Website visits
The Lagu website carries no advertising, no tracking pixels, and no third-party social widgets. To see how the site is used — which pages are read, where visitors arrive from, how many go on to join the list — we run Umami, an open-source analytics tool, on our own infrastructure. It uses no cookies and stores nothing on your device. Visits are counted against a short-lived anonymous identifier rather than a profile of you, the data stays on infrastructure we operate, and it is never shared or sold. The script is served from lagu.fm itself and honors your browser’s Do Not Track setting.
Downloads are counted the same way, from our server rather than by the script: when you download Lagu or follow a TestFlight or Google Play link from this site, the link records which platform and version it handed out before sending you on. If your browser sends Do Not Track or Global Privacy Control, the download is still counted, but without your IP address or the page you came from, so it adds to the total and says nothing about you.
Separately, our hosting and Cloudflare infrastructure may retain ordinary technical logs and aggregate traffic statistics, such as an IP address, browser type, requested page, timestamp, and security events. These records are used to deliver and protect the site, not to build advertising profiles.
The bug-report, contact, and list forms use Cloudflare Turnstile to filter automated submissions. It loads only on the pages carrying those forms and checks the browser rather than your identity. On the bug and contact forms it appears as a visible check; on the list forms it runs invisibly, with no box to tick. Turnstile is covered by Cloudflare’s privacy policy and its Turnstile Privacy Addendum, which describes what the check collects and states that it is not used to build advertising profiles.
Email lists
If you join the Lagu list, we send your email address to our Listmonk mailing-list service. The list uses double opt-in: you must confirm the address before receiving anything. We use it only for major Lagu news: a big release, the launch, or a change to how you get the app. It is not sent for every version. If you joined during the closed beta and told us which platforms you run, that choice is still stored with your address and used for nothing else; ask and we will remove it.
Fire TV and Fire tablet testers sign up on a separate list, with the email address of the Amazon account their device uses. It works the same way, double opt-in included, and we use the address for one thing: adding it to Lagu’s test in Amazon’s developer console, which is how Amazon sends the invitation and the install link. From there Amazon handles it under its own privacy policy. When the test ends or you leave it, we remove you from the list.
Every campaign includes an unsubscribe link. You may also ask us to remove or export your subscription data by emailing [email protected].
The community forum
The forum at forum.lagu.fm runs on infrastructure we operate, behind the same Cloudflare protection as the rest of the site, and under the same rule: nothing about you is sold or shared, and no advertising or cross-site tracking rides along. Every post can be read without an account. Registering asks for an email address and a username you choose; the email confirms the account, delivers any notifications you turn on, and serves no other purpose. The forum sets the cookies it needs to keep you signed in, and its traffic appears in the same technical logs described under Website visits.
What you post there is public, and it stays up so the next person searching finds the answer — so keep log files, screenshots with personal detail, and anything you’d rather not publish to the bug form instead. To close your forum account, email [email protected] and we will remove it.
The Lagu applications
Lagu authenticates through Plex’s PIN authorization flow. Your Plex password is entered only on Plex-controlled pages and is never provided to Lagu. The resulting authorization token is stored on your device — in the system Keychain on Apple platforms, where it is kept to that one device and left out of backups, in your operating system’s encrypted credential store on desktop where one is available, and in app-private storage on Android — so the app can reach Plex and the media server you select.
Your library metadata, artwork, playback streams, queues, ratings, playlists, lyrics, and listening activity are exchanged between the app, Plex, and your Plex Media Server as needed to provide features. Lagu does not operate a central account, backend, or cloud library that receives any of this. (Lagu Relay, described below, forwards Lagu Remote messages it cannot read and keeps none of them; it is not a backend.) The apps contain no analytics, advertising, attribution, or crash-reporting SDKs — a claim you can verify in the app stores’ own privacy labels, which declare no data collected.
When Lagu talks to Plex’s directory service (plex.tv) to sign you in and find your servers, its requests carry standard Plex client headers: the app’s name and version, your device’s model and platform, the device name you have given it (for example “John’s iPhone” — this is how the device appears in your Plex account’s device list), and a random install identifier Lagu generates once. That identifier is specific to Lagu on that device; it is not an advertising ID and is not shared across apps.
Where your data travels
The complete list of destinations the apps ever contact:
- plex.tv: sign-in and server discovery.
- Your own Plex Media Server: everything about your music.
