Privacy Policy

Last updated November 1, 2026

Riyaaz plays music from a Navidrome or other Subsonic server that you run or have an account on. It has no music of its own, no Riyaaz account and no Riyaaz server. Nothing is sent to the developer.

On your device

• Server addresses and usernames, with passwords in the iOS Keychain.
• Settings, including the equalizer, AutoEQ profiles you paste in, crossfade and stream quality.
• Songs you download, cached cover art and your recently played list.

Sent to your server

Riyaaz talks to the server you sign in to, using the Subsonic API: sign-in, browsing and search, streams and downloads, cover art, favorites, ratings, playlist changes, plays (scrobbles), similar songs for autoplay, and lyrics.

Sign-in sends a token made from your password, as the Subsonic API defines. If your server doesn't accept tokens, Riyaaz sends the password itself. Over https this is encrypted. Over plain http it isn't, so use http only on a network you trust, such as your home network.

What your server does with this data, such as forwarding plays to Last.fm or ListenBrainz, is set on the server and covered by its own policy.

Sent to LRCLIB

When your server has no lyrics for a song, Riyaaz asks lrclib.net for them. The request contains the song's title, artist, album and length. It contains no account, name or device identifier. Nothing is sent to LRCLIB in offline mode.

What Riyaaz doesn't do

No analytics, tracking, ads or third-party SDKs.

Deleting your data

Signing out removes your saved servers and passwords. Downloads can be removed from the Downloads screen. Deleting the app removes everything Riyaaz stored on your device.

Contact

Questions: [email protected]