Privacy policy

1. Data controller

Vainastech, Colombia. Contact for privacy matters: vainastech@gmail.com.

2. Use without an account: your library never leaves your device

If you use Heardy without creating an account, all information (your library, playlists, playback history, statistics, settings) is stored only on your device and the operator receives none of it. The application still makes some internet connections in this mode: it checks GitHub for new versions (which exposes your IP address to GitHub; on Windows it also updates its bundled download helper, yt-dlp, from GitHub); it looks up lyrics at LRCLIB and, as an alternative source, at NetEase Cloud Music, sending the song’s title and artist (and its duration to LRCLIB); when you ask for a translation, it sends the text of each lyric line to the MyMemory service; and if you use “Listen” (streaming), it connects to the service hosting the content directly from your device. None of these connections sends your library or an account identifier. Searching, resolving links and downloading also run on your device, which connects directly to the source service (that service sees your IP address); no server of the operator takes part and the operator receives none of that data. The same goes for syncing your own devices over Wi-Fi or through a folder (see the section “Syncing between your own devices”).

3. What data we process if you create an account

• Email and verification status, managed by the identity provider. The operator never sees or stores your password.
• Your library index: titles, artists, album, duration, a fingerprint of the audio content (a value derived from the file that cannot be used to reconstruct it), playlists and their composition and order (for online playlists, references to songs, not audio), and a song’s source link when it was imported from one. File paths and audio are never sent.
• Playback history: which song you listened to, when, and for how long (this last value is capped on the server and not treated as a reliable figure). Plays of songs in online playlists are included, by video identifier, so they count in your statistics. Your statistics are computed from this history.
• Username, if you choose one, and friendship relationships (requests sent, accepted and rejected).
• “Listening now”, only if you expressly enable this option: the song you’re currently playing, visible only to your friends, and which expires automatically when the song ends. It is disabled by default.
• Downloads, search and link resolving do not go through the operator’s server: they run on your device. Explore does use the server: the searches you make in Explore, the country you choose and the video identifiers of your most-played songs that have a source link (to generate recommendations) are processed there to answer each request.
• Minimal technical data needed to operate the service: per-account usage counters (for rate limits and abuse protection), sync timestamps and server logs. Logs never combine your identity with the content of your data.

Summary of what’s collected

In one line: without an account, the operator receives nothing (the application only contacts third parties for updates, lyrics, translations and streaming, as described in section 2). With an account: your email (via the identity provider), your library index, your playback history, your username, your friendships, “listening now” if you enable it, what you ask Explore, what you publish in the forums, and technical usage counters. Never the audio of your library, never file paths, the app never collects analytics or advertising data.

Syncing between your own devices

Heardy can sync your devices without going through the operator’s server and without an account. Nothing in this section is sent to the server.

• Wi-Fi sync: your playlists and their order (online playlists included), the library index entries they refer to (titles, artists, album, duration and a content fingerprint) and your listening history and statistics travel directly from one device to the other over your local network, encrypted. File paths and audio are never sent. It only works while the sync screen is open on both devices. While it is open, the device announces on the local network a random identifier and a device name, in clear.
• Pairing and trust: the first time, both devices show an 8-digit code that you must compare and confirm on both screens. If they match, each device stores the other’s key and from then on only accepts that paired device; you can forget a device in Settings. Pair only devices that are yours: a paired device can add data to the other one, and if it is lost or compromised while unlocked it can read that device’s index. Confirming the code without comparing it removes the protection against someone else on your network.
• Folder sync and backups: each device writes its own file (index and history, without paths or audio) inside your library folder and reads those of the others. Whatever moves that folder between devices (Syncthing, Drive, OneDrive…) is a tool you choose and its own terms apply; the operator does not receive the file.

4. What we don’t collect

• The audio files of your library: they are never uploaded to the server.
• File paths, folder names or your storage’s structure.
• Analytics, usage-tracking or advertising data: the Heardy app does not include any analytics or ad SDK (advertising on the website is described in the next section).
• Contacts, location, microphone, or any permission unrelated to reading your music folder.
• Payment data: Heardy does not receive or store payment data. If you choose to make a voluntary donation, the payment is processed by Mercado Pago or, if you use the secondary option, by Ko-fi and its payment providers (such as PayPal or card processors), under their own terms. The operator receives the information the payment platform provides about the contribution, which may include the donor's name, email address and any message they choose to leave, and uses it only to manage the donation and thank the donor.

