Privacy Policy

Overview

Meringo is a local-first music player published by Meringo Labs LLC. I do not operate servers that collect your personal data. I do not run analytics pipelines. I built Meringo because I wanted a more refined, high-fidelity way to experience a music library — not to harvest data.

This policy describes what minimal data interactions the application has, and exactly why they exist.

What We Collect

Meringo collects no personal data on my servers. On your device, the app stores:

• Your music library metadata (artist, album, track, file path) in a local Room/SQLite database
• Your Jellyfin and Subsonic / OpenSubsonic sign-in tokens, encrypted on-device using Android Keystore
• Each server's address and your username for it, in the app's private DataStore (not encrypted)
• Your listening preferences and non-sensitive app settings in the app's private DataStore (no passwords or tokens are kept here)
• Cached artwork and editorial metadata fetched from public APIs

None of this data is transmitted for advertising or tracking purposes. When crash reporting is enabled (off by default; opt in on the first-run screen), error reports may be sent to Sentry, tagged with a random ID created for your install — see the Crash Reporting section below.

Acoustic Fingerprints Stay on Your Device

Meringo fingerprints your music: a compact acoustic signature of each track, computed from the sound itself using a fingerprinting library (libchromaprint) bundled inside the app. It is a mathematical representation of the audio signal — not an audio recording, and not something you can listen back to.

No fingerprint is sent anywhere, and there is no setting that would send one. The work happens entirely on your device, and its results stay there: finding tracks that resemble the one playing, and spotting duplicate rips of the same recording across your library and your server.

Earlier releases offered an optional lookup that submitted a fingerprint to the AcoustID web service to identify badly-tagged files. That feature has been removed, along with its setting. Album identity now comes from MusicBrainz alone, queried by album title and album-artist name — described under Third-Party Services below.

Crash Reporting

Meringo uses Sentry (sentry.io) for crash and error reporting. This helps me identify and fix stability problems without you having to file a bug report manually.

Crash reports are opt-in. New installs see a consent toggle on the first-run screen (off by default); until the user makes a choice and taps a Connect button, Sentry is held in a no-op state and zero crash data leaves the device. The same toggle is available afterwards under Settings → Privacy → Crash reporting. Disabling it at any time stops Sentry from running for the remainder of the session; it will not be started on the next launch either.

Existing installs from before this consent flow (where the user had already completed onboarding under the previous default-on behavior) are treated as having implicitly consented and keep their existing crash-reporting preference. The toggle remains available to flip off whenever they like.

A crash report contains:

• The exception type, message, and stack trace
• Device model and Android OS version
• App version and build environment (debug / production)
• Recent navigation breadcrumbs (screen names only)
• A random ID created for your install (Meringo does not attach your IP address)

Crash reports do not contain your music library, file paths, server credentials, listening history, or any content from your device. Known authentication parameters in server URLs — Jellyfin api_key, OpenSubsonic apiKey, and the Subsonic legacy auth quartet (t, s, u, p) — are redacted from any URL captured in a crash report before it is transmitted.

When crash reporting is enabled, Meringo also reports release-health signals to Sentry — session start/stop events (used to compute crash-free-session and crash-free-user rates) and ANR (app-not-responding) events. They carry the same random install ID, and follow the same opt-in and redaction rules as the crash reports above.

Sentry's own privacy policy is available at sentry.io/privacy.

Third-Party Services

Meringo integrates with the following public, read-only APIs to provide editorial content:

