Privacy

Sonora has no Sonora account system, analytics, advertisements or mandatory application backend. Optional temporary account import requires provider authorization; the experimental Google browser flow additionally requires an explicitly configured HTTPS broker.

Search terms and playback requests are sent directly to YouTube through NewPipeExtractor. Stream requests go to the media hosts returned by that source. With About → Faster playback starts enabled (the default), Sonora also resolves up to two likely tracks while a screen is visible and prepares the next queue item during playback. It may contact YouTube, podcast feeds and audio hosts before you press Play, fetching at most 192 KiB of audio per preparation plus metadata/network overhead. Up to four prefixes (768 KiB) are kept only in RAM, with a five-minute reuse limit; audio is never saved to disk. Disable the switch to cancel speculative work and clear the shared prefix cache. Normal playback buffering and artwork requests still work. Preparation never plays audio or creates listening-history entries.

Music search also sends the selected query/category and, when enabled, partially typed terms for public online suggestions. Discovery settings can disable online suggestions; debounced local search and saved search history remain available. Explicitly submitted searches are stored on the device (up to 50); clear them in Discovery settings.

With Autoplay enabled, choosing an individual song starts a radio session. Public related-item and bounded music-search requests use that song and candidate artist/source-credit names. Personalized Home may also request candidates from recent listening, favorites or user-written interests. Sonora does not upload the full library, listening-event log, completion/skip counts or account identifiers. Public services can still observe the individual references/search terms requested and normal network information. Disable local personalization to stop implicit learning and Home recommendations based on history; explicit Start radio and searches still make requests. Disable Autoplay to stop automatic queue extension.

Public metadata enrichment is off by default. Enabling it sends selected title/credit hypotheses to MusicBrainz and matched artist IDs to ListenBrainz Labs for artist similarity. No login, key, token or listening-history upload is used. Those providers’ terms and policies apply. Returned metadata and its source/confidence/date/license are cached locally with expiration; there is no bulk catalog download. Cached evidence may still be shown when enrichment is disabled, but no new enrichment request is initiated.

Learning is device-local: favorites, repeats, elapsed listening, completions, gentle skip/removal signals and explicit More/Not interested feedback. Discovery settings can disable personalization or reset learned and hidden preferences without deleting favorites, playlists, podcasts or history. Reset excludes old learned play counts from ranking; explicit favorites remain useful. Search history, preference signals, radio state and enrichment caches are not included in exported library backups. Queue checkpoints contain only canonical references, recommendation reasons and recent session context, never resolved stream URLs.

Artwork requests go to the image hosts returned by the source. Those services receive standard network information such as your IP address. Their policies apply to those requests.

Podcast search terms and locale country are sent to Apple’s public podcast directory only when you search. Opening or refreshing a feed contacts its publisher. Playing or preparing an episode fetches its current feed and audio enclosure, including the publisher’s redirect/measurement services. Podcast publishers may include ads in their audio. No Apple or Google account, cookies or paid-feed credentials are used. Podcast subscriptions, cached episode metadata, and listening positions are stored locally; no periodic background subscription polling is performed. Unsubscribe in the podcast screen; this retains cached episodes and progress. Mark unplayed resets an episode’s saved progress.

Favorites, playlists and their track order, canonical track URLs, titles, artwork URLs and listening history stay in a local Room database. Android app backup is disabled. Clear history in Library → History; remove favorites with the heart button. Uninstalling Sonora or clearing its app storage removes the local database. The queue and its last saved position are stored locally; resolved playback URLs remain in memory; Coil may cache thumbnails in app-private storage.

Imported ZIP/CSV files are read locally through the Android document picker. Sonora does not upload the archive or request Google credentials, cookies or account access. Optional missing-title lookup sends canonical video references to YouTube through NewPipeExtractor; disable it in the preview to import offline. Public playlist-link imports also contact YouTube. Artwork may subsequently be fetched when displayed. Files are parsed in memory and are not retained by Sonora. Delete imported playlists from Library → Playlists; favorites are managed separately.

Spotify account-data exports are read locally through the document picker. Only playlist and saved-song metadata is retained in the import flow; other ZIP entries are discarded without JSON decoding, including profile, payment and history files. Archives are never extracted to disk or uploaded. After choosing lists, optional matching sends only selected song titles and artists to YouTube. Turn that option off to review offline; an individual Search again or Look up link action explicitly requests a network lookup. Spotify durations are not inferred from listening history. Unconfirmed entries remain in memory only and are discarded on cancellation/navigation/process death. Confirmed playable references use the existing local-library and backup rules.

Temporary account import is opt-in and configuration-gated. Spotify requests playlist read permission and, only if selected, liked-song read permission. The experimental Google adapter requests YouTube read permission only and is disabled by default pending the use-case and retention-policy issues described in OAuth import availability. Passwords stay in the system browser. No profile, email, account ID, offline scope or persistent sign-in is requested.

Authorization codes, PKCE state/verifiers and access tokens remain transient. Access tokens are never written to preferences, Room, backups or application logs; refresh tokens are discarded. Account reads use a separate HTTP client without cookies, disk cache, redirects, logging or automatic retries. Cancellation, leaving an active import, timeout and failure discard the connection. A process restart requires a new attempt. The connection is discarded before review/matching; selected Spotify titles and artist names are then sent to YouTube to find playable equivalents. Ambiguous results require review and are not silently imported.

If an operator enables the Google broker, it transiently receives the one-time code/verifier and token during exchange and keeps the OAuth client secret in its hosting secret store. The supplied broker does not store tokens, playlists or account profiles and has no refresh endpoint; operators must disable payload/query logging and caching. It is not deployed or enabled in this default build. Selected playlist names/source IDs and chosen playable references enter the local library only after confirmation. Unselected metadata and pending entries are discarded when leaving the flow. This does not log out of the browser or necessarily revoke provider consent. Consent can be removed separately in Google permissions or Spotify apps.

Library backups are created only when you choose Export library and a document destination. They contain metadata, playlist order, favorites and listening timestamps/counts, podcast subscriptions and episode positions in readable JSON, not audio or account credentials. A cloud document provider receives the file only if you select that provider. The restore operation reads and validates the chosen file locally and merges it without contacting YouTube. Displayed artwork, enabled personalized Home discovery and foreground playback preparation can subsequently make network requests. Sonora does not encrypt exported backups.

No storage, microphone, location or Android account-manager permission is requested. Internet, network-state, foreground media service and wake-lock permissions support streaming and background playback. Android media-session notifications are exempt from the Android 13 notification runtime permission, so Sonora does not request unrelated notification access.

The beta does not collect diagnostic logs remotely. If reporting a bug, avoid including signed stream URLs, private information or an unredacted full device log.

Sonora 0.6 and later checks the public Sonora release manifest on GitHub when checking for updates. Release builds make this request periodically. The official APK is requested when you choose to download it. These requests do not include library, history or playback data.