Legal

Privacy Policy

Last updated: October 21, 2026

Attune is a local, offline-first music player. Your music files stay on your device and are never uploaded to us or to any cloud service. A few anonymous identifiers do reach services we run or use. This page lists each of them: what is sent, to whom, when and why.

What stays on your device

The app keeps these in its own storage on your device and sends none of them to us:

• Music files: scanned and played locally.
• Playlists, favorites and radio favorites: stored locally.
• Listening stats and tuning preferences: stored locally. We never learn what you listen to.
• Settings and preferences: stored locally.
• Libraries and music sources: the folders you chose; for network storage, its address, share, folder and user name; for a music server, its address, user name, the user ID the server assigned, the kind of server and, if you trusted one, the fingerprint of its certificate. Stored locally.
• Passwords and sign-in tokens: the password of network storage or of a Subsonic server, and the sign-in token a Jellyfin server issues, are encrypted with a key held by the Android Keystore and stored in a part of the app's storage that is excluded from every backup. Each is used only to sign in to the storage or server it belongs to. A Jellyfin password is never stored.

Two features of Attune can move this data off the phone, both under your control: the optional Google Drive backup and playback on a computer in your own network. Both are described below. Android's own backup can copy this data as well, if it is turned on in the Android settings: into the backup of your Google account, and onto a new phone when you move to it. Passwords, sign-in tokens, the cache of network storage and music servers and the cover art read from your music are never part of it. Files you imported into Attune never go into the cloud; from Android 12 on they move with a transfer to a new phone.

What reaches our services

• Purchase identifier: Attune uses RevenueCat to check whether Attune Pro is active. RevenueCat issues an anonymous app user ID on first launch and holds the purchase status behind it. The app also attaches two things to this ID: the source of the install as reported by Google Play (for example a link in another Clearpoint Studios app) and the result of the app's own integrity check (whether it was installed from the store and is signed with our key). The payment itself runs through Google Play. We never see your card, your address or your Google account.
• Install identifier and product events: a random ID generated on the device, sent to our analytics service from the first launch on. It travels with anonymous events: the app was opened, the paywall was shown or closed, a plan was selected, a purchase started, succeeded, failed or was cancelled, and the Studio Bundle screen was opened. Each batch also carries the app version, the interface language, the platform, whether Pro is active, the purchase identifier and the install source. The service records the country Cloudflare derives from the connection and does not store your IP address. The events carry no name, no contact detail and nothing about your music or what you listen to.
• Device identifier (hashed), Studio Bundle and invitations: a SHA-256 hash of the Android ID of your phone, sent together with the purchase identifier to our service for the Studio Bundle and invitations. It is sent once after installation, on the first launch, to check whether a Studio Bundle belongs to this device. It is sent again when you tap "Restore purchases", when you redeem a bundle code, when you use an invitation link or code, and when you open the invitation screen to get your own invite code. The hash lets the service give Attune Pro back after a reinstall on the same phone, limits how many devices one bundle code can unlock and prevents one invitation from being redeemed several times from the same device. The Android ID itself never leaves the device. The hash carries no name and no contact detail. On every launch the app also asks this service whether a Studio Bundle is active for your purchase identifier, without the hash.
• Device identifier (hashed), free radio allowance: without Pro, the radio has a daily listening allowance. While you play radio without Pro, the app sends a second, separately salted SHA-256 hash of the Android ID to our radio allowance service, together with the seconds listened since the last report, your time zone offset, a timestamp and the result of the integrity check. This happens before a station starts and every five minutes while it plays. It does not include which station you play. The hash keeps the allowance in place after a reinstall. With Pro the app never contacts this service.
• Support account, messages and notifications: on first launch the app creates an anonymous account on our support backend (Supabase): a random user ID with no email and no name. When you send a message through the in-app support, we receive the text you wrote, the app version, your Android version, the manufacturer and model of your device, the interface language and whether Pro is active. A copy of the message goes to our internal Telegram channel so we notice it quickly, and messages can be translated with Google's Gemini API so we can read and answer in your language. Attune includes Firebase Cloud Messaging so a reply can reach you as a notification. Firebase issues an installation ID and a push token for the app. If notifications are allowed for Attune, the app stores that token, the platform and the language with your anonymous support account. The app asks for the notification permission only after you send your first support message. On Android 12 and older, notifications are allowed by default.