• Google Play — first, because it happens first. Meringo is free to install with a one-time unlock, and an app sold that way has to ask Google whether you bought it: at every launch, before any consent screen renders, the app connects to Google Play's billing service through the Play Store on your device to check the purchase. Google's billing library also brings along a Google upload component (com.google.android.datatransport) — a small database and a scheduled upload job in the app's own data directory that batch Google's delivery telemetry back to Google. It arrives transitively with the Play libraries; it is Google's plumbing, not Meringo tracking your listening — and it is named here because it exists, not because we chose it. Meringo also uses Google Play's In-App Review API, which asks Play to show its rating prompt; Google decides whether the prompt appears, and a rating you leave goes to Google Play.
• MusicBrainz — Relational metadata: artist bios, credits, release information. Query payload per album is the album title and album-artist name, plus any MusicBrainz IDs your files' tags already carry (recording, release or artist). Opening the Now Playing artist info sheet also looks that artist up by name. Listening habits, play counts, file paths, and device identifiers never enter the request. Unresolved entries re-attempt every 30 days; tentative low-confidence matches every 90.
• Cover Art Archive — High-resolution album artwork; queried by release-group MBID returned from the MusicBrainz lookup above. The image files are served from archive.org (the Internet Archive), where the Cover Art Archive redirects; artwork downloads are on by default
• Wikipedia (Wikimedia Foundation) — Artist biographies, and artist photos served from upload.wikimedia.org, fetched on demand for the Now Playing artist info sheet
• Jellyfin — Your personal Jellyfin server only; URL and credentials configured by you
• Subsonic / OpenSubsonic — Your personal Subsonic-compatible server only; URL and credentials configured by you
• LRCLIB — Opt-in community lyrics database (off by default). When you switch on Online lyrics and a track has no embedded or server lyrics, its title, artist and album are sent to lrclib.net to find matching words. Nothing else — no audio, no file path, no play counts. No request is made until you switch it on.
• ListenBrainz — Opt-in scrobble service (off by default). When you connect your token in Settings → ListenBrainz, track metadata (artist, title, album, duration, MusicBrainz Recording ID when available) and the listen's start timestamp are submitted to api.listenbrainz.org. No data is sent until you've affirmatively connected. Token is stored encrypted on-device using Android Keystore; pausing or disconnecting in Settings stops submission immediately. Failed submissions persist to a local retry queue and never leave the device until the network allows them.
• Sentry — Crash and error reporting, tagged with a random install ID (opt-in; see above)
• AutoEQ archive (raw.githubusercontent.com) — the community archive of headphone corrections. The fetch code ships in the app, but the network tier is switched off in this release: corrections come from a bundled offline pack, and a build test fails the moment anyone flips the switch. Named now so this list is already true on the day a future update turns it on.

Content retrieval requests carry no personal identifiers. Crash reports are governed by the terms described in the Crash Reporting section above. Use of all third-party services is subject to their respective privacy policies.

Local Storage & Security

Server sign-in tokens are encrypted on-device using the Android Keystore system (EncryptedSharedPreferences): the Subsonic token and its salt, and the Jellyfin access token. Meringo never stores a Subsonic password. Each server's address, your username and non-sensitive preferences are kept in the app's private DataStore, not encrypted but accessible only to Meringo. The local Room database is stored in the app's private data directory, inaccessible to other apps without root access.

Meringo declares these permissions. Four of them are declared but never requested or used, and each says so below:

• INTERNET — metadata APIs (MusicBrainz, Cover Art Archive) and communication with your Jellyfin or Subsonic server
• ACCESS_NETWORK_STATE — detect connectivity before making network requests
• CHANGE_WIFI_MULTICAST_STATE — declared but never requested or used. Google Cast is not in this release, there is no DLNA support, and the app never takes a multicast lock
• READ_MEDIA_AUDIO — declared but never requested or used. Meringo reaches the music on your device only through the folders you pick in the system folder picker
• READ_EXTERNAL_STORAGE — declared but never requested or used. It carries maxSdkVersion=32, below the app's minimum of Android 13, so it can never apply
• FOREGROUND_SERVICE / FOREGROUND_SERVICE_MEDIA_PLAYBACK — keep the playback service running while the screen is off
• POST_NOTIFICATIONS — non-foreground-service notifications such as the USB DAC lockout alert (the playback notification itself is exempt under FOREGROUND_SERVICE_MEDIA_PLAYBACK). Prompted for at install on Android 13+; the app remains fully usable if declined
• MODIFY_AUDIO_SETTINGS — audio output routing
• BLUETOOTH_CONNECT — declared but never requested or used. Meringo recognises a Bluetooth output without it
• WAKE_LOCK — prevent the CPU from sleeping mid-track during background playback
• VIBRATE — haptic feedback on seek and UI interactions
• com.android.vending.BILLING — the one-time in-app purchase. A normal-level permission auto-granted at install; Google Play's billing client will not initialise without it. It grants no access to your device, your library, or your payment details — the transaction itself is handled entirely by Google Play, and Meringo never sees a card number

Your Rights

Because Meringo does not collect personal data on any server I control, there is no centralized profile for me to provide, correct, or delete on my end. All data the app holds is stored on your device and remains under your direct control.

Right to access (GDPR Art. 15, CCPA § 1798.110). All data Meringo holds about you is on your device: the local library database, encrypted server sign-in tokens, server addresses and usernames, app preferences, and any cached metadata. You can inspect it directly through Android's app-data tools, or open the JSON dump produced by the Export my data feature described below.

