Privacy Policy

Updated September 22, 2026

Codec is a self-hosted music player. The app and web player connect to the server you configure. When you use your own server, the Codec developer does not collect your app data: your music, credentials, library and playback activity stay on your device and your server.

Codec has no developer-run account service, advertising, analytics SDKs or tracking. Managed hosting is not part of the current offering. Any future service with different data practices will be described here and in the app's privacy disclosures before it is offered.

Your server and who can access it

When you connect to your own server, music and synchronization information are sent to that server. The Codec developer does not automatically receive a copy. The operator of your chosen server controls its storage, access and backups.

Your server can provide audio and artwork from other media hosts. Requests to those hosts follow the server's configuration and are subject to their operators' privacy practices.

A server can be shared: its operator, other authorized clients and participants in an Aux session can access shared library and playback information. Codec does not make a separate private library for each device connected to the same server. Only connect to a server whose operator you trust.

Information your server uses

• Device and connection information: an app-generated device identifier, a device name, the server address, and authentication or session credentials. These allow the server to recognize connected players and authorize requests.
• Playback and interactions: the current song, playback position and state, queue, recent playback history, playlist source, shuffle and repeat settings, volume state, and synchronization timestamps. These support playback controls and continuity between devices.
• Library content: song metadata, likes, playlists and their order, and audio or cover images you import or upload. A photo selected as playlist artwork is sent to the connected server.
• Operational information: the server records request times, methods, paths, response status, transferred bytes and request duration. Paths can contain song or playlist identifiers. The server and its hosting or network providers also receive the connection information needed to deliver requests, such as an IP address, and may keep their own operational logs.

Your server uses this information for app functionality, access control and troubleshooting. It is not sent to the Codec developer. Codec does not sell personal information or track you across other companies’ apps and websites.

App Review server

A separate server with licensed demonstration music is provided to Apple for App Review. Its address and credentials are supplied in the private review instructions, not bundled into the app. It is not a hosted music service offered to app users. The developer operates this review server and can access the library, device, playback and operational information it receives during testing. Reviewers can email codie@codie.sh with questions or deletion requests.

The project website

The website at codec.codie.sh provides screenshots, documentation and download links. It does not connect to your music server or ask for your server token. It has no analytics scripts or advertising. Its hosting provider receives the connection information needed to serve pages, including IP addresses, and may retain operational logs. Following a download or source link takes you to GitHub.

Information stored on your device

Codec saves connection credentials, preferences, its device identifier, library and artwork caches, and playback state in app or browser storage. The app also stores songs you choose to download so they can play offline. Browser storage includes local storage, IndexedDB and application caches.

Local network permission lets the app reach a server on your network. The system photo picker lets you select a playlist cover; it does not give Codec unrestricted access to your photo library. The visualizer analyzes the music being played and does not record your microphone.

Transport and sharing

HTTPS encrypts the connection to a server that supports it. Codec also supports plain HTTP connections, including local network servers; HTTP does not encrypt credentials or music in transit. Use HTTPS for a server reached over the internet.

Using Aux shares playback controls with participants in that session. A server operator may use hosting, storage or network providers to deliver the service. Opening an external support or source link is subject to that website’s privacy policy.

Retention and deletion

Library content and saved playback information remain on the connected server until they are changed or removed by the server operator or an authorized client. A device disappearing from the active-player list does not erase its saved device information or previous playback commands. There is no single automatic deletion period covering all Codec servers. Log and backup retention depends on the operator and hosting configuration.

In the app, Settings → Disconnect removes the saved server connection and cached library. Downloaded files and other local preferences may remain. Use a song’s Remove Download action to remove its offline copy; deleting the app removes its local app data. For the web interface, your browser’s site-data controls remove locally saved credentials and caches.

Disconnecting, clearing browser storage or removing the app does not delete server data. Deleting a playlist removes that playlist, not the underlying music. Contact the operator of your server about removing server-side content or backups.

Questions and privacy requests

Email codie@codie.sh for support or privacy requests. If you contact us, we receive your email address and the information you choose to send so we can respond. Do not send authentication tokens or music files. For information stored on a self-hosted server, contact that server's operator; the Codec developer cannot access or delete it.

You can also use the Codec support tracker for public bug reports. GitHub issues are public: keep private server addresses and other sensitive information out of your report.

Changes to this policy will be published here with an updated date.