- Network speakers you choose: desktop and Android phone, and only if you turn on the network-speaker output. Lagu finds DLNA speakers on your local network and tells the one you pick what to play, handing it a private address on your own network where Lagu itself serves the audio and the album art. The speaker never receives your Plex token, and nothing Lagu sends it leaves your network.
- Google Cast devices you choose: desktop only, and only if you turn on the experimental Google Cast setting. Lagu starts Google’s standard media receiver on the Chromecast, Google TV, or Nest speaker you pick and gives it the track’s title, artist, and album and a private address on your own network where Lagu serves the audio and the art. The device never receives your Plex token. The Cast device loads that receiver from Google, under Google’s own terms.
- Lagu Relay: only for Lagu Remote, and only while Lagu Relay is on. A computer or TV with it on keeps one connection to the relay it measures as fastest, and a phone uses that relay only when it can’t reach the host on the network it is on. Everything that passes is encrypted end to end between your phone and your host, so the relay cannot read it. See Lagu Remote over the internet below.
- Last.fm and ListenBrainz: only if you connect them. See Scrobbling.
- Discord and Apple’s iTunes catalogue: desktop only, and only if you turn on Discord Rich Presence. The current track, artist, album, and position go to the Discord app on your computer, which shows them on your Discord profile under Discord’s own privacy policy, and, unless you switch the album-art lookup off, the artist, album, and track name are sent to Apple’s public catalogue to find a cover Discord can display — no token, no server address, no account.
- lagu.fm: if you tap Report a Bug, which opens our bug form in your browser pre-filled with your platform, app version, and device model/OS version — never an identifier, token, or anything from your library; nothing is sent unless you submit the form. The desktop app also periodically checks lagu.fm’s content network for updates; the check is a plain fetch of a static version file — it carries the app’s version, no identifier, and can be turned off in Settings. Infrastructure logs treat it like any website visit. Finding an update is as far as the app goes on its own: downloading and installing one happens only when you choose to.
The store apps make no such check; on iPhone, iPad, Apple Watch, Apple TV, Android, Android TV, and Amazon Fire, updates arrive through TestFlight or the App Store, Google Play, and the Amazon Appstore. There is no other destination.
A note about your own server: Plex Media Servers on a home network often use plain HTTP rather than HTTPS. Lagu allows this — refusing it would break most local setups — which means that on your local network, traffic between Lagu and your server (including the access token in stream addresses) may travel unencrypted. Connections to plex.tv, Last.fm, ListenBrainz, and Lagu Relay are always encrypted. If your server offers a secure connection, Lagu prefers it.
Lagu Remote over the internet (Lagu Relay)
Lagu Remote normally runs entirely on your own network. Lagu Relay is the one exception, and it is optional: when your phone can’t find a paired computer or TV on the network it is on, the two connect through Lagu Relay, a relay service we run at relay.lagu.fm and at regional relays named after their region (such as uk-relay.lagu.fm). The computer or TV picks the relay that answers it fastest, and your phone follows. Cloudflare sits in front of the relays, as it does for this website. You can see how each relay is doing at status.lagu.fm.
When it is on. On a computer, Lagu Relay is off until you turn it on, in Settings › Remote under “Let my phone control this computer.” On Apple TV (Settings › Remote) and Android TV (Settings › Lagu Remote), it is on by default whenever phone control is on, and you can switch it off there. On iPhone (Settings › Remote › Away From Home) and Android phones (Settings › Remote), it is on by default once a paired computer or TV offers it, with a switch to turn it off; a phone whose computers and TVs all have Lagu Relay off never contacts it. Even with it on, your phone looks for the host on your network first, and says “via Lagu Relay” whenever it is using it. Pair over Lagu Relay, which lets a phone on another network pair for the first time, is off by default; switched on at the host, it adds a single-use pairing key, valid for ten minutes, to that host’s QR code.
What the relay sees. Messages are encrypted end to end between your phone and your host before they reach the relay: the two agree a fresh key from the identities they exchanged when you paired, and seal every message with it (X25519 and ChaCha20-Poly1305). The relay passes along sealed messages it cannot open, so it cannot read your commands, your library, what you play, or your Plex token, account, or server details. What it does see is what any connection reveals: your IP address, when you connect and for how long, how much data passes, and a random identifier for the host you are reaching, held only while the connection is open.