All of this travels over HTTPS. None of it is used for advertising, none is sold, and none is used to track you across apps of other companies. Attune contains no ad network and requests no advertising ID.

Radio

The station catalog comes from the public Radio Browser API (api.radio-browser.info). Your search terms and filters are sent there, and when you start a station the app reports the click to Radio Browser, which counts it for its public popularity ranking. The audio is streamed directly from the station's server, and station logos are loaded from the addresses the stations list. These servers see your IP address, as any website does. We do not receive which stations you play.

Optional cloud backup (Google Drive)

Attune can optionally back up your library data so you can move it to a new device. This is off by default and only happens if you choose to sign in with Google and enable it.

• What is backed up: your playlists and their custom covers, favorites, radio favorites, tuning preferences, listening stats, the lists of tracks you hid or added by hand, your libraries and music sources (including the address, share, folder and user name of a network storage and the address, user name, user ID, kind of server and trusted certificate fingerprint of a music server, never a password or sign-in token), and app settings. The backup also names the device it came from (manufacturer and model) and a random installation ID, so a restore can show which device a backup belongs to. Your music files are never uploaded.
• Where it is stored: in the hidden app-data folder of your own Google Drive. The data goes directly from your device to your Drive. We never receive, see, or store it, and we run no server that holds it.
• Access scope: Attune uses only the restricted drive.appdata scope, which limits it to its own hidden folder. It cannot see or touch any other files in your Google Drive.
• Your account: the email address of the connected Google account is kept on your device only, to show which account is connected.
• Your control: you can turn the backup off at any time and delete it from your Google Drive whenever you like.

Playback on a computer in your network

While Attune is open, it listens on your local network for an Attune app on a computer in the same network. When one asks, the phone answers with its device name (manufacturer and model), a random installation ID and whether Pro is active. With Pro, that computer can then load your library list, cover art and the tracks it plays directly from the phone. This traffic stays inside your local network and never passes through a server of ours. You can switch it off in the settings.

Music from network storage

With Attune Pro you can add network storage (a NAS or a shared folder on a computer) as a music source. While you set it up, the app looks for devices that announce file sharing (SMB) in your local network and lists them. It connects only to the address you choose, using the SMB protocol and the user name and password you enter, or as a guest. Attune then reads the folder list, file names, tags, cover art and audio of the folders you picked. Tracks you play, and the next ones in the queue, are copied into a cache on your phone up to the size you set in the settings, so they start without waiting. This traffic runs between your phone and your network storage and never passes through a server of ours. We never receive the address, the user name, the password or anything stored on the device. Removing the source deletes its tracks from the library, its cache and its saved password.

Music from a media server

With Attune Pro you can add your own music server (Jellyfin or any Subsonic server, such as Navidrome or gonic) as a music source. Attune connects only to the address you enter, in your local network or over the internet, over HTTPS or plain HTTP as that address says. While you set it up, the app asks your local network for Jellyfin servers (a broadcast on UDP port 7359) and lists those that answer. To sign in, a Subsonic server receives your user name and, with every request, a token made from your password and a random salt; a server that does not accept tokens (for example one that checks passwords against LDAP) receives the password itself instead, hex-encoded as the Subsonic API defines it, which is not encryption. A Jellyfin server receives your user name and password once and returns a sign-in token, and Attune keeps only that token. Every request to the server carries the app name and version (and a Subsonic server also receives the app name as its client name); requests to Jellyfin also carry "Android" as the device and a random ID created for this installation, which Jellyfin uses to list the session among your devices. If the server shows a certificate your phone does not trust, Attune asks before it connects and remembers only the fingerprint you confirmed. Attune then reads the track list, tags and cover art of the libraries you picked. Tracks you play, and the next ones in the queue, are copied into the same cache as network storage, up to the size you set in the settings. This traffic runs between your phone and your server and never passes through a server of ours. We never receive the address, the user name, the password, the token or anything stored on the server. Removing the source deletes its tracks from the library, its cache, its cover art and its saved password or token; for Jellyfin the app also signs out of the server, unless another source on the phone uses the same sign-in.