Advertising on the website

This section applies only to Heardy’s website, not to the application. The website shows ads served by a third-party ad network, to help fund the project. Downloading Heardy is free and never depends on the ads.

• The ad network and its advertising partners may use cookies or identifiers and process technical data (IP address, browser and device information, approximate location and pages viewed) to serve and measure the ads, under their own policies, which Heardy does not control.
• If you visit the site from the European Economic Area, the United Kingdom or Switzerland, you will be asked for your consent before ads load: ads load only after you accept. Elsewhere, the basis is the legitimate interest in funding the project.
• To limit tracking you can adjust the cookie settings in your browser or use a content blocker. Outside the European Economic Area, the United Kingdom and Switzerland, the website may ask you to turn your ad blocker off to use it; the legal pages can always be read without doing so.
• The website runs a technical check to see whether the ad script can load, which is how it detects ad blockers. The result is not stored or sent anywhere. The check only runs where ads do not require prior consent.
• Notification-style ads (a bar and in-page notifications) are loaded from the ad network only after consent where it is required, and they are not loaded on the forum pages. The forums are served from their own address (foros.heardy.vainastech.com), where no third-party advertising code runs in the page itself and banners appear only in a separate frame; the forum sign-in session is kept in the browser storage of that address, separate from the main website’s.
• The footer includes a text link to a third-party advertiser, labelled as advertising. The link itself loads no third-party code in the page; if you click it you leave this website for an advertiser’s page, which is covered by its own policies.
• When you confirm a download, a window with advertising from a third-party advertiser may open in the background (at most once every 24 hours per browser, and only if you have accepted advertising where that is required). That page is not Heardy’s, and the only Heardy file is the one you download from this site, so do not install anything or enable notifications if that page asks you to.
• The website uses Cloudflare Web Analytics, which counts visits in aggregate (pages viewed, country, browser and device type) through a small script served by Cloudflare. It does not use cookies or track individuals across sites. It is not loaded on the forum address.
• The Heardy application (Android and Windows) shows no ads and includes no ad or analytics SDK. Heardy does not run analytics of its own on the website.

The browser storage the website itself uses, and how to manage it, is listed in the Cookie policy.

5. Purposes and legal basis

Account data is processed exclusively to provide the features you enable: syncing your index and history across your devices, restoring them after a reinstall, managing your username and friendships, and showing your friends what you’re listening to if you choose to. We also use it, in aggregate and without identifying you, to maintain security and enforce usage limits on the service.

The legal basis is your prior, express and informed authorization (article 9 of Colombia’s Law 1581 of 2012), which you grant when you create and link your account, at which point the application informs you that your index and history will travel to the server. For European Union users, the equivalent legal basis is consent and performance of the requested service (articles 6.1.a and 6.1.b of the GDPR). You can withdraw your authorization at any time by deleting your data (section 9).

6. Where data is processed, and processors

The optional server and database run on external providers’ infrastructure that act as data processors and host the data in the United States. This constitutes an international data transfer, which is covered by your prior, express and informed authorization (article 26 of Law 1581 of 2012 and External Circular 005 of 2017 of the Superintendence of Industry and Commerce) and by those providers’ data-processing agreements, which include the standard contractual clauses approved by the European Commission for European Union users.

• Google (Firebase Authentication) — Account identity: email, verification and session. Privacy policy.
• Render — Hosting for the optional server (account, index sync, friends, presence and statistics; no audio). Privacy policy.
• Neon — Database that stores the library index, history, username, friendships and forum content. Privacy policy.

For lyrics, the application queries LRCLIB and, as an alternative source, NetEase Cloud Music (a service operated from China), sending the song’s title and artist (and its duration to LRCLIB). To translate, it sends the text of each lyric line to the MyMemory service (see Licenses and credits). We do not share your data with any other third party, nor do we sell it.

7. What other users can see

A user who isn’t your friend can only check whether an exact username exists, and never sees your email, the size of your library, or your statistics. Your friends can see your username, your listening statistics (most-played songs and artists, totals) and, only if you’ve enabled it, the song you’re currently listening to. You can remove a friendship at any time.

Forums, comments and ratings

The website’s forums are public. This section describes the data they involve; it adds to the rest of this policy.

