Fetchrail Browser Integration Privacy Policy
Last updated: 19 October 2026.

Project maintainer: RRMTools, Portugal. Privacy contact: support.fetchrail@rrmtools.uk.

RRMTools is the Fetchrail project operator responsible for optional desktop analytics (the data controller).

Optional desktop analytics and per-run summary sharing rely on consent, withdrawable at any time without affecting earlier lawful processing. You may request access, correction, erasure, restriction or portability where applicable, or object where applicable, using the privacy contact. An unidentified contribution cannot be isolated after aggregation. You may complain to Portugal's data protection authority, CNPD (https://www.cnpd.pt/cidadaos/participacoes/), or your competent supervisory authority. See the complete policy for the processing details and local controls.
Canonical policy: https://fetchrail.rrmtools.uk/privacy

Fetchrail Browser Integration connects a supported desktop browser to the Fetchrail download manager installed on your Windows or Linux computer. It handles information needed to select, route and control downloads. The desktop app separately offers optional improvement analytics with user consent, described below.

Information processed

Downloads: File and referring-page URLs, filenames, file sizes, content types, progress and transfer options that you choose.

Page content: When you choose to scan a page or process a page batch, the companion reads relevant links, media URLs, labels and download controls.

Browsing activity: With optional website access, the companion temporarily observes HTTP(S) request URLs, methods and tab identifiers to associate downloads with pages, including redirects and popups.

Authentication information: Only if you explicitly enable Use browser session for captured files, the companion may forward the final GET request's Cookie, Authorization, Referer and User-Agent headers to the local Fetchrail application to support downloads that need your existing website session. Session support is disabled by default.

Local preferences: Browser download routing, session setting, queues, connection limits, speed limits, schedules and page-batch state.

Where information goes

The companion passes chosen downloads and transfer controls to Fetchrail on your computer through the browser's native messaging interface. Fetchrail contacts the file server you selected to verify and download the file. If browser session support is enabled, the relevant session headers accompany the download request. The file server receives ordinary network request data, including your IP address, according to its privacy policy. The extension does not load remotely hosted executable code. Optional desktop analytics are described below.

Optional desktop performance calibration

The desktop app offers user-started hardware and connection tests with explicit network-data and temporary-disk budgets. Generated online test traffic goes to Cloudflare's speed-test endpoints. You may explicitly provide a direct file URL for bounded ranged reads instead; that link is held in memory during the test and excluded from saved/copied reports. The chosen server receives ordinary request information including your IP address. Downloaded files, browser credentials and measurement reports are not submitted. Hardware measurements and hashed network/volume/host tuning keys stay in the app's private local performance.json file, bounded to four reports, 128 observations and 2 MiB. Tuning expires after 14 days or relevant engine/network/volume changes. You can reset this data or disable automatic tuning in Settings > Performance. This optional desktop feature does not require additional browser permissions.

Storage and retention

Preferences and page-batch state are stored locally in browser extension storage. Temporary request observations use browser session storage, are bounded in size and ignored after two minutes. Turning off session support clears captured observations.

Private-window request observations are kept separately in extension memory, never written to shared browser storage, and cleared when their tab closes. They expire after two minutes and are discarded if the extension restarts. Accepted private downloads appear in the desktop application's local history and follow the desktop retention rules below.

With session support enabled, right-clicked links and links pasted into the companion open in the chosen browser window before capture. Private browser batches stay in extension memory. Desktop links submitted with Use browser session wait in desktop memory for up to 15 minutes or until the app closes. Connected companions see only pending request identifiers and counts until you choose Use this window, which passes those links and download options to that browser for processing.

Fetchrail stores download history and unfinished transfer details locally. When session support is enabled, unfinished downloads may include sensitive request headers in the desktop application's local downloads.json file for resuming downloads after restart. These headers are deleted on transfer completion or removal, and are excluded from extension status responses and interface events. Downloaded files remain on your computer until you delete them.

Your choices

You may turn off automatic routing, keep browser session support disabled, revoke optional website access, stop a batch, remove downloads or uninstall the extension. Page scanning uses temporary active-tab access when requested. Broader website access is optional, requested when starting page batches or session support. Private/incognito downloads can be captured only after you allow this extension in private windows through your browser's extension settings. Session forwarding still requires enabling Use my browser session.