Right to erasure (GDPR Art. 17, “right to be forgotten”). Uninstalling Meringo, or using Android Settings → Apps → Meringo → Storage → Clear all data, deletes every byte the app has on your device. Because no copy lives on my servers, this completes the erasure.

Right to portability (GDPR Art. 20). Tap Settings → Privacy → Export my data to write a human-readable JSON file to a location of your choice — your EQ presets, smart playlists, granted folder URIs, rack headphones, every non-sensitive preference, and (since export schema v2) the full on-device backup: star ratings, play counts and last-played times, bit-perfect receipts, the brew log, integrity verdicts, and imported playlists.

Settings → Privacy → Import my data reads the file back onto any install, with a preview of the file's contents before anything is applied. It never takes anything away: nothing you already have is deleted or overwritten, an existing rating is never lowered, play counts merge upward, and duplicates are skipped. It can, however, decline what it is given. Ratings, play history and integrity verdicts describe a particular file rather than a path, so if the file sitting at that path is no longer the one the backup was taken from — a re-rip, a re-tag, a different pressing dropped into the same folder — the incoming values for it are not applied, and the import tells you how many. A declined verdict costs you nothing permanent, because the file is simply re-checked in the background; a declined play count is gone, because nothing can recompute how often you listened to something. That is why the number is put in front of you rather than written to a log. Data for a track that is not in your library yet waits for it, and is held to the same check when it arrives.

Encrypted credentials and the library database itself stay excluded by design and are documented in the export manifest — your ratings and play history are no longer among the exclusions; they ride in the export's backup_payload section. Your music files themselves remain in the formats you provided — the app does not lock them in proprietary containers.

Right to object & opt out. Crash reporting can be disabled at any time under Settings → Privacy → Crash reporting. Acoustic fingerprinting needs no opt-out, because no fingerprint leaves your device — see Acoustic Fingerprints above. ListenBrainz scrobbling requires you to provide a token before any data is sent.

Right to lodge a complaint. EU/EEA users may lodge a complaint with their national data-protection authority. California residents may contact the California Attorney General. For questions about this policy or to exercise any right above, write to support@meringo.app.

The application is provided as-is. As a solo developer, I work hard to keep Meringo stable and respectful of your privacy, but I cannot guarantee it will be free of defects.

Trademarks & Attribution

Meringo is an independent project and is not affiliated with, endorsed by, or sponsored by any third-party service, project, or hardware manufacturer referenced on this page or in the application. All product names, logos, and brands are property of their respective owners and are used here for descriptive, interoperability, and identification purposes only (nominative fair use).

• Jellyfin is a trademark of the Jellyfin Project. Meringo connects to user-configured Jellyfin servers via the project's public HTTP API.
• Subsonic is a trademark of Sindre Mehus. OpenSubsonic is a community specification. Servers compatible with either are independent projects of their respective maintainers.
• FiiO and M21 are trademarks of Guangzhou FiiO Electronics Technology Co., Ltd.
• Snapdragon is a trademark of Qualcomm Incorporated.
• Android is a trademark of Google LLC.
• MusicBrainz, the Cover Art Archive, and AcoustID are projects of the MetaBrainz Foundation and its contributors. Data and artwork retrieved from MusicBrainz and the Cover Art Archive are used under their respective public terms. Meringo no longer queries the AcoustID service, but it does bundle Chromaprint, the AcoustID project's open-source fingerprinting library (LGPL-2.1+), which runs entirely on your device; visit metabrainz.org and acoustid.org for details.
• oratory1990's headphone EQ measurements are bundled as a curated subset of presets, used under the Creative Commons CC BY-SA 4.0 license and sourced via OPRA (Open Profiles for Revealing Audio), a Roon-maintained community headphone-measurement database — see github.com/opra-project/OPRA. If his work improves your listening, consider supporting him at buymeacoffee.com/oratory1990.
• Sentry is a trademark of Functional Software, Inc.

Open-Source Software

Meringo bundles a Meringo-built decoder derived from FFmpeg (libavcodec, libavutil, libswresample) statically linked for ALAC and FLAC playback. It is used under the terms of the GNU LGPL v2.1 or later, with no GPL-licensed components enabled in the build.

Full attribution, license texts, build configuration, and the written offer of source availability are bundled into the application under Settings → Open Source Licenses. The remaining open-source dependencies (Media3, Coil, AndroidX, Hilt, Room, and others) are enumerated in the same screen, generated automatically from the build manifest.

Contact

Questions about this privacy policy or Meringo's data practices? Write to me directly:

support@meringo.app