Controls that protect the service
- Server-side Apify token: the credential is a Cloudflare secret and is never shipped to the browser.
- Per-IP rate limit: the Worker applies a short-window limit before extraction so automated bursts are refused early.
- One normalized link cache: repeated variations of the same public URL share one Durable Object record for the cache window.
- Single-use signed downloads: each available media or profile-picture action has a short-lived token scoped to the exact link hash and marked used at the start of the stream.
- Upstream allowlist: the proxy only fetches media from known Apify or TikTok media hosts, which prevents the endpoint from becoming a general SSRF proxy.
- Honeypot and body limits: the form silently rejects basic automated submissions and oversized JSON bodies.
What the service will not do
- It will not process a login, cookie, private profile, or access-controlled post.
- It will not help download intimate imagery shared without consent, harassment material, or content that violates applicable law.
- It will not offer batch URLs or a public API for automated scraping.
- It will not promise that every upstream post, quality, or watermark state is available forever.
For site operators
Keep APIFY_API_TOKEN and DOWNLOAD_TOKEN_SECRET in Wrangler secrets. Rotate the token if it is ever exposed, keep the actor ID explicit, and review Apify usage because actor pricing and supported fields can change.
Before adding advertising, disclose it clearly and keep ads away from the primary download control. The site should remain useful even when an ad blocker is enabled.
Report abuse: for copyright or rights concerns, follow the notice process on the copyright page. For an urgent security issue, do not publish credentials or personal data in a public report.