This policy explains, in plain language, what YesPotato collects when you use the Instagram downloader, what it never collects, and the choices you have. It applies to https://yespotato.com.
The short version
- No account, no Instagram login, no password — there is nothing to sign into.
- We do not store the media you download. It is streamed through and discarded.
- We do not keep a per-user history of the links you paste.
- We do not sell or share personal information with data brokers.
What we process
Links you submit
The Instagram URL you paste is used to fetch the media and is held in memory for the duration of the request. Successful lookups are cached for a few minutes, keyed by the public post/profile identifier, so a link being shared widely isn't re-fetched from Instagram thousands of times a minute. That cache contains public metadata only and is not associated with you.
Technical request data
Like any web server, ours records standard request information: IP address, user agent, requested path, timestamp and response status. This is used for abuse prevention, rate limiting and debugging. Rate-limit counters are held in memory and expire within minutes.
Aggregate analytics
We count page visits and app-install button clicks to understand which pages are useful. Counts are de-duplicated per IP per day and stored as aggregates; we do not build a profile of an individual visitor and there is no cross-site tracking of your browsing elsewhere.
Local storage on your device
One key, yp-theme, remembers whether you chose light or dark
mode. It never leaves your browser and you can clear it at any time
through your browser's site-data settings.
Advertising
YesPotato is free to use and is funded by advertising. We do not charge for downloads and there is no paid tier. When advertising is enabled, third parties including Google may set cookies or use device identifiers to serve and measure ads.
- Google, as a third-party vendor, uses cookies to serve ads on this site.
- Google's use of advertising cookies enables it and its partners to serve ads based on your visit to this and other sites.
- You can opt out of personalized advertising at Google Ads Settings, or opt out of third-party vendor cookies at aboutads.info.
- See also Google's privacy & terms for partner sites.
Where advertising is active and the law requires it — in the EEA, the UK and Switzerland — consent for advertising cookies is collected through a Google-certified consent management platform before personalized ads are served, and you can change or withdraw that choice at any time from the same notice. If you decline, you will still see ads, but they will not be personalized.
Third-party services we load
- Google Analytics 4 — aggregate traffic measurement (which pages are visited, from which country, on which kind of device). Configured for measurement, not for advertising audiences.
- Google Fonts — web fonts.
- Cloudflare CDN (cdnjs) — the icon stylesheet.
- Google AdSense — advertising, when enabled.
- Instagram / Meta CDN — the media itself is fetched from Instagram's servers.
Each has its own privacy policy governing data it collects.
Google Analytics sets its own cookies to tell a returning visit from a new one. You can prevent it entirely with Google's Analytics opt-out add-on, or by blocking analytics cookies in your browser — the downloader works exactly the same either way.
Children
The service is not directed at children under 13 and we do not knowingly collect personal information from them.
Data retention
Downloaded media: not retained. Extraction cache: minutes. Rate-limit counters: minutes. Aggregate visit counts: retained as aggregates. Server logs: rotated on a short schedule.
Your rights
Depending on where you live you may have the right to access, correct or delete personal data we hold, and to object to certain processing. Because we deliberately hold almost nothing tied to an identity, there is usually very little to act on — but write to us at [email protected] and we will respond.
Security
Traffic is served over HTTPS. Download links are signed and expire, which prevents them being reused or repointed at other hosts. We keep the attack surface small by not storing user data in the first place.
Changes
If this policy changes materially, the date at the top of the page changes with it.
Contact
Privacy questions: [email protected]. Copyright matters: see the DMCA page.