Privacy Policy

1. Plain-language summary

• DYSC connects to the media service or server selected by you.
• Jellyfin and Navidrome/OpenSubsonic traffic normally goes directly between your device and the server address you enter.
• Plex sign-in, account linking, server discovery, and some API requests use Plex-hosted services before DYSC connects to an available Plex Media Server.
• Connection details, account identifiers, passwords where required by the selected protocol, and access or API tokens may be stored on your device using the iOS Keychain.
• Music, artwork, library metadata, preferences, searches, and downloads may be cached or stored locally on your device.
• The current app does not include advertising, cross-app tracking, or developer-operated analytics.

2. Information handled by the app

Server addresses and sign-in information

The information DYSC handles depends on the service you connect. It can include a server address, username, password, user or account identifier, client identifier, access token, API key, authentication token, and information returned about the available servers or libraries. DYSC stores only the connection material needed to keep the selected connection working. Sensitive saved connection material is kept in the iOS Keychain.

Jellyfin

DYSC sends the server address, username, and password from your device to the Jellyfin server you select. The password is used for sign-in and is not retained after a successful Jellyfin authentication. DYSC stores the server address, username, Jellyfin user ID, and access token in the iOS Keychain so that you can remain signed in.

Plex

Plex account linking uses Plex-hosted authentication and API services. DYSC may send a temporary linking identifier or PIN, the DYSC client name and version, a client or device identifier, and related request information to Plex. Plex returns an authentication token and information about resources available to the signed-in Plex account. DYSC does not receive or store your Plex account password when the hosted Plex sign-in flow is used. The Plex token and selected server connection information may be stored in the iOS Keychain. Later requests may be sent to Plex-hosted APIs, a selected Plex Media Server, or a Plex relay, depending on availability and your Plex setup.

Navidrome and OpenSubsonic

For a Navidrome or other OpenSubsonic-compatible server, DYSC may handle the server address, username, password, or a server-issued API key. Depending on what the server supports, DYSC may use the password locally to create a per-request authentication token and salt, use an API key, or use another server-supported method. A password or API/access token may need to remain in the iOS Keychain while the connection is saved. Legacy server configurations may require the password itself to be transmitted to the selected server. OpenSubsonic authentication values can be carried in request parameters and may appear in server or reverse-proxy logs unless the operator redacts them. Use HTTPS, and use a revocable API key where the server supports one.

Device and client identification

DYSC may send the device name, a client identifier assigned to DYSC on the device, the DYSC client name, app version, operating-system information, and network address to the selected service. This lets the service identify, authorise, secure, and manage the client session. The service or server operator may display or retain this information in account, device, session, security, or access logs.

Library, playback, and server activity

To provide its features, DYSC requests and displays artists, albums, tracks, playlists, lyrics, artwork, favourites, and related metadata. DYSC may send searches, playback start, progress, pause, scrobble, and stop events to the selected service. Actions such as favouriting or rating an item, creating or editing a playlist, reordering tracks, deleting a playlist, and changing a playlist cover are also sent to the service or server when you use those features.

Photos selected by you

If you choose a photo as a mixtape or playlist cover, iOS provides the selected image to DYSC. DYSC prepares an uploadable version and sends it to the selected service or server. DYSC does not request unrestricted access to your entire photo library for this feature.

Information stored on your device

Depending on the connection and features you use, DYSC may store:

• saved connections and credentials in the iOS Keychain;
• library snapshots, playlist information, lyrics, artwork, and playback state in Application Support or cache storage;
• downloaded music, downloaded artwork, and temporary streaming cache files;
• app, playback, appearance, library, network, and download preferences;
• recent searches, custom radio stations, and other locally created settings; and
• local notification preferences and Album of the Day state.

Some local information may be included in an iCloud or device backup according to your Apple settings and iOS backup rules. Disposable caches may be removed by iOS without notice.

Notifications

If you enable Album of the Day notifications, DYSC asks iOS for notification permission and schedules notifications locally on your device. DYSC does not use a developer-operated push-notification service for this feature.

3. Third-party services and server operators

A server may be operated by you, by someone who has given you access, or by a third-party provider. That operator independently controls its accounts, logs, security, backups, retention, and other processing. Review the operator's privacy information before connecting. We cannot access, correct, or delete information held by a service or server that we do not operate.

Plex processes information used for Plex sign-in, account linking, resource discovery, API access, relays, and other Plex-hosted functionality under the Plex Privacy Policy. Plex may receive account and client identifiers, IP address and network information, sign-in and request metadata, and information associated with use of the Plex services. Your use of Plex is also subject to the Plex Terms of Service.

Jellyfin, Plex, Navidrome, OpenSubsonic, and their names and logos are the property of their respective owners. Compatibility references are descriptive only and do not imply affiliation, sponsorship, certification, or endorsement.

4. Information received by us

App usage

DYSC does not operate a backend through which your self-hosted library traffic passes. The current app does not send your music library, credentials, playback history, device identifier, or app-usage analytics to us. We do not use this information for advertising and do not sell it. This does not mean that the service or server you choose receives no information; those transfers are described above.

Beta requests and correspondence

If you email us, request support, report a security issue, or join an active beta mailing list, we receive the information you choose to provide. This can include your email address, name, app and iOS versions, device model, service and server version, diagnostic information, screenshots, and the content of your message. Please do not send a password, access token, API key, Plex linking PIN, private media, or an unrestricted server account.

