Privacy Policy

1. Introduction

Welcome to LizMusic. We respect your privacy and are committed to protecting your personal data. This privacy policy will inform you about how we handle your data when you use our music player application.

IMPORTANT: LizMusic is a music player client application only. We do NOT provide, host, store, stream, or distribute any music content. You must provide your own music files and cloud storage accounts.

2. Data We Collect and Access

When you use LizMusic, we may access or collect the following information:

Data Accessed Locally (NOT Uploaded to Servers)

• Music Files and Audio Files: We access your music files (MP3, FLAC, AAC, etc.) and other audio files stored on your device or cloud storage for playback purposes only. These files remain on YOUR device or YOUR cloud storage and are NEVER uploaded to our servers
• Album Artwork and Embedded Images: We access album cover images embedded in your music files or stored as separate image files (JPG, PNG) in your music folders for display purposes. These images are processed locally and not uploaded
• Music Library Metadata: Information extracted from your music files including artist, album, title, duration, genre, and other ID3 tags - stored locally on YOUR device only
• Files and Documents (Music-Related Only): We may access playlist files (.m3u, .pls), lyrics files (.lrc), and music-related documents in your music folders. We do NOT access or process your personal documents, photos unrelated to music, videos, or other non-music files
• Playback History: Tracks you've played, playlists, and listening preferences (stored locally on your device, NEVER uploaded to our servers)
• Cloud Storage Credentials and Authorization Tokens: If you choose to use supported cloud integration (such as WebDAV-compatible servers, OneDrive, Google Drive, or Dropbox), encrypted connection credentials or OAuth authorization tokens are stored locally on your device
• App Settings: Your preferences, equalizer settings, customization choices, and feature toggles

Data Collected/Transmitted

• Pseudonymous Installation and Analytics Identifiers: Firebase services may assign installation-scoped or pseudonymous identifiers such as Firebase Installation ID and Firebase Analytics identifiers to support analytics, diagnostics, remote configuration, and limited-release feature controls. These identifiers are not your real name or email address
• Account Identifiers from Connected Providers: If you connect Google Drive, Dropbox, or OneDrive, the provider may return account identifiers such as an account ID, email address, or display name. LizMusic uses this information only to show and manage the connected source, refresh authorization, and provide browsing, import, playback, lyrics, artwork, and offline cache features you request
• Device Information: Device type, operating system version, app version, audio output device type for compatibility purposes
• Analytics and Diagnostics: Usage statistics, crash reports, and performance metrics may be collected via Firebase (Google) to improve app stability and user experience. We do NOT upload your music files, and we do NOT intentionally send full listening-history content as part of analytics events
• Ads and Consent Data: If advertising is enabled in your app build or region, Google Mobile Ads and Google User Messaging Platform may process device, app, network, and consent-related information, and may use advertising identifiers where supported by Android and permitted by your device settings and Google policies
• Network and Connectivity Information: Network connection type and related diagnostic signals may be processed to improve reliability, playback compatibility, and ad or analytics delivery
• Optional Lyrics Lookup Metadata: If a limited-release lyrics lookup feature is enabled for your installation and you choose to use it, song metadata such as title, artist, album, or duration may be sent to a third-party lyrics service to try to match lyrics. Any lyrics saved from that feature are cached on your device
• Bluetooth Information: Connected bluetooth device names and types when using car mode or bluetooth playback features
• Subscription Information: Purchase records and subscription status for premium features (processed by Google Play)

Important Clarifications

• Music Files: We access and play your music files locally. Your music files are NEVER uploaded to our servers or shared with third parties
• Lyrics Files: LizMusic can read user-provided local lyrics files such as .lrc files stored with your music library. These files remain on your device or your own storage accounts unless you separately choose to use a limited-release lyrics lookup feature
• User IDs and Device IDs: LizMusic does not require a LizMusic account. Firebase and advertising identifiers are device, app-instance, or installation identifiers. Cloud provider account identifiers are used only after you authorize that provider and only for the connected storage features you choose to use
• Photos and Videos: While our storage permission may technically allow access to photos and videos on older Android versions (due to READ_EXTERNAL_STORAGE permission limitations), we do NOT access, process, collect, or view your personal photos or videos. We only access music-related images (album artwork)
• Audio Recordings: We do NOT record audio or access your voice recordings, voice memos, or other recorded content. We only access pre-existing music and audio files that you have stored for playback
• Documents: We do NOT access your personal documents, PDFs, text files, or other non-music documents. File access is limited to music files and music-related metadata only

CRITICAL PRIVACY NOTICE: Your music files, audio content, and personal media NEVER leave your device or personal cloud storage. We are a local music player - core music playback happens on your device. Network traffic is limited to app infrastructure and optional services you choose to use, such as analytics, ads, cloud connections, updates, or limited-release lyrics lookup.

