Privacy

Kescher is a browser extension that finds the videos a page plays and saves them to disk. It needs broad access to the browser to do that, and it uses none of it to learn anything about you.

Nothing leaves your browser. Kescher has no server, no account, no analytics, no crash reporting, no update ping beyond the store's own mechanism, and no uninstall survey. The only network requests it ever makes are to the media you asked it to download, to the manifests and decryption keys that media references, and — while that download runs — to the one cover image the page itself declared for it.

This document is the canonical privacy statement, and its public address — the one both store listings give — is https://kescher.app/privacy/.

It is linked from Privacy in the options page's About section and from both store listings. A verbatim copy ships inside the extension as PRIVACY.txt, and that is the copy the options page links to — reading Kescher's privacy statement must not itself be a request to somebody's server.

Last reviewed 2026-09-13, against the extension's manifest and the behaviour described below. Anything that changes what Kescher observes or stores changes this statement with it.

What Kescher observes

Data	Why	Where it lives	How long
Response headers of requests your tabs make (`content-type`, `content-length`, `content-range`, `content-disposition`), the request URL, tab and frame id	This is the detection: a video is recognised by what the player loads	`storage.session` (browser memory)	Until the tab navigates, the tab is closed, or the browser restarts
Page URL and page title, `<video>`/`<audio>` source URLs, poster URL, duration	Naming the file and replaying the request with the right `Referer`	`storage.session`	As above
What the page says the media is: title, author, series, date, description and a cover image URL, as the page declares them in its own schema.org, Open Graph and `<meta>` tags	Writing them into the file you save, so a media player, Plex or your phone shows it properly	`storage.session`, and on the download's own record in `storage.local` while it exists	As above; the copy on a download record goes with the history entry
Manifest bodies (`.m3u8`, `.mpd`)	Listing the qualities and planning the segments	Memory only, never written to disk	Until the background worker sleeps
Your settings	Your settings	`storage.sync` (or `storage.local` when sync is off)	Until you change or reset them
Download jobs and history: file name, size, source URL, time, state	The download page and the history list	`storage.local`, metadata only — never the video bytes	30 days / 200 entries by default; configurable, clearable, opt-out
The file being downloaded, while it is being downloaded	Some downloads have to be assembled by Kescher rather than by the browser's download manager — a stream made of hundreds of segments, or a file whose server insists on a `Referer`. The bytes are streamed into the browser's own private storage (OPFS) as they arrive, never held in memory, and handed to the download manager when the file is complete	The origin private file system, which only this extension can read and which is not the page's storage	Deleted as soon as the file has been handed over, and on cancel or failure. A leftover is swept on the next start of the download page unless a job record still claims it, in which case cancelling that row deletes it. Nothing is kept after the download

Cookie, Set-Cookie, Authorization and Proxy-Authorization headers are dropped the moment a response is seen, before anything is stored or logged. Downloads started in a private window are marked as such and are never written to the history or to a debug bundle. While such a download is running, its row exists in the browser's session storage so that the download page of that private window can show it and finish it; that record is gone when you close the browser, and a window that is not private never shows it.

What is written into the file you save

A downloaded file carries the description the page itself published about that media, so that your media player, Plex, Jellyfin or your phone shows a title and a cover instead of a file name: the title, the author or artist, the series or site, the date, the description, the address of the page it came from, and the page's own cover image. Nothing else. No header, no cookie, no segment or manifest URL, nothing Kescher observed on the network, and nothing the page did not declare. Every value is stripped of the characters that misrepresent text and clamped to a sane length first, exactly as a title in the popup is. You can switch the whole thing off in the settings (Embed the page's title, author, date and cover in the file).

The cover is one request, and the only one Kescher makes that is not the media itself. While your download is running, Kescher fetches the single image URL the page declared for that media — its thumbnailUrl, its og:image or the player's poster — and writes it into the file as cover art. It is one GET, to a URL the page gave, under the same rules as every other request of that download; it is capped at 2 MB; only JPEG, PNG and WebP are accepted; and if it fails for any reason the download simply carries on without artwork. The image is not stored anywhere else, and nothing is fetched when you merely open the popup: a page you never download from is never requested.

The debug bundle

A bug report about a site that does not work is worth what its evidence is worth, so the download page can write a debug bundle: a JSON file holding what Kescher saw on that page and what it tried. It is written only when you press Download debug bundle, it goes into your download folder like any other file, and it is never sent anywhere — attaching it to a bug report is your decision, after you have read it.

