Clipmoth

Clipmoth — Privacy Policy

Last updated: 2026-10-21 · Applies to the Clipmoth browser extensions (Firefox, Chrome, Edge), the Windows desktop app, and the website clipmoth.com.

Authoritative versions of this policy are English and 日本語. Use the language switcher above to read the Japanese version.

Summary

Clipmoth is a tool for downloading media that you have the right to save. It is built to work on your device. We do not collect, sell, or share your browsing history, the URLs you visit, or the media you download. There are no third-party analytics, no trackers, and no advertising SDKs in our extensions or our desktop app. The website sets no cookies and has no advertising or cross-site tracking; it does use one cookie-less page-usage counter (Webokami), described under “The website” below. We do count some anonymous aggregates on our own server — how many update checks and downloads happen, and which link people came from — and none of it is tied to a person or a device.

What we do NOT collect

  • Your browsing history or the list of pages you visit.
  • The media URLs detected on pages, or the files you download — these are processed locally and never sent to us.
  • Personal identifiers, contacts or location, and — in the extensions and the desktop app — any behavioral or analytics data.

Data that leaves your device

1. License key verification (only if you buy Premium)

If you purchase Premium and enter a license key, that key is sent to our server (api.clipmoth.com) solely to verify it and unlock premium features. The key is a purchase token; we do not use it to identify or track you across sites. The result is cached locally so verification isn't repeated on every use. To enforce the device limit, the server keeps a random per-installation identifier and the browser's user-agent string for each activation; you can see and remove activations on your account page.

2. Update check (desktop app)

On startup the desktop app asks our server whether a newer version exists. That request carries only the app version and the platform it is built for (for example 1.0.0 and windows-x86_64), plus the technical details every web request necessarily has (IP address, which we use to derive the country and do not store, and the request's user agent). We count these requests to know how many people are running which version. There is no account, no device identifier, and no record of what you download.

3. Requests to the sites you download from

To detect and download media, the extension/app makes requests to the website or CDN hosting that media (for example, fetching an .m3u8 playlist and its segments). These requests go directly from your browser/device to that third-party site, not through us, and are subject to that site's own privacy practices.

4. Configuration file (browser extensions)

The extensions fetch a small configuration file (trial length and daily free-tier limit) from our server (api.clipmoth.com), at most about once every 6 hours — when you open the popup or settings, or when a download starts or finishes (free plan only). The request contains no identifier and no browsing data — only what every web request necessarily carries (IP address and the browser's user agent). When you remove an extension, the browser opens clipmoth.com/goodbye, where you can optionally tell us why.

5. Desktop app: download engine updates and optional features

The desktop app's download engine (yt-dlp) checks GitHub (the yt-dlp releases on github.com) for a newer version and updates itself — automatically at launch at most once every 24 hours, and when you press the manual update button. If you turn on SponsorBlock, a short hash prefix derived from the YouTube video ID (not the ID itself) is sent to sponsor.ajay.app to look up sponsor segments. If you turn on “use browser cookies”, the app reads the chosen browser's cookies locally on your PC only to pass them to the site you are downloading from; they are never sent to us. When you uninstall the app, it opens clipmoth.com/goodbye in your browser.

The website (clipmoth.com)

The website is a static site hosted on Cloudflare Pages, and our server (api.clipmoth.com) runs on Cloudflare Workers. The website sets no cookies and uses no advertising or cross-site tracking scripts. Like any web host, Cloudflare processes your IP address and browser details to deliver the pages and protect them from abuse.

Page-usage counter (Webokami)

To see which pages help people, the website — not the extensions or the desktop app — loads Webokami, a cookie-less page-usage counter provided by fretless Inc. and run on Cloudflare. When a page opens it sends the page address, the site you came from and your screen width; when you leave the page it sends roughly where you clicked (a coarse grid, not exact points), which links you clicked, how far you scrolled and how long you stayed. Your IP address and browser name are used only to make a code that changes every day, so that one visit is counted once; they are not stored, and nothing follows you from one day to the next or to other sites. Click positions and scroll depth are kept only as daily totals per page and deleted after 90 days. It is not loaded on the account, checkout, activation, welcome or goodbye pages, and nothing you type is sent.