2a. Google Play Data Safety Alignment

To make our data practices easier to compare with Google Play's Data safety form, the main data categories are summarized below:

• Device or Other IDs: Firebase Installation ID, Firebase Analytics identifiers, app instance identifiers, and advertising identifiers may be processed for analytics, diagnostics, remote configuration, consent, ads, fraud prevention, and app reliability
• User IDs and Account Information: LizMusic has no first-party user account system. If you connect Google Drive, Dropbox, or OneDrive, provider account identifiers may be processed only to manage that connection and access the files you authorize
• App Activity and Diagnostics: App interactions, feature usage, import/playback events, crash logs, and performance data may be processed to maintain and improve the app. We do not intentionally send full listening-history content or your music library contents as analytics events
• Files, Audio, and Music Metadata: Audio files, lyrics files, playlists, artwork, filenames, folder paths, and music tags are accessed to browse, import, play, cache, and organize your own library. These files are not uploaded to LizMusic servers
• Purchase Information: Subscription entitlement and purchase status are processed through Google Play to unlock paid features. Payment details are handled by Google Play, not LizMusic
• Bluetooth Device Information: Device names, types, and connection state may be processed locally for bluetooth playback, car mode, and external-device compatibility features

We do not use your music files, cloud file contents, playlists, lyrics, or listening library to build advertising profiles or to sell data.

2b. Cloud Storage Authorization and File Access

LizMusic accesses cloud storage only after you explicitly connect a provider. Cloud access is used to browse folders, import library metadata, stream or play audio files, display artwork and lyrics files, and cache selected content on your device when you choose offline features.

• Google Drive: When you authorize Google Drive, LizMusic may read file and folder names, paths, metadata, and the contents of supported music-related files within the access scope you approve. We do not upload your Google Drive files to LizMusic servers, sell your Google Drive data, or use it for advertising profiles.
• Dropbox: When you authorize Dropbox, LizMusic may read file and folder names, paths, metadata, and the contents of supported music-related files needed for browsing, import, playback, artwork, lyrics, and offline cache features. We do not upload your Dropbox files to LizMusic servers, sell your Dropbox data, or use it for advertising profiles.
• OneDrive: When you authorize OneDrive, LizMusic may read file and folder names, paths, metadata, and supported music-related file contents needed to provide the features you request. We do not upload your OneDrive files to LizMusic servers or use them to operate a hosted music catalog.
• WebDAV-Compatible Servers: When you connect a WebDAV server, LizMusic uses the server address and credentials you provide to browse, read, and play music-related files from that server.

You can disconnect a cloud source in the app. OAuth providers may also allow you to revoke LizMusic access from your Google, Dropbox, or Microsoft account settings. After disconnection or revocation, related cloud playback, import, lyrics, artwork, and offline cache features may stop working for that source.

3. How We Use Your Data

We use your data to:

• Provide and maintain the music playback functionality
• Sync your music library using your own connected cloud storage providers (if you enable cloud features)
• Apply remote configuration, device-specific feature flags, and rollout controls
• Remember your preferences and settings
• Improve app performance, stability, and user experience through analytics
• Diagnose and fix crashes and bugs through automated error reporting
• Monitor app performance and optimize resource usage
• Provide customer support when requested
• Manage subscriptions and process in-app purchases
• Request and store advertising consent where required, and serve ads when enabled
• Deliver app updates and new features

4. Privacy-First Approach

LizMusic is designed with privacy as a core principle:

