Privacy

What lyt sends, and what stays on your machine.

lyt runs on your machine. It has no lyt account, no hosted service, and no product analytics. Downloads contact the media site you request, and setup contacts release sources when it installs managed tools.

What lyt sends over the network

The media site. When you download, yt-dlp contacts the URL you give it and the services needed to resolve and fetch the media.
Managed tools. lyt doctor --fix and first-use installs download yt-dlp from its GitHub release and check it against the published checksum. On Windows, lyt may download a verified ffmpeg build from its GitHub release when no usable ffmpeg is found.
Update checks. lyt may ask npm for the latest published version of @tanattv/lyt. Successful checks are cached for about six hours. Turn them off with lyt config set update-check false or LYT_NO_UPDATE_CHECK=1.
Spotify links. lyt reads the public track list from Spotify and searches YouTube for each song. If you set your own Spotify API keys for playlists over 100 songs, lyt uses Spotify's Web API with them.
Cookies. Browser cookies are read only when you pass --cookies-from-browser or --cookies, and they are sent to the site you download from.
Network checks. lyt doctor --network contacts YouTube, Spotify, SoundCloud, and GitHub, and only when you run it.

Requests are not anonymous

Requests come from your network address and are visible to the sites and networks they pass through. lyt cannot make those requests anonymous.

What stays on your machine

Downloaded files, saved to the folder you choose or the default downloads folder.
Config in config.json inside lyt's data folder. Secrets such as Spotify API keys are stored there and masked in lyt config output.
History in history.jsonl inside the same folder. It records titles, uploader, site, page URL, and absolute file paths. Use lyt history --clear to wipe it, or --no-history to skip recording a run.
Managed tools such as yt-dlp and any managed ffmpeg. lyt doctor shows their exact paths.

The data folder is %LOCALAPPDATA%\lyt on Windows, ~/Library/Application Support/lyt on macOS, and $XDG_DATA_HOME/lyt or ~/.local/share/lyt on Linux.

Check before you share

Before you send a history file, a bug report, or a screenshot, remove source URLs, local file paths, and any config values.

Telemetry

lyt does not send product-usage analytics. npm download counts and GitHub traffic are published by those platforms. They do not identify lyt users or show which downloads succeeded.

Responsible use

Download media only when you own it, have permission or a licence, it is in the public domain, or an applicable copyright exception covers the use. Public availability does not grant download, reuse, or redistribution rights. Site terms and local law may also restrict a workflow. Do not use lyt to get around DRM, paywalls, or access controls.

Reporting security issues

Do not open a public issue for a vulnerability that could expose user data, run unexpected commands, overwrite files, or bypass a safety boundary. Follow the security policy instead. Remove cookies, tokens, private media URLs, and personal file paths from any report.

Install lyt Command reference