Privacy Policy
Last updated: 4 November 2026
VidHatch is built so that we see as little as possible. This policy explains what the extension, the Telegram extension, the Android app, the Windows app and the website do with data.
The extension
- Page content. VidHatch reads network requests in your current tab to detect media. When an answer has an address that may hide a video list (for example a playlist sent as plain text), it asks the same server again for the first 4 KB of it to check, at most 16 times per page; you can turn this off in Settings with “Look deeper for hidden streams”. On a page that lists many videos it also reads the page’s links to count them. All of this happens locally in your browser. It is not sent to us.
- Your files. Downloads and any audio/video merging run on your machine. The files never pass through our servers.
- Settings and lists. Your preferences, your recent downloads and, for Smart select on the Pro batch page, the addresses of files VidHatch saved before (up to 4,000, so it can skip them next time) are stored locally in the browser. They stay on your device. “Clear history” in Settings clears both lists; “Forget saved files” in Smart select clears the second. With Archive mode on in the Pro batch page, a .json file with the details the video’s page shows (title, address, uploader, upload date, length, tags, description) is saved next to each video on your disk; it is not sent to us.
- Hard-site resolver (paid). For a small set of supported sites, the extension asks our resolver for the information needed to locate the stream. This request carries the page address and your licence key, which confirms your plan. The address is held in memory for at most ten minutes to answer a repeat request, is never written to disk or logged, and is not used to profile you. The media itself still downloads directly to your machine.
The Telegram extension
- Where it runs. “Telegram Video Downloader – VidHatch” runs only on web.telegram.org. It has no access to any other site.
- Your messages. To find the file behind a message, photo or story you click, the extension asks Telegram Web for that item inside your own browser tab. Your chats, contacts and message text are never sent to us or to anyone else.
- Your files. Files travel from Telegram, through Telegram Web in your tab, to your disk. They never pass through our servers.
- No login. The extension never asks for your Telegram phone number, your password or a Google account, and it has no analytics.
- Stored on your device. The number of free downloads you used today and, if you add one, your licence key. Nothing else.
- Network requests to us. None. “Get VidHatch Pro” and “Lost your key?” only open a page on vidhatch.com in a new tab.
The Android app
- Pages you open. The app shows pages in Android System WebView and watches that page's requests to find media. This happens on your phone. It is not sent to us. On Free, the app also checks those requests against its ad list, on the phone, so its menu can show how many ad requests the page made. WebView applies Google Safe Browsing, as Chrome does.
- Your files. Downloads and merging run on your phone. Files are saved to Download/VidHatch, or with Pro to an encrypted Private folder inside the app, and never pass through our servers. A backup of that folder goes only where you choose to save it, still encrypted.
- Pro. Your Pro key is checked on the phone. The 3-day free trial is kept on the phone too: nothing is sent when it starts or ends. “Get Pro” opens the checkout in your browser through vidhatch.com/go, which counts the tap and which screen of the app it came from; that count has no IP address. If you activate Pro with the 6-digit code from your email, the app sends that code to vidhatch.com and gets your key back; if you ask for a new code, it sends the email address you typed. Your PIN and recovery code are used only on the phone, to encrypt and open your Private files. They are never stored in readable form and never sent anywhere, so nobody can reset them for you. Fingerprint unlock uses Android’s own prompt, so VidHatch never sees your fingerprint.
- No account, no analytics. The app has no sign-in, no analytics, no ads and no crash reporting. “Report a site” opens our report page in your browser with the page address filled in; nothing is sent unless you send the form.
- Update checks. Once a day the app asks vidhatch.com whether a newer version of the app exists, and asks GitHub for the latest release of yt-dlp, the open-source tool it uses to read some sites. The request to us carries only the app version. Our web server logs it with your IP address, as it does for any visit, and deletes those logs after about two weeks.
