Privacy Policy
Effective date: 2026-10-24
1. What we collect
When you sign in with Google, we receive your Google account identifier, email address, name, and profile picture URL to create and identify your account. Your favorites, ratings, play history, playlists, and preferences in Cantabile are stored on your own Cantabile Core.
2. What we do not collect
We do not collect your audio files, file contents, lyrics, location, device fingerprints, or advertising identifiers, and we do not perform behavioral analytics or cross-site tracking.
3. Audio files
Cantabile never hosts, relays, or stores anyone's audio files. During playback, audio is sent directly from your own music source (such as Core on your own NAS or computer) to your browser.
4. Cookies
The portal uses one HttpOnly sign-in session cookie (valid for 30 days) and a 10-minute state cookie during the Google sign-in flow. Your Core also uses a sign-in cookie on its own domain. There are no tracking cookies.
5. Third parties
Sign-in is provided by Google and is subject to Google's privacy policy. Music metadata comes from MusicBrainz and Wikipedia (CC BY-SA); artwork search may use iTunes Search (Apple) and Cover Art Archive.
Lyrics (LRCLIB)
Your Core sends the track title, artist, album and duration to LRCLIB only when you open a song's lyrics page and no same-name .lrc exists locally. It never prefetches in the background and never fetches the next track. Retrieved lyrics are stored on your own Core and work fully offline afterwards; you can switch LRCLIB off in settings.
Album notes and biographies (Wikipedia / MusicBrainz)
Your Core sends an album's title and artist name to Wikipedia only when you open that album's or artist's page and nothing exists yet in that language; if Wikipedia has nothing for an album, it then checks MusicBrainz release annotations (Japanese uses Wikipedia only). A lookup is remembered for 90 days, so reopening the page does not query again. You can also turn both sources off in Settings. Fetched text is stored in your own Core and used fully offline afterwards.
Automatic lookup runs only when no language has content and retains Core's existing administrator permission requirement. Only confirmed misses are remembered for 90 days; temporary failures are retried on the next page visit. Manual retries and batch enrichment in Settings are separate actions you initiate.
6. Retention and deletion
Signing out clears your session. The data the portal holds (Google identifier, email, name, picture URL and your list of Core URLs) can be exported in one click, or your account deleted, from the portal's Account page; deletion is immediate and cannot be undone by you. Your Core and the music, favourites, ratings, playlists and listening history inside it are not deleted — that data lives only on your own device; use Core's backup and export.
7. Contact
For privacy questions you can write to privacy@bluer.synology.me. Note: this address sits on a Synology DDNS domain with no MX records, so it may not receive mail — please use the portal's Account page for deletion and export instead of emailing.