The beta form in the current website preview saves an entered email address only in that browser and does not transmit it to DYSC. This policy will be updated before a hosted form or mailing-list provider begins collecting beta registrations.

Apple services

Apple may process information when you download DYSC through the App Store or TestFlight, submit TestFlight feedback, use iCloud or device backups, or share diagnostics under your Apple device settings. Apple handles that information under its own agreements and privacy policy.

5. How information is used

Information received directly by us is used only as reasonably necessary to:

• manage beta invitations and communicate about the beta;
• answer support, privacy, and security enquiries;
• investigate crashes, defects, compatibility problems, or abuse;
• improve DYSC using feedback you choose to provide; and
• meet legal, security, accounting, or regulatory obligations.

Where data-protection law requires a legal basis, we rely on steps requested by you, performance of an agreement with you, our legitimate interests in operating and securing DYSC, your consent where requested, or compliance with legal obligations. You may withdraw consent at any time without affecting processing that occurred before withdrawal.

6. Sharing and disclosure

Information may be disclosed in the following circumstances:

• At your direction: DYSC sends information to the service, server, or server operator you select so it can perform the actions you request.
• Plex-hosted functions: information required for account linking, discovery, API access, and related Plex functions is sent to Plex.
• Service providers: providers that supply email, website hosting, beta distribution, or technical infrastructure may process limited information on our behalf and only for the relevant service.
• Legal and safety reasons: information may be disclosed where reasonably necessary to comply with law, protect rights or safety, investigate fraud or abuse, or establish or defend legal claims.
• Business transfer: responsibility for DYSC may be reorganised or transferred, subject to appropriate confidentiality and notice where required.

We do not sell personal information and do not share it for cross-context behavioural advertising.

Providers and server operators may process information in countries other than yours. Their transfers are governed by their own arrangements. Where we appoint a provider to process information for us, we use contractual or other legally recognised safeguards where applicable.

7. Storage, retention, and deletion

• Saved connection details and credentials remain in the iOS Keychain until you sign out, remove that connection, or the retained Keychain item is otherwise erased. Keychain items may persist after the app itself is deleted.
• Library snapshots and other Application Support data remain until refreshed, cleared, reset, signed out where the relevant feature supports that, or removed with the app.
• Caches remain until cleared by you, removed by iOS, replaced by newer data, or removed with the app.
• Downloads remain until you remove them or remove the app.
• Preferences, searches, radio stations, and other local settings remain until reset, individually cleared where supported, or removed with the app.
• Beta-list information is retained until you unsubscribe, ask for deletion, or for no more than 24 months after our last beta-related interaction.
• Ordinary support correspondence is normally retained for no more than 24 months after the last interaction.
• Security reports may be retained for up to 36 months, or longer where reasonably necessary to address an ongoing issue or legal obligation.

Signing out removes DYSC's locally saved credential for that connection, but it does not necessarily revoke a token or authorised-device grant held by the service. For Plex, remove DYSC from authorised devices or otherwise revoke access in your Plex account if you want to invalidate the Plex grant. For an OpenSubsonic API key, revoke the key in the server if that function is available.

Server-side and Plex-hosted retention is controlled by the relevant provider or server operator. Signing out of DYSC does not delete a third-party account, service logs, playlists, favourites, playback records, or other data stored there.

8. Your choices and rights

You can:

• disable playback reporting in DYSC settings where that option is available;
• change notification and local-network permissions in iOS Settings;
• clear cached library data and artwork;
• clear recent searches and remove individual downloads or all downloaded music;
• sign out of or remove each saved connection to delete its saved DYSC credential from the Keychain;
• revoke DYSC tokens or authorised-device access in the relevant provider or server account; and
• sign out, clear downloads, and then delete the app to remove its ordinary local data, subject to normal iOS Keychain and backup behaviour.

Depending on where you live, you may have rights to access, correct, delete, restrict, or receive a copy of personal information held by us, or to object to certain use. You may also withdraw consent and complain to your local data-protection authority. Email support@dysc.app to exercise a right. We may need to verify your request.

Account and server-side deletion

DYSC does not create or control a DYSC account. To delete a Jellyfin, Plex, Navidrome, OpenSubsonic, or other server account, or to delete data stored by that service, use the provider's controls or contact the relevant server administrator. We cannot perform that deletion unless we operate the relevant system.

9. Security and server connections

DYSC uses the iOS Keychain for saved connection credentials and relies on iOS protections for local app data. No method of storage or transmission is completely secure. Treat passwords, API keys, access tokens, Plex linking PINs, and diagnostic logs as confidential.

Use HTTPS for any server reachable over the internet. If you choose an HTTP connection, credentials, tokens, metadata, searches, media, and playback traffic may travel without transport encryption and may be observable or altered by others on the network. A salted OpenSubsonic token does not encrypt the rest of an HTTP request or media stream. You are responsible for the configuration and security of a server and network you operate or select.

10. Children, changes, and contact

DYSC is not directed specifically to children and we do not knowingly collect personal information from children through a DYSC-operated service. A parent or guardian who believes a child has sent information directly to us should contact us so that we can review and, where appropriate, delete it.

We may update this policy when DYSC, its supported services, its providers, or legal requirements change. The effective date above will be revised, and material changes will be communicated in the app or on the website where appropriate.

Privacy enquiries can be sent to support@dysc.app.