Skip to content
Synara
Synara

Privacy policy

Last updated: 2026-10-27

Synara is a client application for self-hosted Synara media servers. This policy describes what data the Synara apps (iOS, iPadOS, watchOS, tvOS, macOS, Android, and the desktop app for Linux, Windows and macOS, including CarPlay, widgets, the share extension and the Android live wallpaper) process and where it goes.

This website

  • This website has no analytics, no ads and no cookies.
  • It stores your theme choice (synara-theme, in localStorage) and, on the download page, a 10-minute cache of release info (in sessionStorage). Neither leaves your device.
  • The download page asks api.github.com for release info.
  • The share page (/share/) makes requests from your browser to look up the song, album or artist in a share link:
    • It sends only the ISRC or UPC to linkresolver.synara.audio (Synara's link resolver).
    • It sends the title and artist, or the ISRC/UPC, to itunes.apple.com.
    • It sends the MusicBrainz ID to musicbrainz.org, only when the resolver found no links.
    • It loads cover art from the image host the lookup returns, such as Apple's CDN.
    • Like any web request, these include your IP address.
  • The song details are part of the share link itself, so they are included when your browser loads the page.
  • The site is hosted on GitHub Pages, which may process your IP address in its server logs under GitHub's own privacy policy.

Summary

  • Synara does not collect analytics, does not show ads, and does not track you across apps or websites.
  • The app communicates with the media server you configure. Your server's operator controls all data stored on that server.
  • Your account data, listening history, and library content are stored on your own media server, not by the developer of Synara. The apps never send anything to the developer, apart from the song identifier and your IP address reaching Synara's link resolver when you open a share page.

Data stored on your device

  • Server address and credentials: the host, port and login you enter are stored on the device so you stay signed in.
    • On Apple platforms, the session token and any scrobbling credentials (ListenBrainz, Last.fm) are stored in the system Keychain.
    • On Android and desktop they are stored in the app's private settings. On Android this storage is included in Android's own device backup and transfer.
  • Library cache: metadata (songs, albums, artists, playlists, cover art) fetched from your server is cached locally for performance and offline use. On Apple platforms, library items are also added to the on-device Spotlight index.
  • Offline downloads: songs you choose to download are stored in the app's private storage. On macOS you can choose to also show them in your Music folder, and on Android they can be opened from the system Files app.
  • Listening statistics: recent plays are buffered locally and sent to your own server. They are also shown in widgets via a shared app group container on your device, and on Apple Watch via the watch's own connection to your server and your iPhone.
  • Settings: playback, appearance and sync preferences.

Signing out removes your server session. Scrobbling credentials stay configured until you remove them in Settings. The cached library, downloads and settings stay on the device until you delete the app. Deleting the app removes its containers. On macOS you can also use "Clear data" in Settings. On Apple platforms, sign out before deleting the app if you also want the Keychain entry removed, as the system may keep Keychain items after an app is deleted.

Data sent to your media server

Everything you do in the app (browsing, playing, searching, creating playlists, downloading, listening history) is exchanged with the Synara server you configured. Podcast episodes are also played through your server. Synara the app does not operate that server. Refer to your server operator for how it handles your data.

  • Settings sync (optional): if you turn it on, your app preferences are stored on your server so your devices match. Scrobbling credentials are only included if you also turn on secrets sync and set a passphrase. They are encrypted on your device with that passphrase before upload.
  • ListenBrainz account link (optional): if you link a ListenBrainz account to your server, your ListenBrainz username (and token, if you enter one) is stored on your server, which then imports your ListenBrainz listens.
  • Server-side link resolver (operator option): if your server's operator enables it, the server can send track and album identifiers and streaming links to Synara's link resolver (linkresolver.synara.audio) to find matching streaming links.

Third-party services

The following connections are only made when you enable or use the corresponding feature:

  • MusicBrainz (musicbrainz.org) and Cover Art Archive (coverartarchive.org): used to look up recordings, releases and artwork. This happens when you:
    • use the metadata or importer tools
    • create or open a share link
    • play tracks while ListenBrainz scrobbling is on, to identify them

    Requests contain search terms (title, artist, album) or identifiers (MusicBrainz ID, ISRC, barcode), plus the app name and version as a User-Agent.

  • ListenBrainz (api.listenbrainz.org): if you enable ListenBrainz scrobbling and enter your own user token, the tracks you play (artist, title, album, duration, MusicBrainz IDs, time) and what is playing now are submitted to your ListenBrainz account.
  • Last.fm (ws.audioscrobbler.com): if you enable Last.fm scrobbling, you enter your own API key and shared secret, and your Last.fm username and password are sent to Last.fm once to get a session. The tracks you play (artist, title, album, time) and what is playing now are then submitted to your Last.fm account.
  • Importer search: cover images in search results load directly from the music service that provides them.
  • synara.audio: share links you create point to https://synara.audio/share… and redirect back into the app. A share link contains the title, artists, duration and identifiers (ISRC, barcode, MusicBrainz ID) of what you share, and nothing about you or your server. Opening a share link sends nothing to the developer apart from the song identifier and your IP address reaching Synara's link resolver. See "This website" above for the lookups the share page makes.
  • Discord (desktop app, off by default): if you turn on Discord rich presence, the current track is sent to the Discord client running on your computer, which shows it on your Discord profile. This includes the title, artist, album and playback time, plus a cover image link if your server has an image cache configured.
  • Google ML Kit (Android app): the barcode scanner uses Google's ML Kit, which reads the barcode on your device. Camera images are not uploaded. Google's SDK may send anonymous usage and performance metrics to Google.

You can disable scrobbling at any time in Settings.

GitHub (Android app): the app checks github.com once a day for updates by reading release metadata. You can change this or turn it off in Settings. The crash screen also checks for a newer version. An update APK is downloaded only when you choose to install it.

Apple TV and Apple Watch sign-in

When you use the iPhone app to sign in an Apple TV, the phone creates a new session for your account on your media server and transfers it to the Apple TV over the local network. This only happens after you explicitly confirm the request on the iPhone. The Apple TV then talks to your media server directly.

If the Synara Watch app is installed, your iPhone creates a session for it on your media server and sends it to the watch through Apple's watch connection.

Device permissions

On Apple platforms, permissions are requested only when you use the related feature. On Android, notifications and local network access are requested when the app first starts.

  • Local network / Bonjour: to discover and connect to Synara servers on your network.
  • Camera: to scan barcodes when importing physical albums.
  • Photo library (add only): to save generated album mosaics.
  • Calendar (full access, iOS and macOS, optional): if you turn on Release Calendar, Synara:
    • creates its own "Synara Releases" calendar
    • adds your server's upcoming releases to it and refreshes it daily in the background
    • removes releases that are no longer upcoming

    It only looks at other calendars to find a Synara calendar it created earlier, and nothing from your calendars is sent anywhere. Turning the feature off deletes the Synara calendar. Without it, "Add to Calendar" opens the system event editor, nothing is added unless you save the event there, and no calendar access is needed.

  • Notifications: for listening recaps and, on Android, download, sync and update notices. No push notification server is used.
  • Background audio / background refresh: for uninterrupted playback, downloads, keeping your library in sync, recaps and, if you turned it on, the release calendar.
  • Install apps (Android): to install updates you download.
  • Music folder (macOS): only if you choose to show downloads in your Music folder.

Children

Synara is not directed at children under 13 and does not knowingly collect data from them.

Changes

Updates to this policy are published in the app repository and at the URL where this policy is hosted.

Contact

Questions about this policy can be sent through the project's GitHub repository: github.com/dertyp7214/synara