Optional desktop improvement analytics

The desktop Fetchrail app offers optional first-party improvement analytics, off by default. Choosing Allow in the desktop app permits combined counts of launches, HTTP/torrent downloads and feature use plus broad app version, operating system, CPU architecture and completed-download size buckets. A browser handoff may contribute a count; its URL, filename, browsing/session information and local preferences are never included. There are no user, device, session or transfer identifiers or exact event times. Declining or closing the choice sends no analytics and changes no functionality. Settings → Privacy lets you withdraw, clearing unsent memory-only counts.

Desktop counters are sent at most every 30 minutes to Fetchrail's Cloudflare-hosted endpoint and combined into protected daily totals for the latest 30 UTC calendar days. No raw reports or IP addresses are stored by our analytics code; Cloudflare recovery copies may retain deleted aggregate data another 30 days. Cloudflare sees IP addresses in transit and may process ordinary network/security metadata. Full fields, purposes, recipients and choices are explained at https://fetchrail.rrmtools.uk/privacy. App update checks remain a separate feature.

Diagnostics uses separate permission

Desktop diagnostics runs only after your action, keeping full measurements local. Its optional connection test requests at most 128 MiB of payload from speed.cloudflare.com; Cloudflare sees ordinary IP/request metadata, and Fetchrail sends no uploads or result reports to that endpoint. Turn that checkbox off for local-only tests. The browser extension does not instrument diagnostics.

The usage-analytics grant does not authorize performance fields. A completed desktop report separately previews optional coarse processor/drive/memory/connection bands plus app release version and broad OS/architecture. Only an explicit per-run Share sends these independent counters to Fetchrail on Cloudflare, with the same aggregate retention above. Exact values, available RAM, model names, paths, endpoints, identifiers, errors, timestamps and full reports are excluded. Keep local changes no features; a pending share can be cancelled. There are no queued or automatic retry sends.

Website, support and changes

The Fetchrail website runs on Cloudflare, which may handle ordinary site request logs and website analytics. Visiting the site does not send extension download history or browser session headers to the developer. GitHub handles source downloads, release visits and support under its own policies.

For questions, email support.fetchrail@rrmtools.uk or visit https://github.com/Beelzebub2/fetchrail/issues. Do not put private download links, cookies or credentials in public issues. Future changes to this policy will be reflected at https://fetchrail.rrmtools.uk/privacy, with the update date shown on the page.

Desktop reliability diagnostics and separately scoped analytics

For analytics intake abuse protection, Cloudflare uses a temporary IP-derived rate-limiting key. Fetchrail does not copy it into analytics tables, reports or application logs. This separate security processing relies on our legitimate interest in protecting service availability and security, rather than analytics consent; contact the privacy address to object where applicable. Provider network/security metadata follows Cloudflare's purpose, sensitivity, security and legal retention criteria at https://www.cloudflare.com/privacypolicy/, rather than Fetchrail's aggregate deletion schedule.

Desktop version 0.8.2 introduces private local download health with bounded numeric stage/attempt timelines, HTTP body and checkpoint counters, fixed cause classes, broad software version/platform, and safe torrent observations. No source, filename/path, credential, tracker, peer address, infohash or arbitrary message enters a safe incident report. This does not add extension instrumentation or browser permissions. A separate per-incident preview and review choice is required to copy/export JSON; there is no automatic incident upload. Exported files remain until you delete them. Public GitHub issues are public; agree a private recipient and retention before sharing.

Desktop imports and browser verification/commit operations have separate source-free local reports when no download was admitted. The latest 20 stay in session memory and never enter routine fleet download counts.

Optional local crash breadcrumbs are separately enabled, off by default, protected with Windows account encryption or private Linux permissions, capped at 20 reports / 512 KiB and seven days, and cleaned at startup/read/periodic runs. If the app is closed, cleanup runs on its next start. Clear deletes owned diagnostic history. Unknown or damaged files are preserved for manual inspection. Hard termination can lose the last unsaved evidence.

Existing improvement consent does not authorize product-quality-v2. This independent choice covers only combined outcome/size/error/protocol counts and fixed stage-duration histograms, broad release/OS/architecture, with no identifiers, source data, exact event times or per-transfer record. Only transfers newly admitted in the consent period qualify; withdrawal clears unsent counts and cancels pending sends, with no persistent retry queue. Already received aggregates cannot be recalled. Recipient and aggregate/PITR retention are the same Fetchrail/Cloudflare boundaries above; no EU-only or absolute-anonymity claim is made. From desktop 0.8.2, expanded analytics stays off until you expressly allow this separate purpose under notice reliability-v2-20261019. Earlier improvement grants and draft reliability choices do not enable it.