DAVamp Privacy Policy
This policy explains how DAVamp, the Android music player published by M87 Labs LLC ("M87 Labs", "we", "us"), handles information. It covers the app with the package name com.m87labs.davamp. Our general M87 Labs privacy policy covers this website and email contact.
The short version
- DAVamp plays music you already have: on your phone, on a shared folder at home, on your own server, or in your own cloud storage.
- Your music, your library, your sign-in details and your listening history stay on your phone. They are never sent to M87 Labs.
- Passwords and sign-in keys for your music sources are stored encrypted on your phone.
- There are no ads, no analytics, no tracking and no accounts with us.
- If DAVamp crashes or freezes, it sends a crash report to M87 Labs automatically so we can fix the problem. Personal details are removed first, and you can switch this off in Settings › Privacy.
- To fill in missing covers, years, genres and lyrics, DAVamp asks a few free public music databases. It sends them song, artist and album names, nothing that identifies you.
- To run the 7-day free week and the one-time unlock fairly, DAVamp checks in with a small M87 Labs licence server. It stores a one-way hashed device identifier and dates, not your name, email or music.
What stays on your phone
DAVamp keeps these in the app's private storage on your phone:
- your music library list, likes, playlists, play history and listening stats;
- your settings;
- covers, song details and lyrics it found;
- songs you saved for offline listening, and a temporary cache of recently played songs;
- sign-in details for your music sources (server address, username, password, access token or private key). Passwords, tokens and keys are encrypted with a key held in Android's secure key store (Android Keystore) on your phone, and they are excluded from Android's cloud backup and device-to-device transfer.
Crash reports are also saved on your phone (the last five), and you can share the latest one yourself from Settings › Privacy › Crash reports. Unless you switch it off, a copy is also sent to M87 Labs automatically: see Crash reports.
Technical logs. To help solve library problems, DAVamp writes a few plain-text log files to your phone's Download folder. Web addresses and passwords are left out. They never leave your phone unless you send them to someone, and you can delete them from Download at any time.
Removing a music source deletes its sign-in details. Uninstalling DAVamp, or clearing its storage in Android's settings, deletes everything above except the log files in Download.
Your music sources
DAVamp only connects to the places you add:
- folders on the phone or SD card, opened only through Android's folder picker and only the folders you pick;
- WebDAV servers (for example Koofr, pCloud, HiDrive, Yandex Disk or Nextcloud);
- Windows or NAS shared folders (SMB);
- SFTP servers;
- Jellyfin servers;
- Navidrome and other Subsonic-compatible servers;
- Google Drive, Dropbox and OneDrive (see the sections below).
DAVamp sends each source your sign-in details and asks it for the folder lists and songs it needs. It only reads from your sources, unless you ask for one of these:
- Send plays to the server (off unless you turn it on for a source): tells your Navidrome/Subsonic or Jellyfin server which songs you played.
- Save to source for a cover or song details you edited: writes that change into the file on your source.
- Backup copy of your DAVamp data: saves the backup file on a source you choose.
These sources are run by you or by a provider you chose, and what they do with data is governed by their own terms and privacy policies. "Find on this network" (Windows/NAS) only looks on your local network, and only when you tap it.
DAVamp uses an encrypted connection (HTTPS, or SFTP's own encryption) when your source supports it. You can add a plain http:// address for a server on your home network; DAVamp warns you that such a connection isn't encrypted.
Google Drive and your Google user data
Google Drive is available in the full version. If you add it, you sign in with Google on your phone and allow DAVamp to see and download your Google Drive files (Google's drive.readonly permission). DAVamp can't change, delete, upload or share anything in your Drive.
What DAVamp reads, and why:
- file and folder names, sizes, dates and folder structure in the folders you choose, to show them in the folder picker and find your songs;
- the contents of music files and cover pictures (such as cover.jpg), to play them, read their song details and embedded covers, and keep offline copies you ask for;
- your Google account's email address and name, to show which account a source belongs to;
- a list of what changed since the last update, so DAVamp only re-reads changed folders.
Other files (documents, photos and so on) are skipped and never downloaded.
Where it goes: only to your phone. DAVamp downloads directly from Google's servers to the app on your phone. Nothing from your Google Drive, including file names, file contents and your account details, is sent to M87 Labs, to our licence server or to anyone else. Your library list, covers and offline copies stay in the app's private storage, as for any other source. The only exception is the same one that applies to every source: song, artist and album names may be sent to the music information services listed below to fill in missing details.
Sign-in: Google Play services handles your Google password; DAVamp never sees it. DAVamp gets a short-lived access key from Google Play services when it needs one and keeps it only in memory.
Stopping access: removing the Google Drive source in DAVamp asks Google to remove DAVamp's access. You can also remove access at any time at myaccount.google.com/permissions.
Google API Limited Use disclosure. DAVamp's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. DAVamp uses Google Drive data only to provide the music playback and library features you see in the app. It does not use or transfer that data for advertising, does not sell it, does not use it to determine creditworthiness, does not transfer it to anyone, and no person reads it.