• What is stored on the server: the title and text of the forums you create, your comments, your star rating (only in the “App reviews” forum), your votes (▲▼), the reports you send (the item reported and the reason you write) and the date of each of them. Each item is linked to your account so that you can delete it and so that limits can be applied, but that link is never shown.
• What is public: your username as author, the text, the rating, the date and the vote total of each comment. Anyone who visits the forums can see it, with or without an account. Your email and your account identifier are never shown, and neither are your individual votes or your reports. Do not include personal data in what you publish: once it is public, other people may copy it and we cannot control those copies.
• Who else sees it: the operator, who reviews reports (the reports list includes the usernames involved) and may hide content or block accounts. Server logs do not combine your identity with the content of your posts.

Purposes. To run the forums (display, order and count comments, votes and ratings), to apply usage limits per account and to keep them free of abuse through moderation. You provide this content voluntarily when you publish it, and publishing it implies your authorization for this processing (see section 5).

Moderation with artificial intelligence. Once a day, an automated system reviews the new forums and comments to decide whether they are unrelated to the application, inappropriate, illegal, spam or abusive, and may hide them. The text it receives comes without your username or any other identity, but the text itself is sent to an artificial-intelligence provider that processes it to classify it, and that provider may process it outside Colombia (see section 6). It is not used to identify you. Hiding is reversible: hidden content is not deleted, each action is logged with its reason and can be restored. This system can be wrong; if you think something of yours was hidden by mistake, write to vainastech@gmail.com.

Retention and deletion. Forum content is kept while it exists, until you or the operator delete it or it is hidden; there is currently no automatic expiry. You can delete your own forums and comments at any time. When you erase your account data, your comments, votes, reports and forums are deleted; if a forum of yours has comments from other users, it stays without an author (“deleted user”). Content hidden by moderation remains stored, but is not shown.

Your rights. The rights described in section 9 also apply to this data; use the same email address to exercise them. The terms that govern what you may publish are in the Terms of use.

8. Retention

Your account data is kept for as long as the account exists. “Listening now” information expires automatically when each song ends and is never stored permanently. Server technical logs are kept for a maximum of 30 days. Deleting your data (section 9) removes it from the database immediately; the database provider’s automatic backups are purged within a further 30 days at most. If the optional service were to be discontinued, all accounts’ data would be deleted within that same period.

9. Your rights and how to delete your data

Under Colombia’s Law 1581 of 2012 and Decree 1377 of 2013 (habeas data) you have the right to know, update and correct your data, to request proof of the authorization, to be informed of how it has been used, to revoke the authorization and request deletion of the data, and to file complaints with the Superintendence of Industry and Commerce. European Union users also have the rights of access, rectification, erasure, restriction, portability and objection provided by the GDPR, and may lodge a complaint with their supervisory authority.

The fastest way to exercise deletion is from the application itself: Settings → “Erase my account data”. This action removes your index, history, username, friendships and forum content (see the section “Forums, comments and ratings”) from the server. Your local data stays on your device and remains yours. For any other request, write to us at vainastech@gmail.com from the email associated with your account; we will respond within the deadlines set by law (ten business days for inquiries and fifteen for complaints, extendable under Colombian rules; one month under the GDPR).

Artificial intelligence

Heardy is developed with the help of artificial-intelligence tools, under human supervision. Those tools have no access to user data: no personal data or library content is used to train models or sent to artificial-intelligence providers for that development. The only user text that reaches such a provider is the text of forums and comments, for moderation (see the section “Forums, comments and ratings”). The application also does not make automated decisions with legal effects on you.

10. Security

Communication between the application and the server is encrypted in transit. Access to the server requires a session token issued by the identity provider, which expires periodically. The server does not store passwords. The operator’s server does not download or store audio and does not receive the links you request or your download searches: those run on your device. The server applies rate limits per account and does not log your identity together with the content of your data. No system is foolproof; if we detect an incident affecting your data, we will notify you as required by law.

11. Minors

Heardy is not directed at children under 14 and does not knowingly create accounts for them. The optional account is intended for adults; someone over 14 but under the age of majority may only create it with the authorization of their parents or guardians, under the terms of article 7 of Law 1581 of 2012 and article 12 of Decree 1377 of 2013. If you believe a minor has provided data without that authorization, write to us and we will delete it.

12. Changes to this policy

We will publish any change to this page with its update date and, if the change substantially affects the processing of your data, we will indicate it in the application before it takes effect.

13. Contact

vainastech@gmail.com · Vainastech, Colombia. Terms of use: /en/terminos.