NetMusic Privacy Policy

1. Overview

NetMusic is a local-first music player for iPhone, iPad and Apple TV for personal audio files. The app can connect to storage locations you choose, including Google Drive, OneDrive, Baidu Netdisk, Guangya Drive, Quark Drive, Navidrome, Subsonic, FeiNiu Music, WebDAV, SMB, FTP and Wi-Fi Transfer. NetMusic does not provide a music catalog, public music-sharing platform, advertising system, analytics SDK or developer-operated cloud storage.

Available sources and features vary by platform. Wi-Fi Transfer and the system photo picker are available only on supported devices.

2. Data Processed on Your Device

The app may process storage account configuration, OAuth tokens, server addresses, usernames, passwords, library indexes, file names, paths, file sizes, modification times, artists, albums, genres, playlists, favorites, lyrics, artwork, playback queue, playback state, cache records, downloads and Wi-Fi Transfer files. Sensitive credentials are stored locally using the system Keychain where used. Library metadata, caches and downloads are stored in the app sandbox.

If you select artwork or other images through the system photo picker, NetMusic reads only the items you select. The app may also read app storage size and available disk space so it can show cache/download usage and avoid downloads when storage is low.

Only after you explicitly enable iCloud sync and confirm its disclosure, NetMusic syncs supported source configurations, identifiers or paths for selected files and folders, the credentials described in Section 5, and personal playlists created in the app, including their song references and order, through your private iCloud account.

Song metadata edits (such as title, artist and album) and custom artwork remain on your device and are not synced through iCloud. Audio files, downloads, caches, favorites, playback history, playback state, general settings, device filters, index cursors and server-managed playlists are not uploaded by this feature.

3. Third-Party Services and Local Network Access

When you connect Google Drive, NetMusic requests https://www.googleapis.com/auth/drive.readonly, openid, profile and email. The app uses these permissions to read files you choose from Google Drive and to display the selected Google account in the app.

When you connect OneDrive, NetMusic requests offline_access, Files.Read and User.Read. When you connect Baidu Netdisk, NetMusic uses the provider's basic and netdisk scopes. These sign-ins are optional storage connections and are not used to create a NetMusic account.

When you use WebDAV, SMB, FTP, Navidrome, Subsonic, FeiNiu Music or Wi-Fi Transfer, data is exchanged between your device and the server, computer or browser you choose. FTP is an unencrypted protocol, so it should only be used on trusted networks.

Guangya Drive sign-in

When you connect Guangya Drive, your phone number, SMS verification code and verification-session information are sent directly from your device to Guangya to sign you in. If you use its official sign-in page, Guangya and any human-verification service it uses process the information you enter there. The embedded sign-in browser uses temporary website storage, including cookies, rather than a persistent browser session.

After successful sign-in and account validation, NetMusic stores the issued access token and available refresh token in the system Keychain, and retains expiration information and account details in local app storage. The app reads your Guangya account identifier, nickname and avatar URL to identify and display the connection. Requests to account.guangyapan.com and api.guangyapan.com include a locally stored, randomly generated device identifier and client/request headers for sign-in, security checks, token refresh, account lookup and file access. Signing out clears the local tokens for that connection; the random provider device identifier can remain in app settings. These are optional storage connections, not NetMusic accounts. Credential sync is described in Section 5.

Optional LRCLIB lyrics

LRCLIB is an experimental online lyrics service and is off by default. Only after you enable it in Settings, when existing source, local or embedded lyrics are unavailable, NetMusic may send the song title and artist, plus the album and duration when available, directly over HTTPS to lrclib.net to find lyrics. This can happen during playback, Lock Screen lyrics loading or lyrics downloads. Requests include the app name and version in the User-Agent header, and the service can see the connection IP address. Audio files, artwork, file paths and storage-account credentials are not included in these lyrics requests.

Matched lyrics may be cached on your device. You can disable LRCLIB in Settings at any time; LRCLIB requests stop and cached LRCLIB lyrics are no longer used. The service processes requests under its own terms and policies. See the LRCLIB documentation.

Connecting FeiNiu Music

When you connect FeiNiu Music, NetMusic communicates directly with the NAS or server address you provide. Sign-in requests include your username, a SHA-256 hash of your password and a randomly generated identifier stored locally for that connection.

The password is stored in the system Keychain; the server address, username and connection settings are stored locally. These details are used to authenticate and access your music library, playlists, artwork and lyrics.

Optional ListenBrainz listening history

ListenBrainz is optional and off by default. Connecting an account does not automatically enable submissions. When you connect, your user token is sent directly to ListenBrainz to validate the account and is stored with the account name in this device's Keychain, without iCloud sync. The token also authenticates submissions when sharing is enabled.

Once you enable sharing, NetMusic sends now-playing information and eligible listening records for tracks started after enabling; it does not import existing local history. HTTPS requests include the song title, artist, optional album and duration, playback start time for listening records, and the NetMusic client name and version. The service also receives your connection IP address. Audio files, file paths and storage-server addresses are not included.

ListenBrainz listening history is public. Pending records and their associated account are stored locally for retries.

