Website visits
The Lagu website carries no advertising, no tracking pixels, and no third-party social widgets. To see how the site is used — which pages are read, where visitors arrive from, how many go on to join the beta list — we run Umami, an open-source analytics tool, on our own infrastructure. It uses no cookies and stores nothing on your device. Visits are counted against a short-lived anonymous identifier rather than a profile of you, the data stays on infrastructure we operate, and it is never shared or sold. The script is served from lagu.fm itself and honors your browser’s Do Not Track setting.
Separately, our hosting and Cloudflare infrastructure may retain ordinary technical logs and aggregate traffic statistics, such as an IP address, browser type, requested page, timestamp, and security events. These records are used to deliver and protect the site, not to build advertising profiles.
The bug-report, contact, and beta-list forms use Cloudflare Turnstile to filter automated submissions. It loads only on the pages carrying those forms and checks the browser rather than your identity. On the bug and contact forms it appears as a visible check; on the beta-list form it runs invisibly, with no box to tick. Turnstile is covered by Cloudflare’s privacy policy and its Turnstile Privacy Addendum, which describes what the check collects and states that it is not used to build advertising profiles.
Beta email list
If you join the beta list, we send your email address — and, if you choose to say, which platforms you plan to run Lagu on — to our Listmonk mailing-list service. The list uses double opt-in: you must confirm the address before receiving updates. We use it only for Lagu development, testing invitations (matched to your platforms, if given), and release news.
Every campaign includes an unsubscribe link. You may also ask us to remove or export your subscription data by emailing [email protected].
The community forum
The forum at forum.lagu.fm runs on infrastructure we operate, behind the same Cloudflare protection as the rest of the site, and under the same rule: nothing about you is sold or shared, and no advertising or cross-site tracking rides along. Every post can be read without an account. Registering asks for an email address and a username you choose; the email confirms the account, delivers any notifications you turn on, and serves no other purpose. The forum sets the cookies it needs to keep you signed in, and its traffic appears in the same technical logs described under Website visits.
What you post there is public, and it stays up so the next person searching finds the answer — so keep log files, screenshots with personal detail, and anything you’d rather not publish to the bug form instead. To close your forum account, email [email protected] and we will remove it.
The Lagu applications
Lagu authenticates through Plex’s PIN authorization flow. Your Plex password is entered only on Plex-controlled pages and is never provided to Lagu. The resulting authorization token is stored on your device — in the system Keychain on Apple platforms, in app-private storage on Android and desktop — so the app can reach Plex and the media server you select.
Your library metadata, artwork, playback streams, queues, ratings, playlists, lyrics, and listening activity are exchanged between the app, Plex, and your Plex Media Server as needed to provide features. Lagu does not operate a central account, backend, or cloud library that receives any of this. The apps contain no analytics, advertising, attribution, or crash-reporting SDKs — a claim you can verify in the app stores’ own privacy labels, which declare no data collected.
When Lagu talks to Plex’s directory service (plex.tv) to sign you in and find your servers, its requests carry standard Plex client headers: the app’s name and version, your device’s model and platform, the device name you have given it (for example “John’s iPhone” — this is how the device appears in your Plex account’s device list), and a random install identifier Lagu generates once. That identifier is specific to Lagu on that device; it is not an advertising ID and is not shared across apps.