What it keeps. The relay keeps nothing on disk about you or your devices: the list of connected hosts lives in memory only and goes when they disconnect, and it never stores device identifiers or message contents. To plan capacity it keeps usage counters — connections, bytes, errors, and response times — for up to 13 months; they hold no device identifiers, no addresses, and nothing about what you play. To stop abuse it counts connections and failed attempts per address, in memory, and both those counts and its connection logs refer to addresses only as one-way hashes. The key behind those hashes is replaced every day at midnight UTC and never saved, so a hash cannot be turned back into an address or linked from one day to the next. Connection logs are deleted after 7 days. One such hash also reaches the usage counters: a daily list of the ten addresses refused most often, kept with the counters for the same 13 months and, for the same reason, unreadable. An address that keeps breaking the relay’s limits may be refused for up to an hour; that list lives in memory only. Cloudflare sees your connection the way it does for any website behind it, under Cloudflare’s privacy policy.
Turning it off. Switching Lagu Relay off on a computer or TV closes every relay connection to it at once, and switching it off on your phone sends the phone back to your local network only. Removing a phone, or resetting pairing, on the host cuts that phone off the relay immediately.
Scrobbling
Lagu can report what you play to Last.fm or ListenBrainz. This is off by default and starts only when you connect a service in Settings. Each report carries the played track’s metadata — artist, title, album, track number, duration, and the time you started listening — and nothing else: no library contents, no Plex account or server details, no device identifiers. Reports travel directly from your device to the service you connected; no Lagu server sits in between. Plays made offline are kept on the device (in a bounded queue) and sent when the network returns.
Lagu stores no scrobbling passwords. Last.fm sign-in goes through Last.fm’s own authorization page in your browser and keeps only the resulting session key; ListenBrainz uses a token you paste. The one exception is the TVs, where no browser exists: on Apple TV and Android TV, Last.fm’s own no-browser sign-in accepts your username and password, uses them for a single request to Last.fm, and never stores, logs, or re-sends them — only the returned session key is kept (and a scan-the-QR-with-your-phone flow is offered first, which avoids typing a password entirely). All stored keys live in the platform’s secure storage — Keychain on Apple devices, hardware-keystore encryption on Android, OS-encrypted storage on desktop. Turning a service off pauses reporting and keeps your queued plays; disconnecting it deletes the stored key and that service’s unsent plays. Once delivered, your listening data is held by Last.fm or ListenBrainz under their own privacy policies.
Device permissions
Lagu asks for a small number of permissions, each in context and each degrading gracefully if declined:
Microphone (Android phone, Android TV, and Fire devices only). Android’s audio-visualizer API requires the “record audio” permission even when an app only wants to visualize its own playback. Lagu requests it the first time you choose a visualizer — never at launch — and uses it exclusively to read the audio Lagu itself is playing, so the visualizers can react to it. It is technically incapable of hearing anything else: the visualizer is bound to Lagu’s own audio session. Nothing is recorded, stored, or transmitted, and the audio tap is released the moment visualizers leave the screen. On Apple platforms no such permission exists or is requested — the visualizers read Lagu’s own audio pipeline directly.
Camera. Used only to scan the QR pairing code when you connect Lagu Remote (and, on Apple TV and Android TV sign-in, your phone’s own camera app scans a code Lagu displays). Frames are decoded on the spot; no image is ever captured to disk or transmitted.
Local network (Apple platforms). iOS and tvOS show a system prompt before an app may talk to devices on your network. Lagu needs this to reach a Plex Media Server on your LAN and to discover Lagu Remote hosts via Bonjour. Declining it limits Lagu to remote connections.
Siri (iPhone). Lets “Hey Siri, play…” requests reach Lagu. See the next section for what Siri learns.
Notifications (Android). Shows the playback and download-progress notifications.
System integrations
Siri and Shortcuts. So that voice requests can find your music, Lagu shares the titles and artist names of things you play (and a count of your library’s size) with the Siri learning system on your device, under Apple’s Siri privacy terms. This is what lets a bare “play Blue in Green” route to Lagu. You can turn it off in iOS Settings › Lagu › Siri & Search.
Lock screen, CarPlay, Android Auto, and media controls. The operating system’s media services display the current track’s title, artist, and artwork on the lock screen, in Control Center, on CarPlay and Android Auto screens, and on paired devices. That surface is run by the OS, not by Lagu. On Android Auto, artwork reaches the car through a channel that carries no Plex token, and only Android Auto, the Assistant, and the system itself are allowed to browse your library through Lagu; other apps on the phone are refused.
