# Paid downloads

> How WooCommerce and Easy Digital Downloads files are kept private, and how to move WooCommerce downloads to a private bucket.

The bucket Safe Media Offload serves your media from is public. So files your shop sells are never copied there:

- WooCommerce's downloadable-product files, in `woocommerce_uploads`
- Easy Digital Downloads' files, in `edd`

They stay on your server, where the shop checks the purchase before serving them.

## Move WooCommerce downloads to a private bucket

To take those files off your server too, add a **Private bucket (optional)**: a second bucket on the same account and keys, with public access off. On R2, that means no `r2.dev` address and no custom domain.

- WooCommerce's files are then copied to the private bucket, and their local copies are always kept.
- After the shop has checked a purchase, the customer gets a link to the file that expires after five minutes. WooCommerce redirects to it rather than streaming the file through your server.
- Until Test connection passes for the current settings, the local copy is served instead.

Easy Digital Downloads' files are copied to the private bucket too, but still served from your server.

Update packages from ZealDen Sell Your Plugins are WooCommerce downloads, so they follow the same path.

## More private folders

The `zdom_private_paths` filter adds folders that must never go to the public bucket.

Checked against ZealDen Safe Media Offload 1.0.3 on main, 19 October 2026.