Privacy Policy

Effective date: September 2, 2026 · Last updated: October 17, 2026

Sontrove (“we”, “us”) provides tools for managing and listening to personal media across your devices. This policy explains what information we process, why we process it, and the choices available to you.

Information we process

Account information: email address, password hash, email-verification and password-reset records, account status, and subscription status.
Sign-in information: if you use Google, Facebook, or Apple sign-in, we receive the provider identifier and the basic profile information that the provider makes available, such as an email address when you grant that permission.
Service and device information: device identifiers, node and relay connection information, session tokens, security events, and diagnostic logs needed to authenticate devices, provide remote access, prevent abuse, and troubleshoot the service.
Library information: library indexes, playlists, playback queues, and related metadata needed for the features you use. Your media files live on your own device; we do not provide cloud storage for them. To deliver playback across networks, media data passes through our relay infrastructure in transit, and edge caches may hold it transiently. We do not claim that all media is invisible to our service; privacy-library features have their own documented limitations.
Payment information: subscription and transaction status from our payment provider. Payment-card details are handled by the payment provider and are not stored by Sontrove as card numbers.

Diagnostic data

The diagnostic data below is linked to your account. You decide whether each type is sent.

Connection summaries: The first time you reach the app’s main screen, the app asks whether to share them. Neither answer is preselected. They are uploaded only after you agree. They record whether each connection was direct or relayed, how long it took, how much data it moved, and the network type. They do not include what you listen to, file names, or your full IP address. You can change your choice anytime in Settings under Help & Feedback, and the app stops uploading them once you turn it off. We delete them from our servers 30 days after we receive them. Paid remote listening does not depend on this choice.
Crash reports: After the app closes unexpectedly, it asks the next time you open it whether to send a crash report, and you can view the content first. It contains crash details with personal information removed. It is sent only if you choose to send it. You can also choose to send future crash reports automatically; that option is off by default and can be turned off in Settings under Help & Feedback. We delete each crash report 30 days after we receive it, and you can withdraw it sooner.
Diagnostic reports you send: When you report a problem from the app, you see the full content before sending, and nothing is sent until you confirm. We delete each report 30 days after we receive it. You can withdraw a report anytime under My diagnostic reports in Help & Feedback, which deletes it from our servers.
Network check for diagnostic reports: When you open the diagnostic report screen, the app sends a few probe packets to public STUN servers run by Cloudflare (stun.cloudflare.com) and Google (stun.l.google.com) to identify your network type. These servers see your IP address but not the report contents. The app does not send these probes at other times.

How we use information

We use information to create and secure accounts, verify email addresses, authenticate devices, provide library and remote-access features, process subscriptions, send transactional messages, prevent abuse, comply with legal obligations, and improve reliability.

We share information only as needed to operate the service or comply with law. Depending on the feature, providers may include our hosting and infrastructure providers, Paddle for payments, Resend for transactional email, Google, Meta, or Apple when you choose their sign-in service, and the Cloudflare and Google STUN servers described under Diagnostic data when you open a diagnostic report. We do not sell personal information.

Retention and deletion

You can request deletion from the public web at Account after signing in. The deletion flow requires typing DELETE to confirm, and your current password if your account has one (accounts created through Google, Facebook, or Apple sign-in have no password with us). It removes the account and control-plane data immediately; library data may be cleared by a background purge. The service may retain the minimum device revocation identifiers until associated certificates expire (up to 365 days), legally required transaction records held by the payment provider, and limited abuse-prevention records when required to enforce a repeat-infringer policy.

See Account and data deletion for the complete procedure and scope.

Your choices and rights

You may access or correct account information through the account interface, disconnect a social sign-in by stopping its use, and request deletion. You may also contact us about access, correction, or deletion requests.

Security

We use access controls, token revocation, password hashing, encrypted transport, and operational logging appropriate to the service. No internet service can guarantee absolute security.

Open-source source code requests

Our apps include open-source components licensed under the GNU Lesser General Public License, version 2.1 (LGPL-2.1), such as FFmpeg. You can request the corresponding source code of these components, and the materials needed to relink the app with a modified version of them, by emailing the address under Contact below. We provide them free of charge for at least three years after each app release. We also publish them at https://get.sontrove.com/oss/, organized by platform and app version.

Contact

For privacy questions or requests, email contact@cedarkeel.com. We may ask for information needed to verify that a request concerns your account.