Last updated: 8 October 2026
nzlny does not need your name, email or any social-media login, and it never keeps copies of the videos, photos or audio you download. This policy explains the small amount of information we do handle, why, for how long, who helps us process it, and the rights you have.
1. Who is responsible
nzlny (nzlny.com and its language versions, the "Service") is run by Eslam El-Refae, an individual based in Cairo, Egypt, who is the data controller for the processing described here ("we", "us"). Privacy questions and requests: privacy@nzlny.com. General contact: hello@nzlny.com.
2. The short version
- No account and no sign-up. We never ask for your TikTok, Instagram, X or Facebook login.
- Files you download pass through our servers on their way to your device. They are not saved.
- We do not store IP addresses in our databases. Our host, Cloudflare, sees your IP address to deliver the page, and we use it briefly to stop abuse.
- We keep basic usage statistics. A random visitor ID cookie (
nz_vid) is set only if you choose "Accept" in the cookie banner, and never if your browser sends Global Privacy Control. - Records linked to a visitor ID are deleted after 13 months. Only counts with no visitor ID are kept longer.
- There are no ads on nzlny at the moment, and we do not sell or share your personal information.
3. What we process and why
3.1 When you open a page
What: your IP address (processed by Cloudflare and not written to our databases), browser user-agent, the page you asked for, your language settings, and your country as derived by Cloudflare from your IP address.
Why: to deliver the page, show it in a suitable language, and protect the Service against automated abuse. To limit abuse we issue a short-lived session token (valid 30 minutes) that contains a keyed one-way hash of your IP address, and we apply rate limits per IP address. Neither is stored in a database.
Legal basis: necessary to provide the Service you asked for, and our legitimate interest in keeping it secure.
We do not redirect you automatically based on your location. We may suggest a language version; if you choose one, we remember it in the nz_lang cookie.
3.2 When you paste a link and download
What: the link you submit and, for a public post: the platform, the post ID, the post's public title or caption, the type of media and public counts (such as views and likes); whether retrieval worked, the error type and how long it took; and what you downloaded (video, photo or audio, and its quality). We do not store the creator's username.
Why: to fetch the public file you asked for, show you download buttons, cache results for speed, fix broken links, and understand which platforms and features people use.
Legal basis: necessary to provide the Service, and our legitimate interest in running and improving it.
Download buttons are signed links that expire after about one hour. Thumbnails and files are fetched by our server and passed to your browser, so your browser does not contact TikTok, Instagram, Facebook or X when you use nzlny.
The page reads your clipboard only when you press "Paste" (and only if your browser allows it). The text stays on your device unless you then submit it as a link.
3.3 Usage statistics
What: pages viewed; actions such as paste, download, language switch, opening a question in the FAQ, and how far you scrolled; device type, operating system and browser family; country; the referring website's domain and campaign tags (utm_source, utm_medium, utm_campaign); and JavaScript error messages.
Without your consent these events are recorded without any visitor ID, so they cannot be linked to each other or to you.
With your consent ("Accept" in the cookie banner) we also set the nz_vid cookie, a random ID that lets us count unique and returning visitors and link your page views and downloads together.
Why: to see which features and pages help people, find and fix errors, and produce aggregated statistics (for example, the share of downloads by platform in a country).
Legal basis: your consent for the visitor ID cookie and the records linked to it; our legitimate interest for the cookieless counts.
We do not use these statistics for advertising, do not combine them with data from other websites, do not try to find out who you are, and do not publish rankings of individual creators.
3.4 People who appear in public posts
When you request a public post, its public details pass through our systems. People who appear in public posts are not our users, so we explain it here: we use this information only to deliver the requested file, to run the Service and in aggregated statistics. We do not store creator usernames. Creators can ask us to delete what we hold about their posts, or to block their content from nzlny, by writing to privacy@nzlny.com or following our Copyright Policy.
3.5 When you email us
If you write to us, we use your email address and message to reply and to keep a record of the request. Legal basis: our legitimate interest in answering you, and our legal obligations for rights requests and copyright notices.
3.6 What we do not collect
We do not ask for your name, email address, phone number, passwords or payment details to use the tool. We do not knowingly collect sensitive data, and we do not access private accounts or content that needs a login.
4. Cookies and similar storage
A cookie is a small file your browser stores. We also use your browser's session storage, which works in a similar way and is cleared when you close the tab.
| Name | Type | Purpose | Lifetime |
|---|---|---|---|
nz_consent | Strictly necessary cookie | Remembers your choice in the cookie banner ("all" or "essential") | 13 months |
nz_lang | Strictly necessary cookie | Remembers the language you chose | 12 months |
nz_vid | Statistics cookie, only after "Accept" | Random ID to count unique and returning visitors | 13 months |
nz_ref, nz_us, nz_um, nz_uc | Session storage | Keep the referring site and campaign tags for the current tab | Until the tab closes |
nz_last, nz_sg | Session storage | Remember the last link you pasted (to refresh an expired download button) and that you dismissed the language suggestion | Until the tab closes |
Changing your choice. To withdraw consent or change your choice, delete the cookies for nzlny.com in your browser settings (or clear the nz_consent cookie). The banner will appear again on your next visit. When consent is no longer present, our server deletes the nz_vid cookie. Saying no never stops the downloader from working.