ListenBrainz processes these requests under its terms of service and the MetaBrainz privacy policy.

ListenBrainz listening statistics

On iPhone and iPad, enabling ListenBrainz also lets Listening Statistics display that account's public weekly, monthly and yearly statistics. These HTTPS requests include the account name but do not attach the user token. Statistics are cached locally for offline display and are not synced through iCloud.

Local listening records are retained; disabling ListenBrainz restores the local statistics view. Switching accounts or disconnecting clears the local remote-statistics cache.

4. What the Developer Receives

NetMusic does not send your files, library, playback history, account credentials, OAuth tokens, storage identifiers or device identifiers to a developer-operated server. NetMusic does not sell personal data, track users across apps or websites, use data for advertising, broker data, perform credit or eligibility decisions, or train AI models with user data.

5. Sharing and Service Providers

NetMusic shares data only as needed for features you intentionally use. For example, OAuth and file requests are sent to the storage provider you connect, and local network traffic is sent to the server or browser you choose. Third-party providers process data under their own terms and privacy policies. NetMusic does not rent or sell your data to advertisers, analytics providers or data brokers.

When you enable iCloud sync and confirm its disclosure, approved content is transferred directly to your private CloudKit database under your Apple Account. WebDAV, SMB, FTP, Navidrome, Subsonic and FeiNiu Music usernames and passwords, plus Baidu Netdisk, Google Drive, OneDrive and Guangya Drive access tokens, available refresh tokens and expiration information, are transferred in encrypted CloudKit record fields bound to the matching source and credential version. Apple TV saves restored credentials in its local system Keychain. Credentials entered or refreshed only on Apple TV are not uploaded through this mechanism.

For Quark Drive, the authorization data transferred in encrypted CloudKit record fields also includes access and refresh tokens, any client token, account and authorization-device identifiers, and token validity and update information. Quark credentials are cached in the local system Keychain and restored on other devices through CloudKit; they are not synchronized through iCloud Keychain.

This credential sync lets your devices signed in to the same Apple Account, including Apple TV, restore the storage connections you authorized and access your music. It does not transfer your cloud-storage account login passwords or upload your audio files to iCloud.

Other supported long-lived credentials, including Guangya Drive tokens, also use iCloud Keychain on platforms that support it. Apple TV receives supported credentials through encrypted CloudKit fields. Access remains subject to authorization validity: Google Drive, OneDrive and Guangya Drive can refresh tokens when supported, while the current Baidu Netdisk login requires reauthorization on iPhone or iPad after expiration, followed by sync. The developer does not operate an intermediary sync server and cannot read this content through a NetMusic server.

6. Google API Services User Data Policy

NetMusic's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is used only for user-visible storage browsing, playback, download/cache, account display and, with your consent, cross-device connection restoration through the iCloud sync described in Section 5, and is not used for advertising, profiling, resale or other undisclosed purposes.

7. Permissions

Local Network access is used to discover and connect to user-configured SMB, WebDAV, FTP, Navidrome, Subsonic and FeiNiu Music services and to provide the Wi-Fi Transfer page on your local network. Background Audio is used so playback can continue while the app is in the background or the device is locked. The photo picker is used only for images you select.

8. Retention, Controls and Deletion

You can remove storage accounts, sign out, clear cache, delete downloads, delete Wi-Fi Transfer files and remove library entries in the app. Removing an account clears local credentials for that connection but does not delete files in the third-party storage service. You can also revoke OAuth access in the relevant provider account settings.

For iCloud sync, you can turn off syncing only on the current device without deleting cloud content, or use the in-app confirmation flow to delete the synced content and sync-enabled Keychain credentials from iCloud. A global deletion keeps music and other local content on the current device. iCloud retains a minimal reset marker that contains no music, sources, credentials, playlists or metadata; it is used only to prevent an older offline device from recreating the deleted data set.

Uninstalling the app removes app sandbox data from the device. Data retained or synced by Keychain and iCloud is also governed by your Apple Account and system settings. Before uninstalling, you can use the in-app global deletion control to remove synced content and credentials.

Turning off sync on Apple TV stops syncing on that device; it does not delete credentials already stored in iCloud. To remove the synced dataset, use the global deletion control in iCloud Sync settings on iPhone or iPad. This includes server passwords and cloud-drive authorization tokens in encrypted CloudKit fields and sync-enabled Keychain credentials, while keeping local music. Apple processes iCloud data under its own privacy policy and your account settings.

Disabling ListenBrainz stops submissions and clears pending records. Disconnecting also removes the locally stored account and token. These actions do not delete public history already held by ListenBrainz; manage or delete that history through ListenBrainz.

NetMusic does not submit Navidrome tracks directly, including downloaded or cached tracks. Any ListenBrainz submission configured on your Navidrome server must be managed separately; NetMusic's switch does not control it.

9. Children

NetMusic is intended for a general audience and is not directed to children. We do not knowingly collect personal information from children.

10. Contact

For privacy questions, support or data deletion assistance, contact the NetMusic maintainer at [email protected].