2 of 190 sales refunded and both had downloaded the full export first

One percent refund rate on a digital product is at the low end of normal and you should be pleased with it rather than annoyed. Do the arithmetic on the alternative: if tightening the policy to a case-by-case review costs you even two percent of conversions on 190 sales, you have lost more than the $78, plus the hours you spend arbitrating refund requests, plus the occasional dispute from someone who felt stonewalled — and a dispute costs you a fee on top of the money.

Generous refund policies are usually cheaper than they look precisely because they prevent the expensive outcome.

Keep the policy, revoke on refund, say so in one line at checkout. Two in 190 is not a hole, it is weather.

Disagreeing slightly with the relaxed consensus. Two out of 190 is fine at $39. The reason to fix it now is that the same behaviour at a higher price and higher volume is not two people, it is a pattern that specific communities pass around, and the ones who do this find products by price point.

So yes, keep the friendly policy, but add the revocation clause and add a small amount of telemetry: flag any refund request from an account that completed its main action within an hour of purchase. Not to refuse them, just so you can see the shape of it when the volume is ten times higher.

Practical note on "invalidate the download": use short-lived signed links rather than a permanent URL, and regenerate on each visit. If your links live forever then revoking access only stops the person who did not think to keep the URL, which is not the person you are worried about.

Something small that helped me: I added an optional one-line "what went wrong" box on the refund form. Not required, no barrier, just a text field. About half of people fill it in and the answers turned out to be genuinely useful — two of mine were the same misunderstanding about what the product covered, which was a copy problem on my page rather than a refund problem at all. The deliberate ones leave it blank, which is its own signal.

Depending on where your buyers are, be careful about writing a policy stricter than the consumer rules that apply to them. In some places a buyer of a digital product has a statutory right to cancel unless they explicitly agreed to immediate delivery and waived it at checkout, and a terms page saying otherwise does not override that. The fix is usually a checkbox with the right wording at the point of purchase rather than a paragraph in the terms.