Global Privacy Control. If your browser sends a Global Privacy Control (GPC) signal, we treat it as a refusal: no nz_vid cookie is set and your events stay cookieless.
Third-party requests. Fonts are served from nzlny's own domain, so your browser makes no requests to Google Fonts. When you download all photos of a post as a ZIP, the page loads the open-source JSZip library from cdnjs, which is operated by Cloudflare.
Advertising. nzlny shows no ads at the moment. If we introduce advertising later, ad cookies and similar technologies will only be used with your consent where the law requires it, and we will update this policy before that happens.
5. Who helps us and who receives information
- Cloudflare, Inc. hosts and runs the Service (Cloudflare Workers), stores our usage database (Cloudflare D1) and our event statistics (Cloudflare Workers Analytics Engine), and provides security and content delivery. Cloudflare acts as our processor under its Data Processing Addendum. Its network is global, so data may be processed in data centres in many countries.
- The platform you link to (TikTok, Instagram, Facebook or X). To retrieve a public post, our server sends that platform a request for the post. We do not send your IP address, cookies or identifiers.
- Authorities and rights-holders, only where the law requires it, to protect rights or safety, or to handle a valid copyright notice.
We do not sell personal information, and we do not "share" it for cross-context behavioural advertising as defined by California law.
6. International transfers
nzlny is run from Egypt and uses Cloudflare's global network, so information may be processed in Egypt, the United States, the European Union and other countries where Cloudflare operates. For data from the EU/EEA, the UK and Switzerland, transfers rely on the Standard Contractual Clauses (and the UK and Swiss equivalents) included in Cloudflare's Data Processing Addendum. For data subject to Egypt's Personal Data Protection Law No. 151 of 2020, we follow its rules on cross-border transfers.
7. How long we keep it
| Data | Kept for |
|---|---|
| Records of link requests and downloads, including the visitor ID when you consented | 13 months, then deleted. Before deletion they are rolled up into daily counts with no visitor ID. |
Visitor record for nz_vid (first and last visit, counters) | Deleted 13 months after your last visit |
| Event statistics in Cloudflare Workers Analytics Engine | About three months (Cloudflare's storage limit) |
| Daily aggregated counts with no visitor ID | As long as they are useful |
| Public post details cache (platform, post ID, title or caption, counts; no username) | As long as needed to run the cache and statistics; deleted sooner on request |
| Session tokens, rate-limit counters and download links | Minutes to one hour |
| Emails, rights requests and copyright notices | Up to 3 years after the matter is closed |
8. Your rights
Depending on where you live, you may have the right to know what we hold about you and get a copy, to correct it, to delete it, to restrict or object to its use (including our legitimate-interest statistics), to withdraw consent at any time (without affecting earlier processing), to data portability, and not to be treated differently for using these rights. In particular:
- EU/EEA and UK (GDPR, UK GDPR): all of the rights above, and the right to complain to your data-protection authority (in the UK, the ICO).
- Egypt (Personal Data Protection Law No. 151 of 2020): the rights to know, access, correct, delete and object, and to complain to the Personal Data Protection Center.
- California and other US states (CCPA/CPRA and similar laws): the rights to know, delete and correct, and to opt out of the sale or sharing of personal information. We do not sell or share personal information, and we honour Global Privacy Control.
- Brazil (LGPD), Turkey (KVKK), Saudi Arabia (PDPL), the UAE (PDPL), Indonesia (PDP Law) and other countries: the rights your law gives you, including access, correction, deletion and complaint to your authority (for example the ANPD in Brazil).
How to ask. Email privacy@nzlny.com. Because we do not know your name or email, we may need details to find your records, such as roughly when you used the Service and from which country. If you accepted the statistics cookie, deleting your cookies ends any link between your browser and our records. We answer within one month, or the period your law sets.
9. Children
The Service is not directed to children. You must be at least 13 years old to use it, or 16 in EU countries where that is the age of digital consent (or the higher age your country requires). We do not knowingly collect personal information from children below these ages. If you believe a child has given us personal information, contact us and we will delete it.
10. Security
We use HTTPS everywhere, encrypted and signed short-lived download links, keyed one-way hashing for security tokens, restricted administrative access and Cloudflare's platform security. No method is perfect. If a breach affects you, we will notify you and the authorities as the law requires.
11. Changes
We will update this page when our practices change and change the date at the top. If a change is significant, such as introducing advertising, we will show a notice on the Service before it takes effect.
12. Contact
Eslam El-Refae, Cairo, Egypt · Privacy: privacy@nzlny.com · General: hello@nzlny.com · Copyright: copyright@nzlny.com