Where your data travels
The complete list of destinations the apps ever contact: plex.tv (sign-in and server discovery), your own Plex Media Server (everything about your music), network speakers you choose (desktop and Android phone, and only if you turn on the network-speaker output: Lagu finds DLNA speakers on your local network and tells the one you pick what to play, handing it a private address on your own network where Lagu itself serves the audio and the album art. The speaker never receives your Plex token, and nothing Lagu sends it leaves your network), Last.fm and ListenBrainz (only if you connect them — see Scrobbling), Discord and Apple’s iTunes catalogue (desktop only, and only if you turn on Discord Rich Presence: the current track, artist, album, and position go to the Discord app on your computer, which shows them on your Discord profile under Discord’s own privacy policy, and, unless you switch the album-art lookup off, the artist, album, and track name are sent to Apple’s public catalogue to find a cover Discord can display — no token, no server address, no account), and lagu.fm (if you tap Report a Bug, which opens our bug form in your browser pre-filled with your platform, app version, and device model/OS version — never an identifier, token, or anything from your library; nothing is sent unless you submit the form). The desktop app also periodically checks lagu.fm’s content network for updates; the check is a plain fetch of a static version file — it carries the app’s version, no identifier, and can be turned off in Settings. Infrastructure logs treat it like any website visit. Finding an update is as far as the app goes on its own: downloading and installing one happens only when you choose to. The store apps make no such check; on iPhone, iPad, Apple Watch, Apple TV, Android, and Android TV, updates arrive through the App Store and Google Play. There is no other destination.
A note about your own server: Plex Media Servers on a home network often use plain HTTP rather than HTTPS. Lagu allows this — refusing it would break most local setups — which means that on your local network, traffic between Lagu and your server (including the access token in stream addresses) may travel unencrypted. Connections to plex.tv, Last.fm, and ListenBrainz are always HTTPS. If your server offers a secure connection, Lagu prefers it.
Scrobbling
Lagu can report what you play to Last.fm or ListenBrainz. This is off by default and starts only when you connect a service in Settings. Each report carries the played track’s metadata — artist, title, album, track number, duration, and the time you started listening — and nothing else: no library contents, no Plex account or server details, no device identifiers. Reports travel directly from your device to the service you connected; no Lagu server sits in between. Plays made offline are kept on the device (in a bounded queue) and sent when the network returns.
Lagu stores no scrobbling passwords. Last.fm sign-in goes through Last.fm’s own authorization page in your browser and keeps only the resulting session key; ListenBrainz uses a token you paste. The one exception is Apple TV, where no browser exists: there, Last.fm’s own no-browser sign-in accepts your username and password, uses them for a single request to Last.fm, and never stores, logs, or re-sends them — only the returned session key is kept (and a scan-the-QR-with-your-phone flow is offered first, which avoids typing a password entirely). All stored keys live in the platform’s secure storage — Keychain on Apple devices, hardware-keystore encryption on Android, OS-encrypted storage on desktop. Turning a service off pauses reporting and keeps your queued plays; disconnecting it deletes the stored key and that service’s unsent plays. Once delivered, your listening data is held by Last.fm or ListenBrainz under their own privacy policies.
Device permissions
Lagu asks for a small number of permissions, each in context and each degrading gracefully if declined:
Microphone (Android phone and Android TV only). Android’s audio-visualizer API requires the “record audio” permission even when an app only wants to visualize its own playback. Lagu requests it the first time you choose a visualizer — never at launch — and uses it exclusively to read the audio Lagu itself is playing, so the visualizers can react to it. It is technically incapable of hearing anything else: the visualizer is bound to Lagu’s own audio session. Nothing is recorded, stored, or transmitted, and the audio tap is released the moment visualizers leave the screen. On Apple platforms no such permission exists or is requested — the visualizers read Lagu’s own audio pipeline directly.
Camera. Used only to scan the QR pairing code when you connect Lagu Remote (and, on Apple TV sign-in, your phone’s own camera app scans a code Lagu displays). Frames are decoded on the spot; no image is ever captured to disk or transmitted.
Local network (Apple platforms). iOS and tvOS show a system prompt before an app may talk to devices on your network. Lagu needs this to reach a Plex Media Server on your LAN and to discover Lagu Remote hosts via Bonjour. Declining it limits Lagu to remote connections.
Siri (iPhone). Lets “Hey Siri, play…” requests reach Lagu. See the next section for what Siri learns.
Notifications (Android). Shows the playback and download-progress notifications.
System integrations
Siri and Shortcuts. So that voice requests can find your music, Lagu shares the titles and artist names of things you play (and a count of your library’s size) with the Siri learning system on your device, under Apple’s Siri privacy terms. This is what lets a bare “play Blue in Green” route to Lagu. You can turn it off in iOS Settings › Lagu › Siri & Search.
