Privacy Policy

Sealed — 17 June MMXXVI

The Pact, in Brief

What the Engine knows of the listener stays with the listener. There are no accounts, no telemetry, no analytics, no advertisements, no third-party SDKs, no advertising identifiers, no fingerprinting of the listener or their device. The Engine runs upon the listener's device and reports to nothing beyond it — save for four listener-invoked rites, described below in full, each conveying only the data the listener has commanded, and none carrying any record of the listener themselves.

The Engine does keep a record of the listener's listening — the dates, the durations, the returns — for the sake of the Auguries, the shelves it composes from the listener's own habit. That record is the listener's alone, and it does not depart the device.

What the Engine Reads

The Engine reads the audio files within the listener's reliquary, drawn from the directories the listener has granted it access to. It conducts its census across what it finds — titles, artists, albums, durations, formats, sample rates, bit depths — and inscribes the truth of measure and the truth of identity into a library kept locally upon the device. None of it travels onward.

What the Engine Writes

The Engine never alters the audio itself — it does not re-encode, does not touch the samples, does not delete files. Absent the listener's explicit command, it writes nothing at all. Should the listener enable the Rite of Enrichment described below, the Engine may write corrected metadata and cover art back into the listener's own files — those fields alone, and only then. Beyond that single, invited exception, the reliquary remains the listener's jurisdiction entire, in all of its choices and its accidents.

The Witnessing

If, by their own hand, the listener invokes the Witnessing rite from a connected DAC's diagnostics surface, the application transmits to the Forge — and to nothing else — the following, and no more:

The Forge does not record the listener's IP address, does not record the listener's User-Agent, and mints no identifier that could bind multiple witnesses to a single listener. Two listeners offering the same DAC produce indistinguishable transmissions. The witnessed descriptor enters, anonymously, the public Concordance at voxmachina.audio/dossiers/.

The rite is silent by default; only a deliberate tap invokes it.

The Outward Cadence

The listener may, by their own hand, dispatch the cadence of their listening to Last.fm or to ListenBrainz, configured under Settings → Scrobbling with credentials the listener supplies. The Engine dispatches only because the listener has so commanded. The fields conveyed are:

Vox Machina receives none of this. All data handling by Last.fm and ListenBrainz is governed by their respective privacy policies. The Outward Cadence is silent by default. The listener may revoke it at any moment from the same surface; once revoked, no further dispatch occurs.

The Rite of Enrichment

Should the listener, by their own hand, enable Metadata & Artwork Enrichment, the Engine computes an acoustic fingerprint of a recording's audio — a compact hash of the sound itself, never the audio file, and never the listener — and offers it outward to name the recording and to gather what metadata and cover art the archives hold. The fingerprint names a song, not a person; it carries no identifier of the listener or their device. Conveyed, and only these:

The rite is sealed twice before it speaks: one consent to compute the fingerprint upon the device, a second and separate consent to permit the lookups. Both are dark by default. What the archives return — corrected tags and cover art — the Engine may write back into the listener's own files, and into no others. Neither transmission bears any identifier binding it to the listener. AcoustID, MusicBrainz, and the Cover Art Archive (served by the Internet Archive) each govern their own handling under their own terms. Vox Machina receives none of it.

The Offered Signature

Should the listener go further and enable AcoustID Contribution — a rite apart from the lookup above, and consented apart — the Engine offers fingerprints back to the AcoustID archive, under the listener's own AcoustID key, never the Forge's. Borne outward, and only these:

This is a permanent and public act, and the listener should weigh it as one. What is offered enters AcoustID's open-data releases under a Creative Commons Attribution-ShareAlike license — attributed to the listener's account, and free for any to reuse, including other software. Once given, it cannot be recalled. AcoustID weighs each offering on its own terms, and the Engine cannot promise that what is offered will be kept, or matched to any particular recording. The rite is dark by default and demands its own deliberate consent, distinct from the lookup above — for offering a fingerprint back is a materially different act than reading one. Vox Machina receives none of it.

What the Engine Asks of Android

Of the Bluetooth Link

When the listener routes playback to a Bluetooth device, the Engine reads that device's identity and its negotiated codec, that the fidelity of the link may be shown to the listener. This is used to witness the connection and nothing more — it pairs nothing, dials nothing, and reads nothing of the device beyond the audio link. No Bluetooth data departs the device, and the Forge keeps none.

Of Children

The Engine is not directed to children under 13. It does not knowingly collect information from any listener — child or otherwise — because it does not collect information at all.

Of Revision

Should this pact be amended, the effective date above shall change. Material revisions are also named in the Engine's release notes upon the Play Store.

To Reach the Forge

For questions concerning this pact, address the Forge: privacy@voxmachina.audio.