How Submitted URLs, Caches, History, and Downloads Are Handled
Follow one public Facebook, Instagram, or TikTok link through VideoDownloader.click, see what is sent to the lookup provider, distinguish browser storage from the short server cache, and use the right control when you want information removed from your device.
Evidence boundary for this revision
Submitted-URL validation; browser cache and history keys; 15-minute and seven-day expiry rules; 50-item limit; server cache fields; provider request; response filtering; signed proxy parameters; consent state; no-store download responses; and service-worker exclusions.
RapidAPI and its configured provider, source platforms, remote media hosts, hosting infrastructure, the visitor’s browser, and optional consented services each operate their own systems and policies.
A SHA-256 cache key is not described as encryption or anonymity. This guide does not claim that a submitted URL is never transmitted, that infrastructure has no logs, or that clearing one browser removes third-party records.
Review context: application code, rendered controls, database cache contract, consent loader, service worker, Privacy Policy, and Security & Data Handling page checked July 28, 2026. No production credential or user-submitted URL was inspected.
The Request Flow, From Paste To File
- You paste a public post URL.The text remains visible in the current form until you replace it, clear it, reload, or leave the page. Do not submit a private or confidential link.
- The browser validates and submits it.The interface requires a complete HTTPS address and sends the URL to the application lookup endpoint using POST.
- The application checks for a fresh result.The server validates the supported source, applies a rate limit, derives a SHA-256 cache key, and checks for an unexpired filtered result.
- A provider lookup runs only when needed.For a cache miss, the full URL is sent through RapidAPI to the configured media lookup provider because that provider needs the address to identify the public media.
- The response is reduced before display.The application accepts supported fields and HTTPS media options, then returns that filtered result to the browser. Provider-supplied HTML is not rendered as trusted page content.
- You select a returned option.The file may come from the remote media host or through a short-lived signed proxy request. The proxy verifies its expiry, signature, HTTPS host, public network destination, and redirects before streaming.
What Is Kept, Where, And For How Long
| Information | Location and purpose | Current duration or control |
|---|---|---|
| URL in the input field | The current page in your browser, so you can submit or correct it. | Replace or clear the field, reload, or leave the page. |
| Browser result cache | Local storage on that browser, keyed from the submitted URL and containing the filtered response for quicker repeat checks. | Approximately 15 minutes, or remove it sooner by clearing this site’s browser data. |
| Recent browser history | Local storage on that browser; an item contains the submitted URL, returned public title, and time. | Up to seven days and 50 items. Clear All removes the history list. |
| Consent preference | Local storage records accepted or declined so the banner can remember the choice. |
Use Cookie settings to ask again, or clear this site’s browser data. |
| Server result cache | A SHA-256 representation of the submitted URL, a blank legacy plaintext-URL field, and the filtered provider response in the application database. | Up to 15 minutes; expired rows are removed during normal lookup activity. |
| Provider request | The full submitted URL is sent through RapidAPI to the configured lookup provider for a fresh lookup. | Provider and RapidAPI processing or retention is governed by their own systems and policies. |
| Signed proxy request | The generated same-site address includes the remote media URL, cleaned title, expiry time, and signature. The signature detects alteration; it does not hide the URL. | Short-lived and rejected after expiry. Do not share it; regenerate it from the original public post when needed. |
| Operational records | The application may record limited timestamps, response categories, rate-limit events, and technical errors. Hosting infrastructure may separately maintain standard access/security logs. | Infrastructure practices are outside the browser controls described here; see the Privacy Policy and contact the site for a specific privacy question. |
Three Caches That Do Different Jobs
| Cache | What it stores | What it does not mean |
|---|---|---|
| Browser result cache | A recent filtered lookup result in local storage for that browser. | It is not the downloaded file and is not a server deletion control. |
| Server lookup cache | A deterministic SHA-256 URL key and filtered provider result for up to 15 minutes. | Hashing reduces plaintext storage in this cache, but is not encryption, anonymous processing, or a substitute for the full provider request. |
| Offline site cache | A dedicated offline fallback, previously visited approved public pages, and requested same-origin interface assets managed by the service worker. | Public navigation is network-first while online. Lookup endpoints, signed proxy requests, returned media, review-only routes, errors, redirects, and private/no-store responses are excluded. |
Download-proxy responses also use Cache-Control: private, no-store. The explicit service-worker exclusion matters because a service worker is a managed cache with its own JavaScript caching rules; relying only on an HTTP response header is not the clearest application boundary. Approved HTML uses the network first and stores only successful, non-redirected, non-private responses as an offline fallback after a visit.
What The SHA-256 Cache Key Does—And Does Not Do
The server applies SHA-256 to the submitted URL so identical input can find the same short-lived cache row without intentionally writing that URL into the legacy plaintext URL column. The output is deterministic: the same URL produces the same key.
This is a storage-minimization measure, not a promise of anonymity. The URL must still exist in memory while the request is processed and must be sent to the provider on a cache miss. Deterministic, unsalted hashes may also be testable when someone already has a likely candidate URL. For those reasons, do not treat a private invitation, account-only address, or confidential link as safe merely because the server cache uses SHA-256.
Browser History Is Broader Than This Site’s Recent History
The Home page’s Clear All control removes only the application’s recent-history list. It does not remove the 15-minute result-cache entries, the remembered consent choice, the service worker’s public-page cache, the browser’s general visited-page history, downloaded files, or records held by another party.
For a fuller device-side reset, use your browser’s site-data controls for VideoDownloader.click. Browser wording differs, but the control is commonly found under privacy/security settings or the site information panel. You may separately need to remove the downloaded file and clear the browser’s general browsing/download history.
Optional Analytics And Advertising
The current consent loader waits for an accepted choice before intentionally initializing Google Analytics, Contentsquare experience analytics, or Google AdSense. A declined choice hides optional advertising slots and does not intentionally initialize those services. The choice itself is stored in local storage, not as proof that every external technology or browser feature is controlled by this site.
Select Cookie settings in the footer to reopen the choice. Changing an accepted choice to declined prevents future initialization after the page state is reset or reloaded; it cannot retroactively erase information already sent while optional services were active. Use browser site-data controls and the relevant provider privacy controls when broader deletion is needed.
Choose The Control That Matches Your Goal
| Your goal | Use this control | Also remember |
|---|---|---|
| Remove the recent list | Home → Recent Downloads → Clear All. | This does not clear recent result entries. |
| Remove recent lookup results | Clear VideoDownloader.click site data in the browser. | A fresh request may still use an unexpired server cache row. |
| Reset consent and all local site storage | Clear VideoDownloader.click site data in the browser. | The banner will ask again; offline public assets may be downloaded again. |
| Remove a saved media file | Delete it from Downloads, Files, Photos, or the folder you selected. | Clear the operating system’s trash/recycle bin if appropriate. |
| Avoid processing a sensitive URL | Do not paste or submit it. | This service is for supported public links, not private or login-protected content. |
| Ask about server or vendor handling | Read the Privacy Policy, then use Contact for a specific request. | Do not email passwords, cookies, signatures, or private URLs. |
Privacy-Safe Troubleshooting
- Reproduce a problem with a non-sensitive public post whenever possible.
- Share the exact error message, page route, browser/device, and time—not the signed proxy URL.
- Redact account names, notifications, other tabs, URL query values, and personal information from screenshots.
- Never send passwords, session cookies, API keys, login-only links, private invitation links, or browser storage exports.
- If a concern is about the source platform, RapidAPI, provider, host, browser, or device, use that party’s own privacy controls as well.
Official sources and standards context
Sources reviewed July 28, 2026: