PrivacyPolicy
homecrate does not collect personal information. Your music library stays on your device. Your listening habits stay on your device. Your recordings stay on your device.
The only network requests the app makes are to fetch lyrics and album artwork from homecrate's own servers — using only song title and artist name, no user identifier — and to communicate with your own Plex server if you choose to connect one.
If you connect Plex: your server URL and token are stored in the iOS Keychain, encrypted on your device, and never sent to homecrate's servers. Nothing is sold. Nothing is shared with advertisers. There are no third-party analytics SDKs in the app.
1. Who We Are
homecrate is an iOS music player developed and operated by a sole developer. For privacy questions, contact anthony@broken.place. For general information, visit homecrate.app.
2. What homecrate Does Not Collect
homecrate is designed to avoid data collection. The following is an explicit list of data the app does not collect, transmit, or store on any server:
- Your music library contents, file names, or listening history
- Your listening habits, play counts, skip patterns, or preferences
- Your location — Weather Mood reads conditions from the Apple WeatherKit API on-device; no location data is transmitted to homecrate servers
- Your name, email address, or any account credentials — homecrate has no accounts
- Your device identifier, advertising identifier (IDFA), or any persistent device-level ID
- Your recordings made in homecrate Studio
- Your Algorithm Tuner settings or taste profile
- Your Plex server URL, Plex token, or any data from your Plex library — these never reach homecrate's servers
- Crash logs or diagnostics beyond what Apple collects through its standard iOS crash reporting, governed by Apple's privacy policy
3. What Happens When You Use Network Features
Some features make network requests. Every request is initiated by a user action, uses only the minimum information needed, and returns only content — no user data is sent back to any server.
Synced Lyrics (Pro)
When you open the Lyrics view for a track, homecrate sends the song title and artist name to homecrate's own Cloudflare Worker server to retrieve time-synced lyrics. No user identifier, device ID, or account is stored or logged beyond the duration of the request. The result is cached server-side keyed to the song identity only, then discarded after a limited retention period.
Album Artwork
When the app needs artwork not already on your device, it requests it from homecrate's Cloudflare Worker using the album title and artist name. The Worker fetches and caches artwork from open music databases. No user data is transmitted. Cached artwork is stored keyed to album identity only.
Track Facts (Liner Notes)
Track facts displayed in the Liner Notes view are generated on-device using a bundled model. No network request is made. No track information leaves your device for this feature.
Weather Mood
Weather Mood reads current conditions using the Apple WeatherKit framework, which operates on-device or through Apple's servers under Apple's privacy policy. homecrate does not receive, transmit, or store your location. homecrate's servers are not involved in this feature.
Plex Server Integration (Optional)
homecrate can optionally connect to a Plex Media Server you own and control. This feature is disabled by default.
- Your Plex server URL and authentication token are stored in the iOS Keychain, encrypted at rest and excluded from device backups. They are used only to make requests directly from your device to your Plex server.
- homecrate's servers never receive your Plex URL, token, or any data from your Plex library. All Plex communication is device-to-your-server only.
- When connected, homecrate retrieves library metadata, artwork, playlists, and streams audio directly from your Plex server to your device. None of this passes through or is stored by homecrate's infrastructure.
- Disconnecting Plex from within the app clears the stored URL and token from the Keychain.
Your Plex credentials are stored using kSecClassGenericPassword with kSecAttrAccessibleWhenUnlockedThisDeviceOnly — encrypted at rest by the device, excluded from iCloud and local backups, and never transmitted.
App Store and In-App Purchase
Purchases of homecrate Pro are processed entirely by Apple. homecrate does not receive your payment information, Apple ID, or any personal details associated with the purchase. Receipt validation occurs on-device via Apple's StoreKit framework.
4. Data Flow Summary
| Feature | Sent to homecrate servers | Stored by homecrate | User ID included |
|---|---|---|---|
| Synced lyrics (Pro) | Song title, artist name | Cached lyrics — keyed to song | No |
| Album artwork | Album title, artist name | Cached artwork — keyed to album | No |
| Track facts (Liner Notes) | Nothing — on-device | Nothing | No |
| Weather Mood | Nothing — Apple on-device API | Nothing | No |
| Plex sync (optional) | Nothing — device to your server | Nothing | No |
| Algorithm Tuner | Nothing — stored on device | Nothing | No |
| Studio recordings | Nothing — stored on device | Nothing | No |
| Music library | Nothing — never accessed remotely | Nothing | No |
| Pro purchase | Nothing — Apple handles entirely | Nothing | No |
5. Server Logs
homecrate's Cloudflare Worker servers generate standard access logs as part of normal infrastructure operation. These logs may include the IP address of the request, request timestamp, and type of content requested. They do not include which user or device made the request — homecrate has no mechanism to associate a request with a user.
Server logs are retained for a short operational period (typically 24–72 hours) and used only for diagnosing technical issues. They are not analysed for user behaviour, not shared with third parties, and not retained beyond their operational purpose.
6. Third-Party Services
homecrate does not integrate any third-party analytics, advertising, or tracking SDKs. The app does not use Firebase, Amplitude, Mixpanel, the Facebook SDK, Google Analytics, or any SDK that collects behavioural data.
The only third-party infrastructure involved is Cloudflare, which powers homecrate's Worker servers. Cloudflare's privacy practices are governed by the Cloudflare Privacy Policy.
7. Children's Privacy
homecrate does not knowingly collect any information from anyone, including children under the age of 13. Because the app collects no personal data at all, it does not create privacy risks specific to children.
8. Your Rights
Because homecrate does not collect or store personal data linked to you, most data subject rights — access, deletion, portability — have no practical object. There is no personal data about you held on homecrate's servers to access, correct, or delete.
If you believe homecrate has collected data about you that is not described in this policy, contact us at anthony@broken.place. We will investigate and respond within 30 days.
homecrate does not sell personal information and has not done so in the preceding 12 months. homecrate does not share personal information with third parties for cross-context behavioural advertising.
9. Data Retention
The only data homecrate retains server-side is cached content — lyrics and artwork — keyed to song and album identifiers, not to users. This cached content is retained for a limited operational period and then discarded automatically. There is no user-linked data to retain or delete.
10. Security
All communication between the app and homecrate's servers is encrypted in transit via HTTPS/TLS. Server infrastructure runs on Cloudflare Workers with DDoS protection and security hardening. Because no personal data is stored, the attack surface for a data breach involving user information is effectively zero.
11. Changes to This Policy
If homecrate introduces a feature that changes the data practices described here, this policy will be updated before that feature ships. The effective date at the top will be updated. For material changes — any change that results in new personal data being collected — a notice will be posted on homecrate.app.
Given that homecrate is designed to minimise data collection, material changes are not anticipated.
12. Contact
For privacy questions or concerns: anthony@broken.place
homecrate · homecrate.app · iOS only