Anonymous event counts

To learn which pages and links are useful, a few pages send one small anonymous event to api.clipmoth.com:

  • opening /premium, /request or /changelog (on /changelog, also the extension version in the link, if there is one);
  • clicking a link to the Chrome Web Store, downloading the Windows installer (the download link passes through api.clipmoth.com/dl/…), and pressing the checkout button on /premium.

An event contains only the event name, a short label for the link or campaign you came from (for example extension-footer or lp-hero), and the page language. Our server adds the country (Cloudflare derives it from your IP address; the IP address itself is not stored) and the browser's user-agent string, so that we can tell real browsers from automated link scanners. Events contain no cookie, no account or device identifier, no IP address and no page address, and they are not linked to each other or to you. If you buy Premium, the same link label is stored with your purchase so we know which link led to it.

Showing your local price

When you open /premium, the page asks api.clipmoth.com/geo for your two-letter country code (derived by Cloudflare from your IP address) so it can show ¥1,480 for purchases from Japan or US$9.99 elsewhere. The checkout uses the same lookup to charge purchases from Japan in yen. The answer is not stored.

Forms you choose to send

  • Site requests (/request, and the “which site?” box on /goodbye): the site you typed (we keep only the host name, e.g. example.com, and drop the rest of the address), whether it is video or audio, your email address only if you enter one (used only to tell you about that site), your browser's language and user-agent string.
  • Uninstall reasons (the buttons on /goodbye): the reason you picked, your browser's language, whether you removed the extension or the desktop app, and the user-agent string.

Stored in your browser

The website keeps two items in your browser's local storage (not cookies): clipmoth_lang — the language you chose — and, only if you sign in to your account page, clipmoth_session — your sign-in token, removed when you sign out. You can clear both in your browser settings at any time.

Fonts

The fonts (Inter, and Noto Sans JP for Japanese) are served from clipmoth.com itself, so viewing a page does not connect your browser to Google Fonts or any other font service. No third-party content is loaded.

Payments

Purchases are processed by Stripe on its own Stripe Checkout page. Your card number is entered there, and we never see or store it. We receive a confirmation and your email address in order to deliver your license key and to send purchase-related emails: activation help, check-ins and important notices about the product you bought (updates, fixes, terms), and — only if you opted in at checkout — news and offers. You can stop any of them by replying.

Permissions (browser extensions)

  • Host access to sites you visit — required to detect media on any page you choose to download from. Used only for detection/download; page content is not read or transmitted.
  • webRequest (observe only) — passively notices media responses so the extension can offer them for download. It does not block or modify the pages you browse.
  • webNavigation — to notice when a tab goes to a new page, so the list of detected media is cleared for that tab.
  • downloads — to save files to your device.
  • storage — to remember your settings, daily free-tier count, and cached license status locally. The trial start date and today's download count are also kept in the browser's sync storage, which stays in your own browser account (so reinstalling does not reset them); nothing is sent to us.
  • activeTab — when you click the toolbar button: to read the active tab's title (for naming the saved file) and to take a snapshot of the visible tab as a preview thumbnail in the popup. The snapshot stays in the popup and is not saved or sent anywhere.
  • declarativeNetRequestWithHostAccess (Chrome, Edge) — applies only to the extension's own download requests: adds the page's address as the Referer (some video servers refuse requests without it) and keeps those requests away from sites the extension does not support. Your browsing traffic is not touched.
  • webRequestBlocking (Firefox) — the Firefox equivalent of the line above, limited the same way to the extension's own download requests.
  • offscreen (Chrome, Edge) — joins the downloaded pieces of a stream into one file inside your browser.
  • sidePanel (Chrome, Edge) — to show the Clipmoth list in the browser's side panel when you choose to open it there.

Data retention & your rights

Local data (settings, counters, cached license) stays on your device and can be cleared by removing the extension/app. On our server we retain your license record (key, email, purchase date), your activations, your account login (a password hash), and a log of which purchase-related emails we sent you, for as long as the license is valid, so you can re-activate it. To request deletion of your license record, email us.

Website data — anonymous event counts, site requests and uninstall reasons — is kept only as long as it is needed to improve the product. If you left your email address with a site request, you can ask us to delete it at any time.

Children

Clipmoth is not directed to children under 13 and we do not knowingly collect data from them.

Changes

We may update this policy; material changes will be reflected by the "Last updated" date above.

Contact

Questions or deletion requests: privacy@clipmoth.com