License (MIT)
MIT, plus four supplemental clauses that keep plugins independent works. Verbatim, not summarised.
LICENSE
CHANNEL
Terms & policies
RELv0.4.1.0
API1.0.0
TEST199 PASS
Terms & policies
Four short documents that answer the questions a license does not: what leaves your machine, what ships alongside TurboDL, what you are responsible for, and what the MIT terms actually say. Each one is a file in the repository as well as a page here.
The documents
Third-party components
Which libraries ship with TurboDL, under what license, and which projects supplied ideas without supplying code.
docs/legal/THIRD-PARTY.md
Privacy
What leaves your machine when you use TurboDL — and the list of things that never do.
docs/legal/PRIVACY.md
Terms of use
Responsibility, warranty, third-party plugins, and the name — the parts a license does not spell out.
docs/legal/TERMS.md
What comes along with it
Read out of docs/legal/THIRD-PARTY.md at build time, so this ledger and that file cannot disagree. Only turbodl-core is required; the JS loader is the one module that pulls in a native library.
Runtime dependencies
Kotlin standard library · 2.0.21 toolchainApache-2.0
kotlinx.coroutines · 1.9.0Apache-2.0
OkHttp · 4.12.0Apache-2.0
Okio · via OkHttpApache-2.0
quickjs-kt · 1.0.15Apache-2.0
QuickJS · bundled with quickjs-ktMIT
All permissively licensed (Apache-2.0 / MIT), so closed-source commercial integration is unproblematic.
When it touches the network
Five moments, and every one of them starts with something you asked for. Read out of the privacy document at build time.
outbound requests
You submit a downloadThe URL you gave it. TurboDL contacts that address and nothing else
Segmented downloadThe same URL, with HTTP Range requests for different byte ranges
HLS downloadThe address of the M3U8 playlist, plus the segment addresses written inside that playlist
DNS resolutionYour system resolver; or, if you set TurboConfig.dns, the static hosts or DoH endpoint you chose
ProxyYour proxy server, if you configured one
No heartbeat, no telemetry ping, no request fired off in the background.
What lands on disk
Three kinds of files, all next to something you named.
files
The downloaded fileWherever you asked it to go
Resume statePer-segment progress, next to the destination file. Cleaned up when the task finishes or is removed
JS plugin sandboxCreated only when the JS loader is used: turbodl-js/<plugin-directory>/ under the working directory, containing storage/ (the plugin's own persistent data) and downloads/ (scratch downloads)
The resume state is cleaned up when a task finishes; the JS sandbox exists only if the JS loader is used.
What each one covers
Four files, four questions. If two of them seem to overlap, the repository path tells you which one is authoritative.
docs/ and the repository root
LICENSELicense (MIT)
docs/legal/THIRD-PARTY.mdThird-party components
docs/legal/PRIVACY.mdPrivacy
docs/legal/TERMS.mdTerms of use
These pages are rendered from those files, so a change to the file changes the page.
Why these are written plainly
Because the alternative is a document nobody reads. These pages say what the code does, including the parts that are inconvenient: no warranty, no signing pipeline, no isolation promises beyond what the category list enforces. If something here stops matching the code, that is a bug worth reporting — not a nuance to live with.