Privacy Policy

Coda is a self-hosted music player for iOS and Android. This policy explains what data Coda handles, how it is stored, and what (if anything) leaves your device.

What the app does with your data

Coda stores everything locally on your device. There is no Coda-owned server, no account system, and no cloud sync. Your music library, playlists, queue, playback position, equalizer settings, and lyrics cache all live in your device's local storage and never leave it.

Navidrome credentials

If you connect to a Navidrome server, your server URL, username, and password are stored on-device. Your password is encrypted with AES-256-GCM before being written to the settings file. The encryption key is held in the device's secure enclave (iOS Keychain / Android Keystore). Your server URL and username are stored in plaintext alongside the encrypted password because they are needed to display in the app and to connect to your server.

Last.fm credentials

If you connect a Last.fm account (entirely optional), your API key, shared secret, and session key are encrypted with AES-256-GCM and stored on-device using the same mechanism. Your Last.fm username is stored in plaintext. Last.fm data is only transmitted to Last.fm's API when you have explicitly connected your account — scrobbling artist name, track title, album, and duration.

Network requests

Coda makes network requests to exactly three destinations:

• Your own Navidrome server — to stream music, fetch artwork, and browse your library. This is the server you configured; Coda does not know or control what it logs.
• Last.fm (opt-in only) — to scrobble plays and update now-playing status. Only artist name, track title, album, and duration are sent.
• LRCLIB — to fetch synced lyrics. Only the track title and artist name are sent. No user-identifying information is transmitted.

Coda does not send data to any other server. There is no analytics, no telemetry, no crash reporting, and no phone-home behavior in the app.

What the website does with data

The Coda website (codamusicplayer.vercel.app) uses two data mechanisms:

Download counter

When you download Coda, the website records an anonymous, non-identifying count. A small flag is stored in your browser's localStorage (coda_download_counted) to prevent the same device from counting twice. The counter endpoint uses your IP address only for brief, in-memory rate limiting (to prevent abuse) — your IP is never logged, stored persistently, or transmitted anywhere. The rate-limit data is discarded when the server restarts.

Analytics

The website uses Vercel Analytics, which tracks anonymous page views (which pages are visited, referrer, browser/viewport metadata). It is cookie-free and does not collect personal identifiers.

Third-party services

Coda integrates with services that are outside Coda's control:

• Your Navidrome server — operated by you or your hosting provider. Its privacy practices are governed by your own configuration.
• Last.fm — if you connect your account, Last.fm's own privacy policy applies to the data you send it.
• LRCLIB — an open lyrics database. Only track metadata is sent; no account is required.

No sale of data, no ads

Coda does not sell, share, or monetize your data in any way. There are no ads, no tracking pixels, no ad SDKs, and no data brokerage. The app is free, open-source in spirit (the issue tracker is public at graphicsprocessingunit/coda-issues), and funded entirely by the developer's own time.

Contact

For privacy-related questions or concerns, open an issue at coda-issues or reach out via the contact methods listed on the Coda website.