PRIVACY.md

74 lines · 8.6 KB

Changed in: 0.5.0

1	# Privacy
2
3	Earhorn Music for GNU/Linux makes the network requests its features need, and this page lists every one. There are no analytics, no crash reporting, no telemetry, no usage statistics, no third-party tracking, no "phone home" — auditable: the source is published at [faveat.software/earhorn](https://faveat.software/earhorn/browse/) under GPLv3+, you can read every line and confirm.
4
5	## What Earhorn sends, ever
6
7	### To your LAN
8
9	- SSDP multicast on UDP port 1900. Standard UPnP/DLNA discovery — broadcasts a `M-SEARCH` packet to find servers and renderers on your local network. The packet contains no personal information, no device identifier beyond what UPnP standards require.
10	- mDNS on UDP port 5353. Chromecast discovery, started at every launch. The mDNS library may also announce this computer's host name on the LAN, as mDNS clients usually do.
11	- HTTP to your UPnP server. Browse and search requests, track streams (your audio data), album art, a sibling `.lrc` lyrics file next to a track, sibling `.txt` album notes, and small byte-range reads of a track when you ask to see its tags. Whatever your server hosts.
12	- HTTP to UPnP renderers you pick. When you choose a remote UPnP renderer (a UPnP-aware speaker or receiver) as the output, Earhorn sends it `SetAVTransportURI`, `Play`, `Pause`, `Seek` and similar commands, and subscribes to its status events. The renderer then fetches the stream from your server itself.
13	- TLS to Cast devices on TCP port 8009. Only when you cast to, or follow, a Chromecast or Cast speaker group. Casting hands the device the stream addresses of the tracks you queue (your server's URLs, or for a speaker group a temporary address on this computer — see below); following sends the play/pause/seek/volume commands you press.
14	- musicnow status requests. While you follow a Cast device and a musicnow address is set, Earhorn sends an HTTP `GET` to that address about every 12 seconds, carrying the followed device's name, to show which song a radio station is playing. The address field in Settings is empty by default, so nothing is sent until you enter one; clear it to turn this off again. The requests pause after a few "no station" answers and start again when what is playing changes. The answer can set the title, artist and cover-art address Earhorn shows.
15
16	These normally stay on your local network. The exceptions are addresses that point off your LAN — for example an internet radio entry in your library, or a musicnow address you type in that is on the internet.
17
18	### To the public internet
19
20	- HTTPS to `lrclib.net` for time-synced lyrics. On by default; turn it off with Settings → Lyrics → Allow external service calls. A lookup is made when the lyrics view is open for the playing track — including a track you are following on a Cast device — and when you press Refresh. Earhorn may try up to four spellings of the title (for example without "(2009 Remaster)") until one matches. Each request sends:
21	- Track title
22	- Track artist
23	- Track album
24	- Track duration (in seconds; left out on Refresh)
25	- A User-Agent naming the app: `Earhorn Music Player (https://faveat.software)`
26
27	No account, no API key, no device identifier. lrclib.net's own privacy practices govern what they do with that data; see their site for details. Answers are cached on disk (see below), so reopening lyrics for the same track does not ask again.
28	- Artwork addresses supplied by others. When you follow a Cast device, the cover-art address is whatever the app that started the music published — often a Google, Spotify or similar server on the internet — and Earhorn fetches that image to show it. It also passes the address to your desktop's media indicator (MPRIS), which may fetch it too. The same goes for cover art in a musicnow answer, and in the metadata a phone or other control point sends when it plays to Earhorn as a renderer (LAN broadcast, off by default).
29	- Lyrics files beside internet streams. If a track's stream address is not on your LAN, the sibling `.lrc` is only asked for when external calls are allowed (the same switch as LRCLIB).
30
31	That is the entire outbound network footprint of Earhorn Music for GNU/Linux.
32
33	### Listening on your network
