Privacy

What never leaves your device

Your library is yours. The audio files, their tags, the folders they sit in, the artwork, and everything Sonarch works out about them are read and stored on the device that scanned them. So are your play history, playlists, bookmarks, saved positions, genre categories and settings. None of that is sent anywhere unless you turn on Sync, and even then it is a copy — the library itself stays where it is.

The apps contain no analytics, no telemetry, no crash reporting, no advertising identifier and no third-party SDK of any kind. There is nothing counting what you play, and no build of Sonarch reports back that it was launched.

When you connect a cloud account, its credentials are held in the system Keychain and are never sent to us. Sonarch talks to Dropbox, OneDrive, pCloud, a WebDAV share, an S3 bucket or a Subsonic server directly from your device; your files never pass through our servers. What it reads is the folders you pick and the audio files inside them, read on your device to play and to build your library. Anything that does leave your device goes only to the services you connect yourself, described below.

If you create an account

An account is optional. Sonarch plays your library without one, and Pro works signed out on a single device. Four things need one: Sync, and three parts of Pro — saved cloud locations, kept settings and headphone correction profiles — which are not Sync, but are kept on your account so another of your devices can find them.

Signing in uses your email address and a six-digit code — there is no password. We store your email address, an account identifier, and a random per-account value used for the matching described under Sync. Codes themselves are stored only as a hash and expire after ten minutes. We count requests per IP address so that nobody can work through a list of them, but that counting happens in memory and the address is never written down.

Each signed-in device leaves a session record: a device identifier generated on the device, the device name you can see and rename in the app, its platform and app build, when it was last seen, and hashes of its tokens. That is what lets you see your devices and sign any one of them out.

With Pro, each signed-in device keeps a copy of its own settings with your account unless you switch that off, which you can do on each device: its theme and language, how its interface behaves, its audio and playback preferences, whether it fetches lyrics online, which tags it keeps when importing, and its rules for cellular and other limited connections. A device still at its installed defaults keeps nothing. The copy is stored with the device's identifier and platform, and offered under the device's name, so that another of your devices of the same kind can copy it once when you ask it to. Nothing is kept in step afterwards. Switching it off removes that device's copy, and so does deleting your account.

With Pro, a headphone correction profile you import is kept with your account too, so your other devices, of any kind, can offer it: its name, which is usually the model of your headphones, and its filter settings. Deleting the profile on any of your devices removes it from the account, though a device that already took it keeps its own copy, and deleting your account removes them all. Which output uses which profile stays on each device.

Product news by email is off unless you ask for it, and every message carries a one-click unsubscribe link.

We process all of this to provide the account you asked for — in GDPR terms, performance of a contract.

If you turn on Sync

Sync carries what you have done, not what you own: tag corrections, loved tracks, play history, playlists, bookmarks, pinned albums, when a track was added, your changes to the genre categories, and the cloud locations saved on your account. The audio never travels.

For two devices to agree that a FLAC here and an MP3 there are the same recording, each track is identified by a value derived from its tags. That value is salted with a secret belonging to your account, so the same track on a stranger's install produces a different one, and these identifiers cannot be matched from one account to another. That is all the salt does: it hides nothing that is written out in the values below.

A saved cloud location records where it is and what you called it. It never includes the credentials for getting in. Those travel between your own devices only through iCloud Keychain, which is Apple's and end-to-end encrypted, so we never see them. OneDrive is the exception: its sign-in stays on each device, so a new device asks you to sign in to it again, as every provider does when iCloud Keychain is off.

If you send feedback

The message is what you wrote. An email address is optional and is used only to reply — without one we have no way to answer.

Two extras are offered, both off unless you switch them on:

• Diagnostics — app version and build, the channel it was installed from, your OS version, your Mac or iPhone model, your locale, how many artists and albums are in your library, and the current audio output. The whole thing is shown to you in the sheet before it is sent, so nothing in it is a surprise.
• Logs — the last three days of activity. These do include the names of files and folders in your music library, which is what makes them useful for a bug about a specific track. They carry no home folder path and no user name. A report works perfectly well without them.

Screenshots are attached only when you attach them. We answer support on the basis of our legitimate interest in running the app, and a conversation closes automatically after two weeks of silence.