Lock screen, CarPlay, Android Auto, and media controls. The operating system’s media services display the current track’s title, artist, and artwork on the lock screen, in Control Center, on CarPlay and Android Auto screens, and on paired devices. That surface is run by the OS, not by Lagu. On Android Auto, artwork reaches the car through a channel that carries no Plex token, and only Android Auto, the Assistant, and the system itself are allowed to browse your library through Lagu; other apps on the phone are refused.
iPhone widgets. The home and lock screen widgets draw from a small snapshot Lagu keeps on the device: what is playing, what you played recently, and this week’s counts. They hold no Plex sign-in of their own, and signing out clears the snapshot within seconds.
Apple Watch. If you use the watch app, your iPhone hands it what it needs over Apple’s encrypted device-to-device channel: your Plex sign-in, your library preferences, and — if you connected scrobbling — the scrobbling keys, so the watch never shows a sign-in form. Disconnecting a service on the phone revokes it on the watch too.
Lagu Remote. Pairing your phone with a desktop, Apple TV, or Android TV happens entirely on your local network: a QR code or PIN exchanges a per-device access token over a certificate-pinned TLS connection. The host stores only a hash of that token; you can revoke any paired device at any time from the host’s settings. Your Plex token, account, and server details never travel over the Remote link.
Local data
The apps keep data on your device to work well: preferences, server connection details, cached artwork and metadata, queue state (on iPhone and Android, the last queue is saved so it can come back paused after a restart; signing out or switching servers clears it), a recently-played ledger (capped at one hundred entries, never leaving the device), recent searches, the offline scrobble queue, and — if you download music — the downloaded audio files themselves in the app’s private storage. You can remove downloads in the app at any time.
The desktop app also keeps a local crash log (capped at half a megabyte) recording any crash it suffers. Nothing in it is ever sent automatically; a “Copy crash info” button in Settings › About puts its recent contents on the clipboard for you to paste into a bug report if you choose.
Signing out removes your Plex sign-in from the device but deliberately keeps your local preferences, play history, and the install identifier (so your Plex account’s device list doesn’t grow a new entry every time you sign back in). Deleting the app removes its data according to each platform’s normal behavior — with one Apple-platform caveat worth stating plainly: items in the system Keychain (the sign-in token and install identifier) can survive an uninstall, by Apple’s design. Signing out before uninstalling clears the sign-in token; you can also revoke Lagu’s access at any time from your Plex account’s device settings, which invalidates the token wherever it is.
Service providers
We rely on infrastructure providers to host and secure the website, the forum, and the mailing-list service, and on your configured email delivery provider to send confirmation and campaign messages. Plex, Last.fm, ListenBrainz, and your own server process data under their respective policies and configurations.
Children
Lagu is not directed at children under 13, and we do not knowingly collect personal information from them. If you believe a child has provided us personal information (for example through the beta list), contact us and we will delete it.
Retention and choices
Beta-list information is retained until you unsubscribe, ask for deletion, or the list is retired. Screenshots, recordings, and log files attached to bug reports are deleted from our storage automatically 365 days after upload; the report itself stays in our issue tracker and mailbox while it is useful for development. Log and crash files can include device names, server names, and file paths from your library; trim them before attaching if you prefer. Technical logs are retained according to hosting and security settings.
Feedback and crash reports sent through TestFlight are collected by Apple and reach us in App Store Connect, with the email address on your Apple Account attached so we can reply about what you reported. How long they stay there is set by Apple. We use that address to answer the report and for nothing else.
Your choices, in one place: revoke Lagu’s Plex authorization from your Plex account’s device settings; disconnect a scrobbling service in Lagu’s settings (which also deletes its queued plays); turn off Siri learning in iOS Settings; revoke paired Remote devices from the host; delete downloads in the app; and sign out or uninstall to clear device data as described above.
Contact and changes
Lagu is published by Wasian Ventures LLC. Questions or privacy requests can be sent to [email protected]. We may update this policy as distribution and product features evolve; material changes will be reflected on this page with a new effective date.