# Flash Download — Privacy Policy

**Effective 28 October 2026 · applies to Flash Download 0.1.2 and later**

Flash Download is a desktop download manager published by JM Tech Power. This
policy describes exactly what the app does with data. It is written against the
application's source code, which is public.

## The short version

**JM Tech Power collects nothing.** The app has no accounts, no telemetry, no
analytics, no advertising, no crash reporting and no auto-update service. No data
is sent to the developer or to any third party we control. Everything the app
stores stays on your computer.

## What is stored on your device

| What | Where | Contains |
| --- | --- | --- |
| Settings and history | `state.json` in the app's data folder | Your settings, your list of proxy routes (host and port, but not their passwords), and one record per download: source URL, file name, destination folder, full file path, size, bytes received, added/finished timestamps, and the SHA256 checksum once verified |
| Proxy credentials | `credentials.enc` in the same folder | The username and password for each proxy route, encrypted (see below) |
| Resume data | A `.fdpart` file beside each unfinished download | Source URL, file size, the server's ETag and `Last-Modified`, and the byte offset each connection has reached. Deleted automatically when the download completes |
| Your downloads | The folder you choose (default: your Downloads folder) | The files themselves |

Deleting a download from the list, or uninstalling the app, removes these records.
Downloaded files are not deleted unless you ask for that explicitly.

### Proxy credentials are encrypted by your operating system

If you give a proxy route a username and password, they are encrypted and written
to a separate `credentials.enc` file — never to `state.json`. The encryption key
is held by your operating system's credential store, not by the app: **DPAPI on
Windows, Keychain on macOS, and the login keyring (libsecret/kwallet) on Linux**.
Another account on the same machine cannot read them, and copying the file to
another machine makes it useless.

If your system has no keyring available — some minimal Linux setups — the app does
not fall back to plain text. It keeps the credentials in memory for that session
only, warns you that they will not be saved, and writes nothing to disk. They are
sent only to the proxy server you configured, using that proxy's own
authentication.

## Network connections the app makes

1. **To the servers you download from.** When you add a link, the app connects to
   that server, opening up to 32 connections against the file. It sends ordinary
   HTTP headers, including `Range` headers and the user agent `FlashDownload/0.1`.
   That server sees your IP address, unless you route the download through a proxy.
2. **Through the proxies you configure, if you configure any.** The operator of a
   proxy you add can see the destination addresses and the traffic you send
   through it. This is inherent to using a proxy and is the feature working as
   intended; choose proxies you trust.
3. **One latency test at startup.** To show each route's latency, the app makes a
   single small request through every configured route to a test address. The
   default is `https://example.com`, a reserved documentation domain maintained by
   IANA. This is the only request the app makes that you did not initiate. You can
   point it elsewhere with the `routeTestUrl` setting.

The app contacts no other servers. It does not phone home.

## Clipboard

When **Offer links copied to the clipboard** is enabled — it is on by default —
the app reads your clipboard about once a second and checks whether it holds an
`http` or `https` link. If it does, that link is offered in the app window so you
can start it with one click.

Clipboard contents are never stored, never written to disk and never transmitted.
Text that is not a link is discarded immediately. You can turn this off in
Settings and the app will stop reading the clipboard entirely.

## What the app downloads

Flash Download retrieves whatever you point it at. It does not inspect, filter,
upload or share the contents of your files. Checksum verification is computed
locally on your machine.

## Children

Flash Download is a general purpose utility and is not directed at children. It
is a tool for retrieving files from addresses you supply; it provides access to
whatever is at those addresses.

## Changes

Material changes will be published with a new effective date, and the version of
the app they apply to.

## Contact

JM Tech Power — jmtechpower.com@gmail.com