How a paid file actually reaches the buyer

Your model files are never on a public address, and there is no link to them that could be shared.

What happens:
1. You upload a file. Your browser puts it on a temporary path it is allowed to write and not allowed to read.
2. Turtini's server copies those bytes onto a storage path that no browser can read, under any rule, and strips the shareable download link that normal Firebase uploads carry. That copy step exists for exactly that reason -- a file left where a browser put it keeps a token that would let anyone holding it fetch the bytes regardless of the rules.
3. Only the server knows where the file sits. That record lives in a place no client can read at all.

When somebody wants the file, they press Download in their library. The server checks that they hold the file, and only then mints a link that works for ten minutes and is never written down anywhere. After ten minutes it is dead.

Who gets through the check:
- Someone who bought the listing.
- Someone who claimed it, if it is free.
- You and your colleagues, because it is your org's file -- which is also how you check a draft before publishing it.

Nobody else, including somebody who bought a different listing from you and tries to name this file instead.

A refund does not delete what somebody already downloaded -- nothing can. What it does do is return Turtini's software fee to you, which also happens on a chargeback.