• Local Storage: All your music data, playback history, and preferences are stored locally on your device
• Limited Analytics: We limit analytics and diagnostics to product improvement, stability, and aggregate usage understanding. We do not upload your music files or operate a cloud music catalog
• No Account Required: You can use LizMusic without creating an account or providing personal information
• Encrypted Credentials: Cloud storage credentials are encrypted and stored only on your device
• No Data Selling: We will never sell your personal data to third parties. We do not sell or share your data for targeted advertising purposes
• Minimal Permissions: We only request permissions that are essential for specific features you choose to use
• Transparent Processing: Data collection and sharing for analytics, ads, consent, subscriptions, remote configuration, and connected storage features are described in this policy
• No Music Resale or Catalog Profiling: We do not sell your music files, host your music catalog, or operate a streaming recommendation profile based on your library content

4a. Data Controller Information

Data Controller: LizMusic (Individual Developer) is the data controller responsible for your personal data.

Contact Information:
Email: [email protected]

Data Protection Contact:
We do not have a designated Data Protection Officer as we are an individual developer and do not engage in large-scale processing of personal data. For all privacy-related inquiries, data protection questions, or to exercise your rights, please contact us at: [email protected]

4b. Legal Basis for Processing

We process your personal data based on the following legal grounds:

• Contractual Necessity: Processing is necessary to provide the app functionality and services you request
• Legitimate Interests: We process data for analytics, crash reporting, and app improvement, which are our legitimate interests that do not override your privacy rights
• Consent: For optional features like cloud sync, OAuth cloud authorization, shake-to-skip, and analytics, we process data based on your explicit consent
• Legal Obligations: We may process data to comply with legal requirements and respond to lawful requests from authorities

4c. Data Retention Policy

We retain your personal data only for as long as necessary to fulfill the purposes outlined in this policy:

• Local App Data: Music library metadata, playback history, and preferences are stored locally on your device and retained until you uninstall the app or manually clear the data
• Analytics Data: Anonymous usage statistics and crash reports are retained for 12 months, after which they are automatically deleted
• Subscription Records: Purchase and subscription information is retained for 7 years for accounting and tax purposes
• Support Communications: Customer support emails and inquiries are retained for 3 years
• Cloud Sync Credentials: Encrypted cloud storage credentials and OAuth tokens are stored on your device only and deleted when you disconnect the cloud account or uninstall the app

You can request deletion of your data at any time by contacting us at [email protected].

4d. Data Sharing and Third-Party Access

We do not sell your personal data to third parties. We share limited data only with the following service providers:

• Firebase/Google: Analytics, crash diagnostics, and remote configuration data needed to operate and improve the app (subject to Google's privacy policy)
• Google Ads / Consent Services: If ads are enabled, Google Mobile Ads and Google User Messaging Platform may receive device, app, and consent-related information to serve ads and manage consent flows
• Google Play Services: Subscription billing and in-app purchase processing
• Supported Cloud Storage Providers: Only when you explicitly connect your own Google Drive, Dropbox, OneDrive, or WebDAV-compatible storage source
• Optional Lyrics Providers: If a limited-release lyrics lookup feature is enabled for your installation and you use it, relevant song metadata may be sent to a third-party lyrics provider for matching

These third parties are contractually obligated to protect your data and use it only for the purposes we specify. We do not share your music listening habits, playlists, or personal preferences with any third parties.

Your Right to Know: You have the right to know whether your personal data is being shared and with whom. The complete list of third parties is provided above.

5. Cloud Storage Integration

User-Provided Cloud Storage: LizMusic does NOT provide cloud storage services. To use cloud sync features, you must have your own accounts with supported third-party providers (such as Google Drive, Dropbox, OneDrive, or WebDAV-compatible servers) that YOU set up and pay for independently.

When you connect your personal cloud storage accounts, your music files are synced directly between YOUR device and YOUR cloud provider. LizMusic does NOT store, access, or process your music files on our servers. We only store the encrypted connection credentials locally on your device.

Your cloud provider's privacy policy applies to any data stored in your cloud accounts. You are responsible for:

• Signing up for and paying for cloud storage subscriptions
• Maintaining the security of your cloud storage credentials
• Ensuring you have legal rights to all content in your cloud storage
• Complying with your cloud provider's terms and privacy policies

LizMusic has no access to, control over, or responsibility for the content in your cloud storage accounts.

