Privacy

Microphone and audio

While listening is on, Life Music turns on the microphone for a few seconds, every 15 seconds to a few minutes depending on what it hears, also when the app is closed or the screen is off, to check whether music is playing. A notification is always shown while listening is on, and you can pause or stop from it or from the app. After the phone restarts, listening stays off until you open the app.

Your audio stays on the phone. The sound is processed only in the phone's memory and discarded within seconds. It is never written to storage, logs, caches or crash reports, and never sent anywhere: not to us and not to anyone else. There is no setting, debug option or diagnostics feature that saves or uploads audio.

Recognising songs

First, a small model on the phone checks whether the sound is music. Only then does the app compute a song fingerprint on the phone: a compact signature, not a recording, from which the sound (including speech) can't be rebuilt. That fingerprint is sent to a music recognition service to find out which song it is.

The recognition services the app uses are ShazamKit (run by Apple) and ACRCloud. The service receives the fingerprint and the IP address the request comes from. Your location is never sent to them, and neither is your account.

Planned Recognition will go through our own server, and only for a signed-in account with a verified email address. For ACRCloud, the fingerprint passes through our server, which forwards it without any user or device identifiers and holds it in memory for that one request: it is never stored or logged. ACRCloud then sees our server's IP address instead of yours. For ShazamKit, the phone keeps sending the signature to Apple directly, using a short-lived access token from our server, so Apple still sees your phone's IP address.

Planned Our server will count recognitions per account and day (provider, outcome and date only: no songs, places or fingerprints), to apply a daily limit. When our server can't be reached, the phone may hold up to 7 days of pending fingerprints. Each one's fingerprint and location are encrypted on the phone; only its capture time and the provider kind are stored unencrypted, to order and expire the entries. Each is deleted right after it has been tried. They are never synced, and are deleted on sign-out, account deletion, "Delete local data" and a change of server; deleting a date range also deletes the pending entries captured in it. Pausing or stopping listening keeps them.

Location

If you allow location, Life Music takes your position only when a song is identified, so the song can be shown on your map. It does not track where you go in between, never asks for background location, and never uses location when listening is off. The app asks for location "while using the app"; you can allow precise or approximate location.

With each song it stores the coordinates, their accuracy and the time of the fix. On the phone only, it also keeps the speed the phone reported with that same fix, to tell trips apart; the speed is never synced.

Planned While our server can't be reached, the position may also be taken for music that hasn't been identified yet, and kept only inside the encrypted pending entry described above. If that entry turns out to be no match, its position is deleted with it.

Physical activity (optional)

If you allow physical activity, the phone tells Life Music when it was in a vehicle, on a bike, walking, running or still while listening is running, to show trips between songs. Only the kind of activity and its times are kept, on this phone only, for up to 90 days. They hold no location and no audio, are never sent to our server or anyone else, and "Delete local data" removes them.

Music played on the phone (optional)

With notification access, Life Music can also note the title and artist of music playing in apps on the phone. It uses that access only to read what's playing.

What stays on your phone

• The songs identified, with time and place, and simple listening statistics. No audio.
• Place names worked out for those places (see "Place names" below), the activity log and fix speeds described above.
• Your profile: the name or nickname you pick, your avatar and trip icons.
• Diagnostics: statistics about each listening check (sound levels, the model's scores and top label, recognition outcomes, timings), the service's starts and stops, and battery level samples. Never audio, songs or locations. They are kept for 14 days, and you can export or clear them from the Diagnostics screen.

All of it is in the app's private storage and excluded from cloud backup and device transfer.

What our server keeps

The server receives metadata, never audio. Everything below except crash reports reaches it only when you sign in to sync.

• Your account: your email address and a password hash (Argon2id; we never see or store your password itself), your devices and their sign-in sessions.
• Your history: for each listen, the song (title, artist, album, ISRC, the provider's track ID, the artwork link and links such as the Apple Music page), whether it was heard nearby or played on the phone, the recognition provider and its confidence, the start, last-heard and end times, the place (coordinates and their accuracy), and the random ID of the device that heard it. This is what lets you keep years of history across phones. It is kept until you delete it. Place names and fix speeds are not sent.
• Your profile: name or nickname, avatar and trip icons, so your other phones show the same. Some avatars can hint at religion or skin tone; they are kept and deleted like the rest of your account.
• Crash reports, only if you turn them on ("Send crash reports" in Settings; off by default in the released app, on in test builds). These are sent whether or not you are signed in, and aren't linked to your account: app and Android version, device model, the type of error and where in the code it happened, and a short code (hash) identifying the app's settings. Never audio, location, song titles, logs or account data, and no account, device ID or IP address is stored with them. They are deleted after 90 days.
• Wrong-code locks: if too many wrong verification codes are entered for an email address, the server locks codes for that address (for 1 hour, then 5 hours, then 24 hours on each further wrong code) and keeps a record of it: a hash of the address (not the address itself, but anyone holding the server's database or a backup could check whether it matches an address they guess), when the current lock ends and how many locks there have been. It is kept with no time limit, until a right code is entered for that address or the account with that address is deleted, and it isn't in the account export, because it belongs to the address, not to an account. It can exist for someone who has never used Life Music, if someone else typed their address; they can clear it by creating an account with that address and entering the code we mail them.
• Planned Whether your email address is verified, pending registrations (deleted once used or after 24 hours), verification codes (stored hashed, deleted once used or expired), and, if you sign in with Google, your Google account ID and the email Google reported.