Things you connect to yourself

Some features hand data to a service you chose, and those services have their own policies:

• Cloud storage, S3 buckets, WebDAV and Subsonic servers — your device talks to them directly, using the credentials you gave it.
• Last.fm and ListenBrainz — if you enable scrobbling, what you play is sent to them by your device. Disabling it stops that immediately.
• LRCLIB — a lyrics lookup names the track being looked up. It is not tied to an account and is not sent unless a lookup happens.

Every one of those requests says which app is asking: the name Sonarch, its version, and a link to this site. That is what LRCLIB asks of anyone using it, and it is only decent towards whoever reads the log of a server you pointed us at. It identifies the app and never you.

Buying

Apple is the seller. Purchases and subscriptions go through the App Store, and we never see your card, your billing address or your Apple Account. What reaches us is Apple's signed receipt, which we verify and reduce to three things: which product was bought, Apple's identifier for that transaction, and when it starts and ends. That is the record that tells your devices you have Pro or Sync.

This website

This site sets no cookies and loads no fonts, scripts or trackers from anybody. The one thing it stores in your browser is your light or dark choice, and only if you press the switch. Images are served from our own object storage.

We count how often each page is opened and which site linked to it, as totals per hour kept for ninety days — never who, from where, or on what. No address, browser details or anything else about a visit is kept with those totals.

Our servers keep ordinary operational logs, which can include IP addresses, for as long as it takes them to rotate — they exist to see errors and abuse, and nothing is built on top of them.

Who else touches it

Three companies process data on our behalf, and no others:

• Scaleway — our servers, database, backups and object storage, in Amsterdam, Netherlands, and the transactional email that delivers sign-in codes, from Paris, France.
• Migadu — the @sonarch.app mailboxes, so anything you write to us is held there until we have dealt with it.
• Apple — distribution and payment, under Apple's own terms.

Our servers, database, backups and object storage are all in the European Union. They are administered by one person, from outside it — worth saying plainly rather than leaving to be inferred from where we are. We do not sell data, and there is nobody to sell it to.

How long it is kept

• Account, devices, saved locations, kept settings, correction profiles and synced data — until you delete the account, or sooner for a device's settings when you switch keeping them off, and for a profile when you delete it.
• Sign-in and deletion codes — usable for ten minutes, and the row is removed seven days after it expires.
• Sessions — a signed-out or expired session is removed ninety days later.
• Support conversations — closed after two weeks of inactivity and kept as a record; attachments and logs are deleted after ninety days.
• Backups — the database is backed up daily and a week of those is kept, with superseded copies expiring after thirty days. Something you delete today can survive in a backup for up to a month before it ages out.

Deleting your account

You can delete your account from inside the app, in the account settings. It asks for a code sent to your address, and then removes the account and everything keyed to it — sessions, devices, saved locations, kept settings, correction profiles, the whole sync journal and your purchase records. It is immediate and it is not reversible.

Support conversations are the one exception. A thread stays as a record of a problem that was reported, so a bug does not vanish from our side while it is still being fixed. Your address is removed from it at the same moment — including from any report you sent before you ever signed in.

Deleting the account does not touch your library. The music, the play history and everything else on your devices stay exactly where they are and go on working.

Your rights

You can ask for a copy of what we hold about you, ask us to correct it, ask us to delete it, ask for it in a portable form, or object to a use of it. Write to privacy@sonarch.app and we will answer within a month. Most of it you can do yourself in the app, which is faster.

If you are in the EU or the UK and you think we have handled your data badly, you can complain to your national data protection authority.

Age

Playing music needs no account and collects nothing, so there is nothing here that depends on how old a listener is. An account is a different matter: creating one means you are at least 16, or the lower age your own country sets, which can be anywhere down to 13. If you believe a child has created an account, write to us and we will remove it.

Changes

When this page changes, the date at the top changes with it. If a change actually affects what we do with your data rather than how it is worded, we will say so in the app before it takes effect.

Who we are

Aliaksandr Siamionau is responsible for the data described here.

For anything on this page, and for any request about your data: privacy@sonarch.app. For everything else, support@sonarch.app.