6. Data Security

We implement appropriate technical and organizational measures to protect your data against unauthorized access, alteration, disclosure, or destruction. However, no method of electronic storage is 100% secure, and we cannot guarantee absolute security.

7. Third-Party Services

LizMusic integrates with the following third-party services:

• Firebase (Google): Analytics, crash reporting, diagnostics, and remote configuration
• Google Mobile Ads / User Messaging Platform: Ad delivery and consent handling when ads are enabled
• Google Play Services: In-app updates, subscription billing, and payment processing
• Cloud Storage Providers: Google Drive, Dropbox, OneDrive, and WebDAV-compatible servers that you connect for file access and playback
• Optional Lyrics Providers: Third-party lyrics services used only if a limited-release lyrics lookup feature is enabled for your installation and you choose to use it

These services have their own privacy policies, and we encourage you to read them. We are not responsible for the privacy practices of third-party services. Data shared with these services is governed by their respective policies.

8. Children's Privacy

LizMusic does not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us with personal information, please contact us.

9. Your Rights and How to Exercise Them

You have the following rights regarding your personal data:

• Right to Access: You can access your data stored in the app settings at any time
• Right to Rectification/Correction: You have the right to correct or update any inaccurate personal data. You can edit your preferences, playlists, and settings directly in the app. For data we store, contact us at [email protected]
• Right to Delete: You can delete your data by uninstalling the app or contacting us at [email protected] to request deletion of analytics data
• Right to Data Portability: You can export your playlists and settings through the app's export feature
• Right to Opt-Out: You can opt-out of analytics and crash reporting in the app settings. You can also opt-out of personalized ads (though we don't use targeted advertising)
• Right to Withdraw Consent: For features requiring consent (cloud sync, analytics), you can withdraw consent at any time in app settings
• Right to Object: You can object to data processing by disabling specific features or uninstalling the app
• Right to Restrict Processing: You can limit how we process your data by disabling analytics and optional features
• Right to Lodge a Complaint: You have the right to file a complaint with your local data protection authority or supervisory authority if you believe we have violated your privacy rights

To exercise any of these rights, contact us at: [email protected]. We will respond to your request within 30 days.

9a. Opt-Out of Data Sharing and Sales

We do not sell your personal data. We do not share your data for cross-context behavioral advertising or targeted advertising purposes.

We do not use your music library, cloud file contents, playlists, lyrics, or listening history to create targeted advertising profiles. If ads are enabled in your app build or region, Google Mobile Ads and Google User Messaging Platform may process advertising and consent signals under Google's policies and your device settings.

If you want to reduce third-party data processing, you can disable optional features where the app provides such controls, avoid connecting cloud accounts you do not want to use, revoke OAuth access from the connected provider account, and use Android or Google account privacy controls for ad preferences.

Alternatively, email us at [email protected] with "Opt-Out Request" in the subject line.

You can also opt-out of personalized advertising through the app's consent prompt where available, through Android settings under "Ads," or through your Google Ads Settings.

9b. GDPR Rights (European Union Users)

If you are located in the European Union (EU), European Economic Area (EEA), United Kingdom (UK), or Switzerland, you have additional rights under the General Data Protection Regulation (GDPR):

• Right to Access: Request a copy of all personal data we hold about you
• Right to Rectification: Correct any inaccurate or incomplete data
• Right to Erasure ("Right to be Forgotten"): Request deletion of your personal data
• Right to Restrict Processing: Limit how we use your data
• Right to Data Portability: Receive your data in a machine-readable format
• Right to Object: Object to processing based on legitimate interests
• Right to Withdraw Consent: Withdraw consent for data processing at any time
• Right to Lodge a Complaint: File a complaint with your national data protection authority

To exercise your GDPR rights, contact us at: [email protected]

EU Supervisory Authority Contact: You can find your local data protection authority at: https://edpb.europa.eu/about-edpb/board/members_en

9c. CCPA Rights (California Users)

If you are a California resident, you have specific rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

• Right to Know: Request information about the categories and specific pieces of personal data we collect, use, disclose, and sell
• Right to Delete: Request deletion of your personal data, subject to certain exceptions
• Right to Opt-Out of Sale: We do NOT sell your personal data. If our practices change, we will provide a "Do Not Sell My Personal Information" link
• Right to Opt-Out of Sharing: Opt-out of sharing your data for cross-context behavioral advertising (we don't engage in this practice)
• Right to Correct: Request correction of inaccurate personal information
• Right to Limit Use of Sensitive Personal Information: We do not collect or use sensitive personal information
• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights

To exercise your CCPA rights, contact us at: [email protected] or call us toll-free (if applicable).