- Permissions. Internet access to load pages and files, notifications to show download progress, a foreground service so a download keeps running when you leave the app, and permission to open Android’s installer when you tap Update.
The Android app on Google Play
VidHatch on Google Play is a separate build of the Android app. Everything in “The Android app” above applies to it, except for these points:
- Pro. Pro is bought with Google Play’s own billing. Google handles the payment under its own privacy terms, and we never see your card or bank details. To know whether you own Pro, the app asks Google Play on your phone, so Pro comes back when you reinstall. It does not use a 6-digit code or a Pro key, and it never contacts vidhatch.com about Pro.
- No update checks. Google Play installs and updates the app. This build never asks vidhatch.com for a new version and never downloads yt-dlp from GitHub; the copy of yt-dlp inside it is updated with each release on Google Play.
- No report link. It has no “Report a site” button, so it never opens our report page.
- Permissions. Internet access, notifications, a foreground service so a download keeps running when you leave the app, and Google Play’s billing permission. It does not ask for permission to install apps.
The Windows app
- Pages you open. The app shows pages in its own built-in browser, based on Chromium, and watches that page's requests to find media. This happens on your PC. It is not sent to us.
- Your files. Downloads and merging run on your PC. Files are saved to your Downloads folder and never pass through our servers.
- Stored on your PC. Your settings, your recent downloads, your licence key, and the cookies and sign-ins of sites you visit, as in any browser. They stay in the app's own folder on your PC.
- No account, no analytics. The app has no sign-in, no analytics, no ads and no crash reporting.
- Network requests to us. The app never sends us the pages you open; the hard-site resolver is not part of it. It contacts vidhatch.com only when you ask: “Lost your key? Email it to me” sends the email you type so we can send your key again, and “Get Pro” and “Report a site” open a page on vidhatch.com inside the app.
- Install and updates. The Microsoft Store installs and updates the app. Microsoft's own privacy statement covers that.
Licensing & payment
If you buy Pro, your payment is handled by Whop (whop.com) when you pay by card, or by NOWPayments when you pay with crypto. Each processes your payment under its own privacy terms; we receive a license record and the email you used, so we can deliver and support your license. If you buy Pro in the Android app from Google Play, Google processes the payment under its own privacy terms and tells us about the order; we never receive your card or bank details.
The website
This site uses Google Analytics 4 to understand aggregate traffic: which pages are read, which sites send visitors here, and which install buttons get used. Google Analytics sets its own first-party cookies (_ga) and receives your IP address to estimate a general location; Google says GA4 does not log or store IP addresses. Advertising features and Google signals are turned off. You can block it with any content blocker or with Google’s opt-out browser add-on.
When a link to this site carries a ?ref= tag, we also count which site sent the visit, whether an install or payment button was clicked, and, for a crypto order, which site sent the buyer. That count stores only the site name, the action and the time — no IP address and no cookie.
When a payment goes through, our server tells Google Analytics that a purchase happened: the plan, the price, the order number and, for a crypto order placed on this site, the anonymous _ga ID of the browser that placed it. Your email address and payment details are never sent to Google.
When a link to this site carries an ?a= tag from a VidHatch affiliate, your browser keeps that affiliate’s Whop username for 30 days and adds it to the Whop checkout link, so Whop can credit them if you buy by card. The username stays in your browser; it is not sent to us.
If you send a report from the Report a site page, we receive the page address you enter, your note, the error VidHatch showed, the extension version and browser name, and your email only if you type one. The extension fills in the page address for you but sends nothing itself; the report goes out only when you press Send. It is delivered to our inbox by email, is not stored on this server, and is used only to fix that site and to reply to you.
We do not sell your data, and we do not use it to build advertising profiles.
What we do not do
- We do not sell or rent your data.
- We do not track what you download.
- We do not embed third-party ad or tracking networks in the extensions or the apps.
Your requests
You can ask what license data we hold for your email, or ask us to delete it, at [email protected].