A digital download sale looks instant from the seller's side: a notification, a payout pending, done. From the buyer's side it is a chain of about a dozen handoffs — payment, confirmation, email, link, file, first open — and every handoff is a place a sale can quietly break. This is that chain, annotated: what happens at each timestamp, what can go wrong there, and the fix to have ready before it does.
T+0 seconds — the payment
The buyer clicks pay. Their card is charged by your payment processor, and the processor — not your delivery tool — decides whether the money is good. That ordering matters: a well-built delivery flow waits for the processor's confirmation before it sends anything.
What can go wrong: the payment succeeds but the confirmation signal back to your delivery system is delayed or lost, so the buyer has paid and nothing moves. Or the opposite: a payment that later fails or is reversed already triggered delivery.
The fix: delivery should key off the processor's confirmed-payment event, never off the buyer reaching a "thanks" page. And keep the confirmation email and the delivery email as separate messages — if delivery stalls, the buyer at least holds proof of purchase, and so do you.
T+5–30 seconds — the delivery email
The buyer is emailed a personal download link: unique to them, tokenized, and set to expire or run out of downloads at limits you chose. This email is the product, as far as most buyers are concerned — lose it and, to them, they bought nothing.
What can go wrong: it lands in spam or Promotions, it goes to a mistyped address, or the buyer's inbox provider delays it by minutes while they refresh and panic. "I never got my download" is the single most common support email in this business, and most of the time the file was delivered fine — the email just wasn't found.
The fix: tell buyers on the confirmation page exactly what is coming, from what sender, and where to look if it isn't in the inbox in two minutes. Send from a domain with its authentication records set up properly. And make re-delivery self-serve or one-click for you — you will do it often enough that digging through dashboards each time is a real cost.
T+1–10 minutes — the first download
The buyer clicks and downloads. If the product is a PDF, this is also when per-buyer stamping usually happens: the copy they receive is marked with their identity, so a leaked file traces back to its source. If the product uses license keys, a key is issued with the paid order at this stage of the flow, ready to paste into the software.
What can go wrong: a partial download on a flaky connection produces a corrupt file the buyer assumes is broken. A large file stalls on mobile data. The buyer downloads on their phone, then can't find the file when they're back at a computer — and concludes the link "doesn't work."
The fix: keep files as small as the product honestly allows, name them like a human (YourProduct-v1.pdf, not final_FINAL2.zip), and set download limits generously enough that a phone download plus a computer download plus one retry never locks out a real buyer. Limits exist to stop link-sharing, not to ration honest use — unlimited or high-count limits with link expiry usually punish sharers more precisely than tight click counts punish everyone.
Day 1 — the support-risk window
Almost everything that will go wrong with a sale goes wrong in the first 24 hours: the email not found, the file that won't open because the buyer lacks the right app, the license key pasted with a trailing space and rejected, the purchase made on a work device the buyer can't install software on.
What can go wrong: a small confusion hardens into a dispute because the buyer couldn't reach anyone while they were frustrated. Silence, not the glitch, is what turns a fixable problem into a refund demand or a chargeback.
The fix: the answers to the five most common day-1 problems should already be written — a short recovery note with a fresh link beats a long apology. Answer fast with the fix first and the explanation second. Every day-1 exchange is also data: two buyers hitting the same snag in a week means the snag is in your setup, not in the buyers.
Days 2–3 — the refund path
Sometimes the right answer is a refund: the buyer bought the wrong product, it genuinely doesn't fit their setup, or the troubleshooting honestly ran out. Here the mechanics matter more than the money.
What can go wrong: the refund goes through at the processor, but the buyer's download link and license key stay live — you've returned the money and kept delivering the product. Or the reverse bookkeeping error: access revoked for a buyer whose refund was never completed.
The fix: connect the two systems. When the processor reports a refund, the buyer's download entitlement and any license keys should be revoked automatically, and expired, revoked, or refunded links should simply stop working. Be honest with yourself about the limit, though: a refund can revoke access, but it cannot un-download a file already saved. That's what per-buyer stamping is for — not prevention, but traceability. And refund graciously when it's your flow that failed; a buyer refunded without a fight rarely escalates to a chargeback, which costs more in every currency.
Day 7 — the follow-up
A week out, the sale is either settled or a lesson. This is the moment most sellers skip, and it's the cheapest growth work in the whole timeline: one short follow-up email. Did the file open? Did they get what they expected? Is anything missing? Buyers who hit a silent problem on day 2 and never wrote to you are still out there; a day-7 check-in surfaces them while a fix — or a graceful refund — is still possible.
What can go wrong: nothing new breaks at day 7; the risk is informational. If you're not looking at the week's deliveries, expiries, revocations, and support themes together, you'll keep fixing the same break one buyer at a time.
The fix: once a week, skim the tally. Which timestamp produced your support emails? Email-not-found points at deliverability and confirmation-page wording. Corrupt-file reports point at file size and format. Key rejections point at your install instructions. The timeline is a diagnostic: every complaint belongs to a timestamp, and the timestamp tells you what to repair.
Closing note — where one tool fits this timeline: FileFreight is a delivery-only tool built around exactly these handoffs: after your own Stripe account confirms payment, the buyer is emailed a unique tokenized download link (you set the limits and expiry — up to 25 downloads and 30 days on the free plan, unlimited and never-expiring on Pro), PDFs are stamped per-buyer on first download, a license key is issued with every paid order when enabled (validatable by API, revocable anytime), and a Stripe refund automatically revokes the buyer's entitlement and keys. Files up to 500 MB per product; payments settle straight into your Stripe account and are never held by the tool. Pro is $19/month with 0% per-sale fees; the free plan is 5% per sale. The honest caveats: it is NOT a merchant of record and does not handle sales tax or VAT — that stays with you; there is no automatic importer (the first 20 sellers get a free white-glove migration, products and keys rebuilt by hand within 48 hours); it is not a Shopify app — every product gets a standalone buy link; it is delivery-only, with no marketplace or discovery; and it is new and small, which is exactly why this timeline is written as tool-agnostic advice first.