We will verify your identity before processing your request and respond within 45 days.

9d. VCDPA Rights (Virginia Users)

If you are a Virginia resident, you have rights under the Virginia Consumer Data Protection Act (VCDPA):

• Right to Access: Confirm whether we process your personal data and access that data
• Right to Correct: Correct inaccuracies in your personal data
• Right to Delete: Request deletion of your personal data
• Right to Data Portability: Obtain a copy of your data in a portable format
• Right to Opt-Out: Opt-out of targeted advertising, sale of personal data, and profiling (we don't engage in these practices)

To exercise your VCDPA rights, contact us at: [email protected]. We will respond to your request within 45 days.

If we decline your request, you may appeal the decision by contacting us at [email protected].

9e. LGPD Rights (Brazil Users)

If you are a resident of Brazil, you have rights under the Lei Geral de Proteção de Dados (LGPD) - Brazil's General Data Protection Law:

• Right to Confirmation and Access: Confirm the existence of data processing and access your personal data
• Right to Correction: Request correction of incomplete, inaccurate, or outdated data
• Right to Anonymization, Blocking, or Deletion: Request anonymization, blocking, or deletion of unnecessary or excessive data
• Right to Data Portability: Request transfer of your data to another service provider
• Right to Deletion: Request deletion of data processed with your consent
• Right to Information: Receive information about public and private entities with which we share data
• Right to Information about Consent: Be informed about the possibility and consequences of not providing consent
• Right to Withdraw Consent: Revoke your consent at any time
• Right to Object: Object to processing that violates LGPD
• Right to Review: Request review of automated decisions

To exercise your LGPD rights, contact us at: [email protected]

You can also file a complaint with the Brazilian National Data Protection Authority (ANPD) at: https://www.gov.br/anpd

10. Changes to This Policy

We may update this privacy policy from time to time. We will notify you of any changes by posting the new policy on this page and updating the "Last updated" date.

11. Permissions Explained

LizMusic requests the following permissions to provide its features. All permissions are used only for their stated purpose:

• Internet Access (INTERNET): Required for cloud storage synchronization with your own cloud accounts, app updates, subscriptions, optional analytics, optional ads, and limited-release online services
• Network State (ACCESS_NETWORK_STATE): Used to determine connectivity status for playback reliability, cloud access, analytics, ad loading, and update behavior
• Storage/Media Access (READ_EXTERNAL_STORAGE, READ_MEDIA_AUDIO): To read and play your music files from device storage. On Android 12 and below, READ_EXTERNAL_STORAGE is used for local music scanning and playback compatibility. On Android 13+, we use READ_MEDIA_AUDIO for more granular media-only access
• Storage Write Access (WRITE_EXTERNAL_STORAGE): Used only on Android 9 and below to save playlists and app data to external storage
• Foreground Service (FOREGROUND_SERVICE, FOREGROUND_SERVICE_MEDIA_PLAYBACK): To keep music playing in the background and display persistent playback notifications
• Notifications (POST_NOTIFICATIONS): To display playback controls, now-playing information, and media notifications (Android 13+ requires explicit permission)
• Wake Lock (WAKE_LOCK): To prevent the device from sleeping during active playback sessions
• Bluetooth (BLUETOOTH, BLUETOOTH_CONNECT): To connect to car audio systems, wireless headphones, and speakers for playback control and audio output
• Boot Completed (RECEIVE_BOOT_COMPLETED): Optional feature to restore playback state or resume widgets when device reboots

You can revoke any permission at any time through your device settings (Settings → Apps → LizMusic → Permissions). Some features may not work if related permissions are denied.

12. Contact Us

If you have any questions about this privacy policy, please contact us at:

Email: [email protected]