The server doesn't log request contents, passwords, tokens or coordinates.

Other services that see something

Music recognition (Apple ShazamKit, ACRCloud)

A song fingerprint and an IP address, as described under "Recognising songs". Never your location.

Map tiles (OpenFreeMap)

When you look at the map, the phone downloads map tiles for the area on screen. The tile service sees your IP address and which area you're looking at. No account, device or song data goes into these requests.

Place names (your phone's geocoder)

To turn a place into a short name, the app uses the phone's built-in geocoder. Only the centre of the place's area (a grid square of about 100 m) is looked up, and on some phones the geocoder sends that position to Google. Each area is looked up about once, and again after up to 180 days (14 days if no name was found); a lookup that failed, for example offline, is tried again later. Place names stay on the phone. Turn off "Show place names" in Settings to show coordinates only.

Song artwork (Apple's artwork servers)

To show a cover, the phone downloads it over HTTPS from Apple's artwork servers (mzstatic.com), and from nowhere else. Apple sees your IP address and which cover was requested; no account, device or song-history data, cookies or sign-in are sent. Covers are kept in memory only, never saved.

Missing artwork lookup (Apple's iTunes Search, from our server)

For songs without a cover, our server, not your phone, asks the iTunes Search API. Apple sees our server's IP address, the title and artist, and when the request was made, which is usually within about 10 minutes of the listen. No user, device or place is sent. A song with no match is looked up again about every 30 days while it is in someone's history.

Planned Email (Brevo)

To confirm your email address, our server sends a 6-digit code through Brevo. Brevo sees your email address and the text of the mail. The mail has no tracking pixels or tracked links, and no listening data.

Planned Sign in with Google

If you choose it, Google confirms your identity to our server (your Google account ID, email and basic profile). We ask for nothing beyond sign-in and keep no Google access tokens.

Your controls and deletion

• Pause or stop listening at any time, from the notification or the app.
• Delete a song or a whole day from your timeline. On a synced account, the deletion reaches the server and your other phones.
• Export your data: the songs on the phone, with time and place, as JSON and CSV.
• Planned Export your account from our server, with everything it holds, from the app. Our server can already produce this export; until the app offers it, ask for it (see "Still to be filled in" for the contact).
• Delete local data: removes every song, place name, the activity log and your name and avatar from this phone and signs it out. It keeps this phone's random device ID, your settings (including the trip icons and the place-name switch), the daily recognition counter and the diagnostics, which have their own Clear button. Nothing on the server is touched.
• Delete account: deletes your account, its whole history, profile and devices from our server, then everything on the phone.

When you delete your account, your data is removed from our database immediately and from our encrypted backups within 30 days.

Otherwise your history is kept for as long as you keep it: years of history are what the app is for.

How it's protected

• Everything between the app and our server travels over TLS; the app allows no unencrypted connections.
• The server's backups are encrypted, and its database is reachable only from the server's own API.
• Planned The server's disk itself encrypted (to be confirmed for the server in use; see "Still to be filled in").
• Life Music collects no contacts and no continuous location tracks.

This website

This site sets no cookies, runs no analytics and loads nothing from other websites: fonts and images are served from the site itself. It is hosted on Cloudflare Pages, so Cloudflare sees visitors' IP addresses and keeps request logs, as any web host does.

Still to be filled in

For the owner, before this page goes live as the app's privacy policy:

• Who runs Life Music, and a contact address for privacy questions and requests.
• The legal basis for processing, and where the server is hosted.
• Whether the server's disk or volume is encrypted (a provisioning step, not yet confirmed).
• The effective date and how changes are announced.
• Each recognition provider's own retention of fingerprints and request logs (not yet reviewed).