Dropbox
Dropbox is available in the full version. If you add it, you sign in on Dropbox's own page and allow DAVamp to see your files and folders, read their contents, and see your basic account details (Dropbox's files.metadata.read, files.content.read and account_info.read permissions). DAVamp can't change, delete, upload or share anything in your Dropbox.
DAVamp reads the same kinds of information as for Google Drive above, for the same reasons. Everything goes directly from Dropbox to the app on your phone, never to M87 Labs or anyone else.
Sign-in: Dropbox handles your password; DAVamp never sees it. The sign-in key Dropbox gives DAVamp is stored encrypted on your phone (Android Keystore) and is not included in Android backups. Removing the Dropbox source asks Dropbox to cancel DAVamp's access and deletes the key from your phone. You can also remove access in Dropbox's settings under "Connected apps".
OneDrive
OneDrive (personal Microsoft accounts) is available in the full version. If you add it, you sign in on Microsoft's own page and allow DAVamp to read your OneDrive files and see your basic account details (Microsoft's Files.Read, offline_access, openid, profile and email permissions). DAVamp can't change, delete, upload or share anything in your OneDrive.
DAVamp reads the same kinds of information as for Google Drive above, for the same reasons. Everything goes directly from Microsoft to the app on your phone, never to M87 Labs or anyone else.
Sign-in: Microsoft handles your password; DAVamp never sees it. The sign-in key Microsoft gives DAVamp is stored encrypted on your phone (Android Keystore) and is not included in Android backups. Removing the OneDrive source deletes the key from your phone. You can also remove DAVamp's access at account.live.com/consent/Manage.
Music information services
To fill in details your files are missing, DAVamp sends song, artist and album names to these free public services. No account is involved, and they don't receive your sign-in details, your files, or an identifier for you or your phone.
| Service | What it receives | When |
|---|---|---|
| MusicBrainz (musicbrainz.org, run by the MetaBrainz Foundation) | Song title, artist and album names. Also the app's name and version and our contact email (support@m87labs.dev), as MusicBrainz asks apps to do. | Automatically in the background, to find years, genres, album details and covers; and when you search for a cover. |
| Cover Art Archive (coverartarchive.org, MetaBrainz with the Internet Archive) | The MusicBrainz album number, to download its cover. | When a cover is looked up. |
| Deezer public API (api.deezer.com) | Song title and artist name as a search, then the matching album's Deezer number. The app's name and version. | Automatically in the background, only for songs with no genre that MusicBrainz couldn't find a genre for. |
| LRCLIB (lrclib.net) | Song title, artist, album name and song length. The app's name and version. | Only when you tap "Search online" for lyrics. You can turn this off in Settings › Library. |
Like any website, these services can see your phone's internet (IP) address when DAVamp contacts them. Their own privacy policies apply: MetaBrainz, Internet Archive, Deezer and LRCLIB.
Results (covers, years, genres, lyrics) are saved on your phone only. They are never written into your music files unless you choose "Save to source".
Free week, unlock and our licence server
Google Play Billing. DAVamp is free for 7 days. After that, a one-time in-app purchase through Google Play unlocks it. Google Play handles the payment under Google's privacy policy; DAVamp never sees your payment details. DAVamp asks Google Play on your phone whether your Google account bought the unlock and keeps that answer on the phone, encrypted, so it also works offline. M87 Labs receives Google's standard sales reports for the purchase, which never include your library or listening data.
On your phone and in your Google backup. DAVamp saves the date your free week started on the phone and in Google's Block Store (part of your Google account backup), so reinstalling doesn't restart the week. It holds only dates. To stop the phone's clock being turned back, DAVamp also asks Google's servers for the current time with an empty request and reads only the time from the answer.
The M87 Labs licence server (api.m87labs.dev). DAVamp checks in with a small server run by M87 Labs on Cloudflare. It is used only to make the free week and the unlock work fairly:
- Free week: the app sends a random identifier for your phone. The server stores only a one-way, keyed hash of it (it can't be turned back into the original), the date it first saw that phone (your free-week start) and the date it last checked in.
- Purchase check: when you buy or restore the unlock, the app sends the Google Play purchase token. The server asks Google directly whether the purchase is real and not refunded. It stores a one-way hash of the token, the purchase status and time, Google's order number, and which hashed phone identifiers use that purchase, so that one purchase can't be shared across many phones. It regularly checks Google's list of refunded purchases.
- Play Integrity: the app may also send a Google Play Integrity token, which the server asks Google to decode to confirm that the request comes from a genuine copy of DAVamp installed from Google Play. Only the yes/no results are used; they are not stored.
- What it doesn't receive: your name, email address, Google account, contacts, location, music, library, listening history or anything from your music sources.
- Your phone's IP address is used briefly to limit how many requests one address can make. It is not stored in the licence database. Cloudflare, which hosts the server, processes requests under its own privacy policy.
- Retention: these records are kept for as long as DAVamp is offered, because they are needed to keep your unlock working and to stop the free week from restarting. You can ask us to delete them at any time (see Your choices). A paid unlock keeps working after deletion, because it is checked with Google again.
