Essential cookies are strictly necessary to operate the service and are set without consent. Advertising cookies are only set after you consent. The main cookies and local storage entries we use are:
| Name | Purpose | Duration | Type |
|---|---|---|---|
better-auth.session_token | Keeps you signed in | 7 days | Essential, first-party |
better-auth.session_data | Short-lived session cache | 30 seconds | Essential, first-party |
i18n_locale | Remembers your language | 1 year | Essential, first-party |
nuxt-color-mode | Remembers light/dark theme | 1 year | Essential, first-party |
| Sirdata consent cookies | Stores your consent choices (TCF string) | Up to 12 months | Essential, third-party |
| Google advertising cookies | Ad selection, delivery, measurement and fraud prevention | Varies, up to 24 months | Advertising, third-party — consent required |
ph_* (PostHog) | Recognises returning visitors so usage can be measured across visits | Up to 12 months | Analytics, first-party — consent required |
Our analytics provider (Umami) is cookieless and does not store identifiers on your device. PostHog sets analytics cookies only if you consent; if you refuse, it keeps running in cookieless mode and writes nothing to your device.
10. Consent Management and Transparency
Simply-Debrid obtains your consent in accordance with the policies and technical specifications of the IAB Europe Transparency & Consent Framework. We use the Consent Management Platform n°92 (Sirdata).
You can change or withdraw your privacy choices at any time by clicking here. Refusing is as easy as accepting, and withdrawing consent is as easy as giving it. Withdrawal does not affect the lawfulness of processing carried out before you withdrew.
11. Your Rights
Under the GDPR you have the right to:
- Access your personal data
- Request correction of inaccurate data
- Request deletion of your account and data ("right to be forgotten")
- Export your data in a portable format
- Object to processing carried out on the basis of our legitimate interests
- Request restriction of processing
- Withdraw your consent at any time, without affecting prior processing
To exercise any of these rights, contact [email protected]. We will respond within one month, as required by Art. 12(3) GDPR.
If you believe your data protection rights have been infringed, you also have the right to lodge a complaint with a supervisory authority — in France, the Commission Nationale de l'Informatique et des Libertés (CNIL), or with the authority in your country of residence.
12. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date.
13. Contact Us
If you have any questions about this Privacy Policy, please contact us at [email protected].