Third-party services

Attune uses the following services:

• Google Play: handles payments and distribution and tells the app once where the install came from. The app may also ask Google Play once a day whether other Clearpoint Studios apps are available, to show working links in the "More apps" list. That request carries no identifier of ours.
• RevenueCat: holds the purchase status behind the anonymous purchase identifier. RevenueCat processes purchase data according to their Privacy Policy.
• Cloudflare: hosts this website and the services we run: analytics, Studio Bundle and invitations, the radio allowance and the relay for support messages.
• Supabase: stores the anonymous support account, your support messages and the push token.
• Google Firebase Cloud Messaging: delivers the notification when we answer a support message.
• Google Gemini API: translates support messages.
• Telegram: carries the internal copy of a support message to us.
• Radio Browser API: provides the station catalog for the Radio feature (api.radio-browser.info).
• Google Sign-In and Google Drive: used only if you enable the optional cloud backup, to sign you in and store the backup in your own Drive. Handled under Google's Privacy Policy.

Permissions

• Storage access: required to scan and play music files on your device.
• Internet access: required for the purchase check, radio streaming, the optional backup, music servers you add and the services listed above.
• Wi-Fi state: required so a computer in your network can find the phone for playback, to find network storage in your network and to keep the Wi-Fi connection active while a track loads from network storage or a music server.
• Notifications: used for the playback controls and to tell you when we answered a support message.

Children's privacy

Attune does not knowingly collect data from children under 13.

Data retention

• On your device: your music library, playlists, favorites, listening stats, tuning preferences, music sources and app settings are kept as long as the app is installed. They are removed when you uninstall the app or clear its data. We never receive a copy.
• Cache, password and token of network storage and music servers: tracks loaded from network storage or a music server stay in the cache until it reaches the size you set, then the oldest go first. The cache and the saved password or token are deleted when you remove the source or uninstall the app.
• Google Drive backup: lives in the hidden app-data folder of your own Google Drive account. You can turn it off and delete it there at any time. We never receive or retain a copy.
• Install identifier and product events: deleted automatically 400 days after they arrive. A scheduled job on the analytics service runs every day and removes everything past that date, including the install record itself once nothing newer has come from it.
• Purchase identifier: held by RevenueCat while the purchase is valid, because restoring Attune Pro on a new phone is what the identifier is for. It goes when you ask us to delete it, and a lifetime purchase you delete cannot be restored afterwards.
• Device identifier (hashed), Studio Bundle and invitations: held by our service until you ask us to delete it, because recognising the phone after a reinstall is what it is for.
• Device identifier (hashed), radio allowance: the service keeps one small record per hash with the day, the seconds used that day and when the hash was last seen. It is held until you ask us to delete it.
• Support messages: an open conversation is kept while it is open. A resolved or closed conversation is deleted automatically 30 days after its last activity. The copy in our internal Telegram channel is deleted on request. The relay that forwards it keeps your IP address for ten minutes to limit how many messages one connection can send.
• Anonymous support account and push token: held until you ask us to delete them.

To have any of this deleted, follow the steps on attune.clearpointstudios.at/delete or write to [email protected].

Changes

We may update this policy from time to time. Changes will be reflected on this page with an updated date.

Contact

If you have questions about this policy, contact us at [email protected].