Download limits and expiring links: settings that stop sharing without punishing real buyers

Posted by the FileFreight team. We build a flat-rate delivery tool for digital sellers: secure download links, per-buyer PDF stamping, and license keys. The settings advice below is general practice for any delivery tool with per-buyer links; FileFreight's own limits are the ones stated on our homepage.

Every digital seller eventually finds their download link somewhere it shouldn't be — a forum post, a group chat, a "freebies" site. The instinctive response is to clamp down: one download, link dies in 24 hours. That stops the sharing, mostly. It also generates angry emails from real buyers who clicked on their phone, meant to download at home, or never saw the email until the weekend.

Limits and expiry are a trade-off, not a security switch. Too loose, and a single purchase becomes a public link. Too tight, and you become unpaid tech support. The goal: casual sharing impractical, legitimate re-downloads painless.

Why per-buyer links change the math

None of this works with a single public URL. If every buyer downloads from the same address, a "limit" means nothing — you can't tell the tenth download by your best customer from the tenth stranger who found the link.

Per-buyer links are what make limits meaningful. On FileFreight, each buyer gets a unique, tokenized download link, and you set the limit and expiry per product. A limit then applies to one person's link, not the product as a whole — and sharing that link spends the sharer's own allowance, which changes the incentives completely.

Downloads to allow, by product type

Real buyers download more than once: phone, then desktop; a dead hard drive; a re-download after an update. A limit of one or two doesn't describe anti-piracy policy; it describes a support queue. Practical starting points:

• Ebooks, PDFs, and documents: 3–5 downloads. One for the device they bought on, one for a second device, one spare for the inevitable lost file. PDFs are also the most-shared format, which is why per-buyer stamping matters more here than raw counts (see below).
• Templates, presets, and design assets: 5 downloads. Buyers reinstall software, rebuild machines, and re-download when they start a new project months later. Slightly more headroom costs little — these buyers rarely share, because the value is in their own workflow.
• Software, plugins, and anything with a license key: 5–10 downloads, and let the key do the real work. The download limit is a backstop; activation is the actual control.
• Large files — video courses, sample libraries, asset packs: 3 downloads. Bandwidth is your cost here, and buyers expect to archive something this size themselves. Say so on the product page.
• Anything free or lead-magnet priced: 2–3 downloads, short expiry. Free products get shared the most and supported the least; nobody's purchase is at stake.

In practice, most buyers download once or twice; the limit is for the tail.

Link lifespan

Expiry fails buyers differently: a buyer who runs out of downloads knows they did something; a buyer whose link quietly expired while the email sat unread just thinks your store is broken.

• Launch products and limited drops: 7–30 days, stated loudly. Short expiry is part of the offer — "download within 30 days" in the product description and the delivery email. Urgency disclosed upfront is fair; urgency discovered at day 31 is a refund request.
• Evergreen products: 30–90 days, or no expiry at all. If the product will still be on sale next year, a short window buys nothing except re-issue requests. This is why FileFreight's Pro plan offers never-expiring links: for evergreen catalogs, the download count does the protective work, and the calendar doesn't need to.
• Free products: 3–7 days. Long enough to catch the email, short enough that a forwarded link goes stale before it travels.

One rule covers most cases: the window should exceed the longest realistic gap between purchase and a buyer reaching the "real" computer — for most audiences, a week, not a day.

The settings only work in pairs

A download limit with no expiry means a shared link keeps working until the count runs out — which, at 5 downloads, might be exactly the five friends it was shared with. Expiry with no limit means anyone holding the link in the window can pull the file fifty times. Together, they bound both the audience and the lifespan of any leak.

For PDFs, add the third leg: per-buyer stamping. FileFreight stamps PDFs with the buyer's identity on first download, so a leaked copy traces back to its source. Buyers share far less when their own name is visibly on the file. Limits control the link; stamping changes the behavior.

Re-issue etiquette: the support policy that prevents chargebacks

Whatever you choose, some real buyers will hit the limits. How you handle that moment decides whether you get a thank-you or a dispute.

1. Re-issue fast, once, without a lecture. A buyer who lost a file is already annoyed. Making them prove they deserve a new link converts a two-minute task into a grievance. Verify the purchase email matches, re-issue, move on.
2. Keep a simple log. Date, buyer, product, reason. Patterns matter more than instances: one buyer re-issuing monthly is sharing; fifty buyers re-issuing once means your settings are too tight.
3. Let the log tune the settings. If re-issues cluster on one product, raise that product's limit instead of fighting the same ticket forever.
4. Have one hard line, stated in advance. For example: links are re-issued for the original buyer, never transferred to a different email "for a friend." A policy on the product page is a rule; the same sentence invented mid-argument is an insult.

Say it upfront

Most limit-related anger is surprise, not the limit itself. Three short lines on the product page prevent nearly all of it: how many downloads they get, how long the link lasts, and what happens when they run out ("email us and we'll re-issue it"). Buyers who read "5 downloads, link good for 90 days, lost files replaced free" rarely complain about any of the three.

FileFreight's settings

Per our homepage: FileFreight gives every buyer a unique, tokenized download link, with per-product download limits and link expiry you set. Free allows up to 25 downloads and 30 days per link; Pro ($19/month, 0% per-sale fees, versus 5% per sale on Free) offers unlimited downloads and never-expiring links. Expired, revoked, or refunded links stop working — and when Stripe reports a refund, download entitlement and any license keys are revoked automatically. For software, a key is issued with every paid order, your app validates it with one call (POST /api/licenses/validate), and you can revoke a key at any time.

The honest caveats, because they decide whether we're the right tool: FileFreight is not a merchant of record — payments run through your own Stripe account, and sales tax and VAT remain your responsibility. There is no automatic importer yet; the first 20 sellers get a free white-glove migration instead, rebuilt by hand within 48 hours. FileFreight is not a Shopify app — every product gets a standalone buy link. And we are delivery-only: no marketplace, no discovery, so buyers have to come from you.

Pick settings honest buyers never notice and sharers hit within a day. For most catalogs, that's 3–5 downloads and 30-plus days. Write the policy on the product page, re-issue without drama, and spend the saved support time on the next product.