Privacy Policy

Last updated: August 29, 2026

NaviBeat is a client application for Navidrome and OpenSubsonic-compatible music servers. This policy explains what data the app stores and what, if anything, leaves your device.

What data NaviBeat stores on your device

• Server URL: stored in SwiftData (local device storage) to reconnect automatically at launch.
• Username: stored in SwiftData alongside the server URL.
• Password: stored in the Keychain, never in plain files, and never sent to us. It is protected with kSecAttrAccessibleAfterFirstUnlock. By default it is also marked as syncable, which means it rides iCloud Keychain to your other Apple devices: that is how your Apple Watch inherits the pairing without you typing anything on a watch. iCloud Keychain is end-to-end encrypted by Apple, so neither we nor Apple can read it. If you would rather it never left the device, turn Sync credentials to your other Apple devices off under Settings → Server & Library → Security & Sync on iPhone, and pair each device by hand. An imported mTLS client certificate is never synced at all: it stays on the device it was imported on.
• On the wire, your password is never sent at all. NaviBeat authenticates with a salted hash (Subsonic token auth), so what travels to your server is a token and a salt, not the password.
• Playback history: a local log of which tracks you have played and when, stored in SwiftData. Used to power discovery shelves (Recently Played, On This Day, etc.). Not transmitted to any third party.
• Recent searches: your last 20 search queries on iPhone, iPad and Mac, and the last 10 on Apple TV, stored in UserDefaults. You can clear them in the app, and deleting the app removes them.
• Settings: everything you choose in Settings, from streaming and download quality to theme, accent colour, lyrics, crossfade, ReplayGain, equalizer bands, jump-button lengths and which services you connected, stored in UserDefaults. None of it is a profile of you and none of it leaves the device except where this page says otherwise.
• Spotlight entries (only if you turn them on). Find in Spotlight is off until you switch it on. When you do, NaviBeat writes artist and album names into the system Spotlight index so you can find them from the Home Screen. The default scope is your downloads only; you can widen it to the whole library. Switching it off deletes everything NaviBeat put there.

What leaves your device

• Requests to your Navidrome server only. NaviBeat sends API requests (search, browse, stream) exclusively to the server URL you configure. Your server is under your control.
• Scrobbling (optional). If you enable the “Submit play history” setting, NaviBeat calls your Navidrome server’s scrobble endpoint after each track. NaviBeat itself never scrobbles directly to any external service: if your Navidrome server forwards scrobbles to Last.fm or ListenBrainz, that’s a server-side configuration entirely under your control.
• Last.fm (optional, and only if you connect it). Connecting a Last.fm account means the app talks to Last.fm on your behalf, so here is exactly what that involves.
  • NaviBeat never scrobbles to Last.fm. Your plays go to your own Navidrome server. Last.fm sees them only if you configured your server to forward them, which is a setting on your server, not in this app.
  • What NaviBeat reads from Last.fm: your username, your listening history, your loved tracks, your top artists and tracks, plus public data like listener counts, artist tags and similar artists. This is what powers Listening Stats, Year in Review, Time Machine and the Last.fm shelves.
  • What NaviBeat writes to Last.fm: one thing. When you star a track, it sends a love; when you unstar it, it sends an unlove. That is the whole write surface. It is controlled by Sync favorites with Last.fm, which is on once you connect and which you can switch off, and then NaviBeat writes nothing at all.
  • Not connecting Last.fm means the app never contacts it. Everything else keeps working. See the Last.fm page.
• ListenBrainz (optional, and only if you connect it). Same shape as Last.fm, and the same honesty about it.
  • NaviBeat never submits listens to ListenBrainz. Your plays go to your own Navidrome server, and it forwards them only if you set that up.
  • What NaviBeat reads: your listen count, top artists and recordings, loved recordings, the mixes ListenBrainz builds for you (Weekly Jams and friends), and public data like listener counts and similar artists.
  • What NaviBeat writes: one thing. Starring a track sends a love. Unstarring deliberately does NOT remove it, because a love on ListenBrainz may predate this app and we will not delete something we did not create. Controlled by Sync favorites with ListenBrainz, on once you connect, switchable off.
  • MusicBrainz. To write a love, ListenBrainz needs a MusicBrainz id, so the app may look a track's name up at musicbrainz.org (rate-limited, no account, no token). Nothing about you is sent there beyond the artist and track name being resolved.
  • Use either, both, or neither. See the ListenBrainz page.
• lrclib.net (optional, and off until you switch it on). Lyrics come from your own server first. If your server and its lyrics plugin both come back with nothing, and only if you have turned on the lrclib fallback in Settings, NaviBeat asks lrclib.net for that one song.
  • What is sent: the song’s title, its artist, its album and its length in seconds. That is the whole request. The length is there because it is what keeps a remaster, a live take and a radio edit of the same song apart.
  • What is not sent: anything about you, your server, your account or the rest of your library. lrclib needs no account, no key and no sign-in, so there is nothing to identify you with. If a track has no title or no artist, NaviBeat sends nothing rather than send a useless request.
  • The switch is off in a fresh install. With it off, NaviBeat never contacts lrclib.net at all, and lyrics come only from your own server.
• MusicBrainz and the Cover Art Archive on the Mac (only during a NaviSyncRock sync). When you ask NaviSyncRock to find missing artwork for an iPod, it looks in your own Navidrome first. For albums it cannot match there, it searches musicbrainz.org for the album and artist name and fetches the cover from coverartarchive.org. Both are public, need no account, and are only ever reached because you pressed the button.
• Speakers on your network stay on your network. On iPhone and Mac, NaviBeat can play to a UPnP or DLNA speaker. Finding one and controlling it happens entirely inside your local network, and the address it hands the speaker is your own server’s. Nothing about it reaches us or anyone else.
• Nothing else, and nothing to the developer. NaviBeat contains no analytics SDK, no crash reporter, no advertising framework, and no telemetry. Zero data is sent to us: there is no NaviBeat account and no NaviBeat server for it to go to. Apart from your own server, the outside services above are the complete list, every one of them is off until you turn it on, and every one of them can be turned off again.

Data retention

All data NaviBeat stores lives on your device. Deleting the app deletes all NaviBeat data, including credentials, playback history, and settings. NaviBeat does not store anything server-side.

Children

NaviBeat does not knowingly collect data from children. The app has a 4+ age rating on the App Store.

Changes to this policy

If this policy changes, the updated version will be posted at this URL with a revised “Last updated” date.

Contact

Privacy questions: support@navibeat.app