What it cannot contain, by construction rather than by care:

No query strings. Every URL in it is cut at the ?, in fields, in log messages and in header values alike, because a signed media URL carries its token there.
No headers except an allowlist of headers that describe the shape of a response (content-type, content-length, content-range, …). A header nobody thought about is dropped rather than carried.
Nothing from a private window — not a candidate, not a job, not a log line.

Exactly one place in Kescher builds a bundle, and an automated test checks those three rules against a thousand random header maps. Report this site opens a prefilled issue in a new tab; it makes no request of its own and carries no token.

What Kescher never does

It never reads your cookies. Kescher does not use the cookies permission and never touches browser.cookies. When it downloads from a site you are logged into, the browser attaches the cookies itself, exactly as it does for the page — Kescher never sees their value.
It never sends your data anywhere. No telemetry, no analytics, no error reporting, no remote configuration, no remote code.
It never circumvents DRM. Protected streams are labelled protected and cannot be downloaded.
It never loads anything from a third party. Every byte of the extension ships in the package, and every build is checked for remote references before it is packaged.

Permissions

Every permission Kescher requests, and the single reason it is requested. An automated test fails if the manifest ever asks for something that is not listed here.

Permission	Why Kescher needs it
`webRequest`	Watch the response headers of media requests your tabs make. This is how videos are detected; without it Kescher would have to guess. Response bodies are not read.
`webNavigation`	Notice when a tab navigates so the list of found videos is cleared for that page. Back/forward and cached navigations are invisible to `webRequest` alone.
`downloads`	Save the finished file with the browser's download manager and offer Show in folder.
`storage`	Keep your settings, the download history and the per-tab list of found videos. All of it stays in the browser.
`notifications`	Tell you when a download has finished or failed, so you do not have to watch the page. The notification names the file and nothing else, it is shown by your operating system, and you can switch it off in the settings.
`contextMenus`	Add the single Kescher: download this video entry to the right-click menu on a video, an audio element or a link. Kescher reads the address you clicked on and nothing else about the page.
`declarativeNetRequestWithHostAccess`	Chromium only. Set `Referer`/`Origin` on the extension's own download requests, because a CDN often rejects a request without them. The rules are scoped to Kescher's own download tab and removed when the job ends.
`webRequestBlocking`	Firefox only. The same thing: rewrite `Referer`/`Origin` on Kescher's own download requests. Firefox has no `declarativeNetRequest` equivalent for this.
`<all_urls>` (host permission)	Videos live on any domain, and a video's segments usually live on a different domain than the page. Kescher cannot know in advance which sites you will use it on. It reads nothing from a page beyond the media URLs and the page title, and it acts only when you press Download.

Deliberately not requested: tabs, cookies, unlimitedStorage, scripting, activeTab and downloads.open.

How to delete everything

The list of found videos disappears on its own when you navigate or close the tab; Clear list in the popup removes it immediately.
History — Clear history on the download page, or set the retention to zero days in the settings.
Settings — Reset settings on the options page.
A half-finished download is deleted at once when you cancel it or when it fails. One left behind by a crash or a browser restart is swept from the private file system the next time the download page starts — with one exception, so that opening a second download page cannot delete the file the first one is still writing: a partial file whose job record still says the job is running is kept until that row is cancelled. Nothing has to be cleaned up by hand, and an uninstall takes it too.
Everything at once — uninstall the extension. Chrome and Firefox delete all extension storage with it. Files you already downloaded stay where you saved them; they are yours.

This website

Everything above is about the extension. This website — kescher.app — is a separate thing, and it does count visits.

It uses Umami, a cookieless analytics tool the maintainer hosts himself on analytics.stack25.com. No third party is involved and no data is passed on to one. Umami records, per visit: the page that was opened, the referrer that led to it, the browser, the operating system, the device type, and the country derived from your IP address — the IP address itself is not stored. Clicks on the download buttons are counted together with the browser you chose, so that it is possible to see which install route people actually use.

There are no cookies, no cross-site tracking, no advertising network, no profile and no personal data. Nothing collected here can be traced back to a person, and none of it is shared or sold.

If you would rather not be counted at all, Umami's own opt-out works here: set umami.disabled to 1 in this site's local storage (developer tools → Application → Local Storage) and the measurement script is not even fetched on your next visit. A content blocker that blocks the tracker's domain has the same effect, and nothing on the site depends on it.

The extension itself sends nothing anywhere, and there is no connection between the two: installing Kescher does not start any measurement, and nothing you do with the extension reaches this website. What Kescher never does stays true word for word.

Contact

Privacy questions and reports: open an issue at github.com/STACK25/kescher.app/issues, or write to the address in the imprint.