Privacy Policy

CLICKandDOWN and ClickandShare are operated by POST OFFICE Film Prodüksiyon ve Tasarım Sanayi ve Ticaret Limited Şirketi, Küçükbakkalköy Mah. Selvili Sk. No:4 İç Kapı No:20, Ataşehir / İstanbul, Türkiye. For the purposes of the Turkish Personal Data Protection Law (KVKK) we are the data controller (veri sorumlusu); under the GDPR we are the controller for the data described below.

We have written this in plain language rather than legal boilerplate, because a privacy policy nobody can read protects nobody. Where we record something you might not expect, we say so directly instead of hiding it behind a general phrase.

Questions, requests, or corrections: privacy@clickanddown.com.

You can use the free trial of the desktop apps without an account. An account is required to buy a licence, to sync your library across devices, and to use the web downloader.

Signing in with Google. If you choose this, Google tells us your email address, name and profile picture. We do not receive your Google password and we cannot see anything else in your Google account.

The files you download never pass through our servers. The desktop app talks directly to the site you paste in and writes the file to your own computer. The one exception is the browser-based downloader on the dashboard, where the file is streamed through our service to your browser and is not stored afterwards.

What we do record is the history that makes your Library work:

To be explicit, because a previous version of this page said otherwise: your download history is kept until you remove it. It is not deleted after 24 hours. That history is the Library feature — if we erased it, the feature would not work.

You can delete individual entries from the Library at any time, in the app or on the dashboard.

The contents of your files do not reach our servers. Transfers go directly from one computer to the other. We never receive, store or scan what is inside them.

We do record a line about each transfer, so that your history and your remaining free transfers are correct:

The phone feature. When you send from a phone on the same Wi-Fi, the page and the files come from your own computer. Nothing is uploaded anywhere.

Remote connections are different, and we say so in the app as well. If you switch on the remote mode — for when your phone is not on the same network — the transfer is routed through Cloudflare’s network, because two devices on different networks cannot reach each other directly. In that mode the file contents pass through a third party. Cloudflare does not store them and neither do we, but the sentence “nothing leaves your machine” is not true in that mode, and we would rather write that here than let you assume otherwise.

Video, audio and chat are peer-to-peer. They travel directly between the editor and the guests. We do not see, record or store the session itself.

After a session, the editor can email a summary — the markers and screenshots taken during the review. For that we record:

If you joined a session as a guest. You do not need an account with us and we do not create one for you. Your name is shown to the other people in the session and is not stored on our servers. Your email address is optional; you give it only if you want a copy of the summary, and it is used for nothing else. We do not add it to any mailing list, we do not use it for marketing, and we do not pass it to anyone.

If you gave your email in a session and want it removed, write to privacy@clickanddown.com — you do not need an account to ask.

ClickandShare runs at app.clickanddown.com and signs you in with your CLICKandDOWN account through a one-time, short-lived hand-off code. It keeps its own session cookie (httpOnly, Secure) for that sub-domain only.

Connecting a channel. When you connect Facebook, Instagram, YouTube, TikTok or LinkedIn, the platform asks you to approve ClickandShare and then gives us an access token (and, where the platform issues one, a refresh token). We never see or store your platform password. Tokens are stored encrypted at rest, are never shown in the app or in any API response, and are used only to do what you asked: publish the posts you scheduled, fetch comments for the inbox, and read the statistics for insights.

What we do not do. We do not post anything you did not schedule, we do not read private messages unless you connect an inbox feature that needs them, we do not sell or share channel data with anyone, and we do not use your content to train AI models.

Platform rules. Use of data from each platform is also governed by that platform's terms: Meta Platform Terms (Facebook, Instagram), YouTube API Services Terms of Service and the Google Privacy Policy, TikTok Developer Terms and the LinkedIn API Terms of Use. You can revoke our access at any time from the platform's own security settings; the effect is the same as disconnecting in the app.

Deleting. Disconnect a channel in the app, delete your account from the dashboard, or write to privacy@clickanddown.com. Step-by-step instructions and the exact deletion timings are on the Data Deletion page.

Analytics. We use Google Analytics to see how many people visit, which pages they read and roughly where they are in the world. It sets cookies. We do not load it until you agree — see the Cookie Policy, where you can also change your mind at any time.

Purchases. When you buy a licence we record your email address, which product and tier you bought, the amount, the payment method and the order status. We never see or store your card details — payment happens on the payment provider’s own page, not ours. For bank transfers we record only that the order exists and its reference.

Reviews. If you write a review here, we publish the name and job title you give us together with your text. An email address is optional and is never published; it is only so we can come back to you with a question.

We also invite customers to review us on Trustpilot, which is an independent platform. When we email you your licence key, a blind copy goes to Trustpilot so they can send you that invitation. Your address is all they receive from us. Whether you write anything, and what you write, is between you and them — we cannot edit or remove a Trustpilot review, which is rather the point of it. The “write a review” box that appears on two pages of this site is theirs; see the Cookie Policy.

Server logs. Our hosting provider keeps standard web-server logs, including IP addresses, as every web server does. We use them only to investigate errors and abuse.

Under KVKK Article 5 and GDPR Article 6, processing needs a legal basis. Ours are:

We ask for consent only where consent is genuinely the basis. We do not put a tick-box in front of something you have no real choice about, because a consent you cannot refuse is not a valid consent.

We do not sell personal data, and we do not share it with advertisers. The only third parties involved are the ones needed to run the service:

Some of these are outside Türkiye, which means the data reaches servers abroad. Where that is the case it happens because the service cannot be provided otherwise, and we keep it to what is necessary.

Under KVKK Article 11 and the GDPR you can ask us to:

• tell you whether we hold data about you, and give you a copy of it;
• correct anything that is wrong;
• delete it — including your whole account and everything attached to it;
• stop processing it, or object to a particular use;
• receive it in a machine-readable form so you can take it elsewhere;
• withdraw a consent you gave earlier, without losing access to the rest of the service.

Write to privacy@clickanddown.com. We answer within 30 days, which is the limit KVKK sets. There is no charge.

Deleting your account does not need to go through us at all: sign in, open your dashboard and use Delete account. It removes your account together with your download history, your library notes and tags, your transfer history, your session records and your trial counters. Licence keys are kept as deactivated rows, because they belong to a sales record we are required to keep for tax purposes; they are unlinked from you and can no longer be used.

If you are unhappy with how we handled a request you can complain to the Turkish Personal Data Protection Authority (KVKK Kurumu), or to your local supervisory authority if you are in the EU or the UK.

The site is served over HTTPS only, with a valid certificate; plain-text connections are redirected. Passwords are stored as one-way hashes. Access to the database is limited to the application itself.

We are a small team and we will not pretend to certifications we do not hold. If we ever suffer a breach that affects you, we will tell you and notify the authority, as the law requires — within 72 hours of becoming aware of it.

Our products are made for people who work with video professionally or semi-professionally. They are not directed at children and we do not knowingly collect data from anyone under 18. If you believe a child has given us personal data, write to us and we will remove it.

When we change something that matters — a new kind of data, a new third party, a new purpose — we update the date at the top and describe the change here. Small wording fixes will not be announced.

3 August 2026. Rewritten in full. The previous version, dated June 2024, described only the downloader and said download URLs were deleted within 24 hours. That was not true: your library history is kept until you delete it, and it always was. It also referred to a Data Protection Officer we have not appointed, and to encryption and infrastructure we do not have. Those claims are gone. ClickandStream and ClickandSend were not covered at all before; they are now, including the guest email address and the Cloudflare routing used in remote mode.