If the licence server can't be reached, DAVamp keeps using its last answer for a while, so you can still listen offline.
Crash reports
If DAVamp crashes, or Android reports that it stopped responding (an "ANR", Android 11 and later), DAVamp saves a report on your phone and sends it to M87 Labs' own server (api.m87labs.dev, the same Cloudflare server as the licence check) the next time you're online. This happens automatically, without asking each time. Sending is on by default and you can switch it off at any time in Settings › Privacy › Send crash reports automatically. When it's off, reports stay on your phone only, and any report still waiting to be sent is deleted.
What a report contains:
- the technical error: the type of error and the list of places in DAVamp's code where it happened (the "stack trace"), and for a freeze, what the app's main thread was doing;
- the DAVamp version, the Android version, and the phone's maker and model (for example "Google Pixel 8");
- how long the app had been running, the name of the part of the app (thread) that failed, and when it happened;
- the same one-way, keyed hash of a random phone identifier that the licence server uses, so we can tell whether one crash affects many phones or one phone many times.
What is removed or never included: before a report leaves your phone, DAVamp removes web and server addresses, host names, IP addresses, user names, passwords, sign-in keys and tokens, email addresses, folder and file paths and file names, and song, artist and album names (and other quoted or labelled text). Reports never include your music, your library, your playlists, your listening history, your settings or anything from your music sources. Your phone's IP address is used briefly to limit how many reports one address can send and is not stored with the report.
How it's used and kept: crash reports are used only to find and fix bugs in DAVamp. They are not used for advertising or profiling, not sold and not shared. Identical crashes are grouped together; we keep a count, the dates and the DAVamp versions affected, plus a few recent example reports. Reports and groups are deleted automatically 90 days after they were last seen. You can ask us to delete them sooner (see Your choices).
Playing on a TV or speaker (Google Cast)
When you play on a Chromecast, Google TV or Nest speaker, DAVamp sends it the song's title, artist, album and cover, and the TV or speaker fetches the song itself from a small server DAVamp runs on your phone. That server runs only while you're casting, can only be reached on your local network, and only hands out the songs in the cast queue, behind a random key that changes every time. Your songs don't go through the internet or to M87 Labs.
Google's Cast software in DAVamp finds TVs and speakers on your network and, according to Google, sends Google anonymous information about how casting is used (for example, that a device was found or a cast started, the phone model and DAVamp's version) to improve casting. See Google's Cast data disclosure.
Android Auto
DAVamp shows your library on your car's screen through Google's Android Auto app on your phone. Browsing and playback happen on your phone; DAVamp doesn't send anything to M87 Labs or to Google for this.
Backups
Settings › Backup & restore makes a backup file only when you ask, and saves it where you choose (on your phone or on one of your sources). It contains your settings, likes, playlists, play history, stats and the list of your music sources. Passwords are left out unless you tick "include passwords" and choose a backup passphrase; they are then encrypted with that passphrase (AES-256). Your unlock record and cloud sign-in keys are never included in a backup file. Keep backup files somewhere private.
DAVamp's sign-in details are excluded from Android's own cloud backup and device-to-device transfer.
No ads, no analytics, no tracking
DAVamp shows no ads and contains no third-party advertising, analytics, crash-reporting or tracking software: no Firebase Analytics, no Crashlytics and no similar services. DAVamp's own crash reports (see Crash reports) go only to M87 Labs and are used only to fix bugs. We don't build profiles, we don't sell data, and we don't share data with data brokers.
DAVamp does include Google's own libraries for Google Play Billing, Google Cast, Google sign-in and Block Store. These are part of Google Play services and may send Google technical diagnostic information under Google's privacy policy.
Permissions
- Internet and network state: to play from your sources, look up music details, check the free week and unlock, and send crash reports.
- Foreground service (media playback, data sync): to keep playing with the screen off, and to finish a library update you started.
- Keep the phone awake: so playback and downloads don't stop when the screen turns off.
- Run at start-up: to restart scheduled jobs (such as offline downloads and sending a waiting crash report) after a restart.
- Notifications: to show what's playing and the progress of a library update.
- Google Play billing: to offer the one-time unlock.
DAVamp doesn't ask for your location, contacts, camera, microphone or the phone's media library.
Children
DAVamp isn't designed for or directed at children under 13, and we don't knowingly collect personal information from children. If you believe a child has provided us with personal information, contact support@m87labs.dev and we will delete it.
Your choices and deleting your data
- Turn off online lyrics search in Settings › Library.
- Turn off automatic crash reports in Settings › Privacy › Send crash reports automatically.
- Remove a music source, its offline songs or its sign-in details at any time in the app.
- Delete everything DAVamp keeps on your phone by uninstalling it or clearing its storage.
- To have your licence server records or crash reports deleted, email support@m87labs.dev. Because we don't know who you are, we may ask for your Google Play order number so we can find the right records.
For data the music information services or your source providers may hold, contact them directly.
Changes
If this policy changes, we will post the new version on this page and update the effective date above. If a change is significant, we may also tell you in the app.
Contact
Questions about this policy or about DAVamp: M87 Labs LLC, support@m87labs.dev.