Widgets. The iPhone home and lock screen widgets draw from a small snapshot Lagu keeps on the device: what is playing, what you played recently, and this week’s counts. They hold no Plex sign-in of their own, and signing out clears the snapshot within seconds. The Android home screen widgets show the same kind of thing, read from the playing track and the play history Lagu keeps on the phone.
Apple Watch. If you use the watch app, your iPhone hands it what it needs over Apple’s encrypted device-to-device channel: your Plex sign-in, your library preferences, and — if you connected scrobbling — the scrobbling keys, so the watch never shows a sign-in form. Disconnecting a service on the phone revokes it on the watch too.
Lagu Remote. Pairing your phone with a desktop, Apple TV, or Android TV happens on your local network: a QR code or PIN exchanges a per-device access token over a certificate-pinned TLS connection. (If you switch on Pair over Lagu Relay at the host, its QR code can also pair a phone on another network, through Lagu Relay and inside the same end-to-end encryption.) The host stores only a hash of that token; you can revoke any paired device at any time from the host’s settings. Your Plex token, account, and server details never travel over the Remote link, whether it runs on your network or through Lagu Relay.
Local data
The apps keep data on your device to work well: preferences, server connection details, cached artwork and metadata, queue state (on iPhone, Android, and Android TV, the last queue is saved so it can come back paused after a restart; signing out or switching servers clears it), a recently-played ledger (capped at one hundred entries, never leaving the device), recent searches, the offline scrobble queue, and — if you download music — the downloaded audio files themselves in the app’s private storage. You can remove downloads in the app at any time.
The desktop app also keeps a local crash log (capped at half a megabyte) recording any crash it suffers. Nothing in it is ever sent automatically; a “Copy crash info” button in Settings › About puts its recent contents on the clipboard for you to paste into a bug report if you choose.
Signing out removes your Plex sign-in from the device but deliberately keeps your local preferences, play history, and the install identifier (so your Plex account’s device list doesn’t grow a new entry every time you sign back in). Deleting the app removes its data according to each platform’s normal behavior — with one Apple-platform caveat worth stating plainly: items in the system Keychain (the sign-in token and install identifier) can survive an uninstall, by Apple’s design. Signing out before uninstalling clears the sign-in token; you can also revoke Lagu’s access at any time from your Plex account’s device settings, which invalidates the token wherever it is.
Service providers
We rely on infrastructure providers to host and secure the website, the forum, the mailing-list service, and Lagu Relay (whose relays run on servers we rent from hosting providers in several countries, behind Cloudflare), and on your configured email delivery provider to send confirmation and campaign messages. Plex, Last.fm, ListenBrainz, and your own server process data under their respective policies and configurations.
Children
Lagu is not directed at children under 13, and we do not knowingly collect personal information from them. If you believe a child has provided us personal information (for example through one of the email lists), contact us and we will delete it.
Retention and choices
List information is retained until you unsubscribe, ask for deletion, or the list is retired; the Fire list, until Amazon’s test ends or you leave it. Screenshots, recordings, and log files attached to bug reports are deleted from our storage automatically 365 days after upload; the report itself stays in our issue tracker and mailbox while it is useful for development. Log and crash files can include device names, server names, and file paths from your library; trim them before attaching if you prefer. Technical logs are retained according to hosting and security settings. Lagu Relay’s connection logs are deleted after 7 days and its usage counters after 13 months, as described under Lagu Remote over the internet.
Feedback and crash reports sent through TestFlight are collected by Apple and reach us in App Store Connect, with the email address on your Apple Account attached so we can reply about what you reported. How long they stay there is set by Apple. We use that address to answer the report and for nothing else.
Your choices, in one place: revoke Lagu’s Plex authorization from your Plex account’s device settings; disconnect a scrobbling service in Lagu’s settings (which also deletes its queued plays); turn off Siri learning in iOS Settings; revoke paired Remote devices from the host; turn Lagu Relay off on a computer, TV, or phone; delete downloads in the app; and sign out or uninstall to clear device data as described above.
Contact and changes
Lagu is published by Wasian Ventures LLC. Questions or privacy requests can be sent to [email protected]. We may update this policy as distribution and product features evolve; material changes will be reflected on this page with a new effective date.