34
35	- A UPnP HTTP port, always while Earhorn runs, on the interface Earhorn picks as your LAN (if it cannot tell which one that is, on all of them). Renderers and the UPnP stack use it to deliver status events. The port number is kept in `~/.local/share/earhorn/upnp.port` so it stays the same between launches (which keeps firewall rules simple).
36	- A temporary stream proxy, only while casting to a Cast speaker group. It serves only the addresses Earhorn handed to the group, each behind a random token; anything else is refused.
37	- A UPnP MediaRenderer, only if you turn on Settings → LAN broadcast (off by default). It announces itself on the LAN and any device on your network can control it without a password: start, stop and change what plays, and see what is playing. It plays only `http`/`https` addresses on other machines — not local files, devices or services on this computer. Turn it on only on a network you trust.
38
39	Earhorn also talks to your desktop's media indicator over the local D-Bus session bus (MPRIS). That never leaves the computer.
40
41	## What Earhorn does NOT send
42
43	- No analytics. There is no analytics SDK, no Google Analytics, no Matomo, no anything.
44	- No crash reports. There is no Bugsnag, Sentry, Crashlytics, or equivalent. When something goes wrong, the stack trace prints to your terminal's stderr and that is the only place it goes.
45	- No advertising IDs, no installation IDs, no device fingerprints.
46	- No account system, no login, no email collection.
47	- No "check for updates" — Earhorn does not phone home to check for new versions. You install updates through whatever distribution path you used (`.deb` upgrade, AppImage replacement, source rebuild).
48	- No third-party SDKs that ship background telemetry. The dependency list is in [`gradle/libs.versions.toml`](gradle/libs.versions.toml); inspect it.
49
50	## Local data Earhorn stores
51
52	On your filesystem, Earhorn writes (the `XDG_CONFIG_HOME`, `XDG_DATA_HOME` and `XDG_CACHE_HOME` variables are honoured if set):
53
54	- Preferences — `~/.config/earhorn/config.properties`, a plain Java properties file: your server, output and followed-device choices, volume, ReplayGain, lyrics offset, the external-calls switch, LAN-broadcast name, the musicnow address and display options.
55	- Last session — `~/.local/share/earhorn/session.json`: the queue (track details and stream addresses) and the position, so Earhorn can pick up where you left off.
56	- UPnP port — `~/.local/share/earhorn/upnp.port` (see above).
57	- Playlists saved to the library — `~/.local/share/earhorn/playlists/.m3u`. Playlists you Save As…* go wherever you choose. Both hold titles, stream addresses and cover-art addresses.
58	- Album art cache — `~/.cache/earhorn/images/`, up to 256 MB.
59	- Lyrics cache — `~/.cache/earhorn/lyrics/`, one small file per track looked up (kept 7 days when lyrics were found, 24 hours when not).
60	- Lyrics exports — `~/.cache/earhorn/lyrics-export/`, an `.lrc` file named after the artist and title of each track whose lyrics were found. These are kept until you delete them; Earhorn reads them back before asking the network, and you can copy them next to your music files. Together with the lyrics cache, this amounts to a list of tracks you opened lyrics for.
61
62	The `earhorn` folders are created readable by your user only (mode 0700), and the preferences and session files are 0600. Nothing here is transmitted. You can delete any of it at any time; you lose only those preferences, the resume point, or cached data.
63
64	## Auditing
65
66	Earhorn is GPLv3+ and the entire source tree is published at [faveat.software/earhorn](https://faveat.software/earhorn/browse/), with a download of every release. Network calls are easy to audit — search for `URL(`, `URI(`, `okhttp`, `HttpURLConnection`, `connect(`, `socket(`, `send(`, or `multicast` in the source tree. If you find one this document doesn't account for, that's a bug — please report it.
67
68	## Changes to this policy
69
70	Versioned with the source like everything else. Each release's copy is at [faveat.software/earhorn](https://faveat.software/earhorn/browse/history.html).
71
72	---
73
74	Earhorn is a Faveat Software project. For privacy practices of the broader project family, see [faveat.software](https://faveat.software).