spindle · privacy

Your music, and your data, stay yours.

Spindle is provided by Raindog LLC. Local playback does not require a Raindog account. Spindle has no advertising. Optional online features and support requests involve the data described below.

Spindle for iOS · Spindle for Android · Support and privacy requests

Spindle for iOS

Your library stays on your device.

The audio files you import, your playlists, and song-level play counts stay on your iPhone. In iOS builds that include it, optional usage sharing can send the limited activity counts described below, not your music or a track-by-track listening history.

Optional connections you control.

If you sign in to Last.fm, Spindle sends your scrobbles to Last.fm using the account you connect, and you can disconnect at any time. AirPlay, CarPlay, and USB output are handled by iOS and your own devices. raindog never sees any of it.

If you tap "Fetch missing artwork online," Spindle asks Apple's public iTunes Search API for cover images, sending only the artist and album text needed to make the match. Apple also receives the network information needed to answer the request. The results are stored on your device, and the feature does nothing unless you trigger it.

Your own music server, if you have one.

Spindle can connect to a music server that you run — Navidrome, or another server speaking the Subsonic API. That music-server connection goes directly to the address you give it. There is no raindog account, no relay, and no cloud in the middle: we never see your server, its address, your credentials, or what you listen to.

Your server's address and username are stored on your device, and your password is kept in the iOS Keychain. They are sent only to your own server, to sign in and to request the music you ask for. Albums you keep offline are stored on your iPhone like any other file.

One honest technical note: the Subsonic API signs each request with a token in the web address, and a server address entered without https:// is treated as an ordinary unencrypted one. Over a home network or a VPN that's fine. On a network you don't trust, give Spindle an https:// address so the connection is encrypted.

If you don't have a server, none of this applies — the feature doesn't appear in Spindle at all until you add one.

Optional iOS usage sharing

Usage sharing is available only in iOS builds that include it and have a configured service. The public Spindle 1.5 release does not send these usage records. The Spindle TestFlight build 1.6.0 (42) includes optional sharing. It starts off; you can enable it during welcome or in Settings → Privacy. Spindle works without participating.

If you enable sharing, Raindog receives counts of subsequent setup, listening and purchase-flow activity. The record includes the UTC day you opted in, the day each activity first happened relative to that day, whether you opted in during welcome or later in Settings, your app version and build when you opted in, and a random identifier for that sharing period. Setup activity includes import and server-connection outcomes. Listening records first and return listening milestones. Purchase activity includes trial, paywall, purchase and restore outcomes. Builds with optional failure counters also send counts of failures or connection problems during setup, imports, syncing, browsing, downloads and playback. These bounded counts help identify and fix app functionality problems; they are not complete incident totals. We use these records to understand where the app needs improvement.

The identifier links these counts together: this is pseudonymous data, not anonymous data. The usage record does not include your music, song titles, filenames, server address or credentials, Apple Account, receipts, contacts, advertising identifiers, detailed error messages or stack traces. We do not sell these records, use them for advertising tracking, or combine them with third-party profiles.

Turn sharing off in Settings → Privacy to stop collection, cancel pending transmission and clear unsent records from the app. Cancellation cannot recall a request already received. Turning sharing off does not immediately delete previously received records; they expire within 90 days of the day you opted in. Turning sharing back on starts a new identifier and does not upload activity from when sharing was off. Each sharing period ends within 90 days; continuing requires explicitly enabling it again. Playback and purchasing work either way.

Where usage records are processed

Raindog operates the service on a Hetzner Cloud server in Falkenstein, Germany. Your app sends usage records over HTTPS to telemetry.spindle.raindog.ai. Our server handles HTTPS directly using Caddy; these requests do not pass through a content delivery network. Hetzner provides the hosting infrastructure used to process and store these records.

A network connection necessarily exposes its source IP address to the systems carrying and receiving it. Our collector uses that address temporarily in memory to limit abusive request rates. Inactive entries become eligible for removal after two minutes and are removed by regular cleanup; the table holds at most 4,096 entries. The collector does not save IP addresses to its usage database. We do not retain request bodies or IP addresses in our collector or proxy access logs. These statements describe our service configuration; they do not mean network providers process no connection metadata.

We store only the latest cumulative record per sharing identifier. Records are deleted at 89 UTC days from the day you opted in, with scheduled cleanup at least hourly, so received records expire within 90 days. We do not make backups or snapshots containing these raw usage records.

Optional iOS bug reports

The ladybug report is prepared only when you request it. You can preview the complete text and choose whether to include recent logs before using the iOS share sheet to choose a destination. The report includes your description, app/device/iOS versions, playback state, audio settings, technical file details, output type, and library counts. Music names in generated diagnostic fields are replaced with codes randomized for each report; optional logs are scrubbed for names, addresses, and links.

Review the report before sharing. Your own description may contain personal details, and an email or other sharing service can identify you to its recipient. Reports you send to Raindog follow the support retention schedule below.

Spindle for Android

Local music and device backup

Imported audio, metadata, artwork, playlists, preferences, and playback information are stored on your device. Spindle does not automatically upload your local music to Raindog. A file provider you select in Android's picker may retrieve files from its own cloud service.

Android backup and device transfer may handle eligible app data according to your device settings. Stored authentication secrets are excluded by Spindle's backup rules. Keep a separate copy of original music: backup does not guarantee restoration of every imported file or file-provider permission.

Connections you choose

A Subsonic-compatible server you configure receives authentication information and requests for library metadata, searches, artwork, tracks, and downloads. Its operator receives your network address and controls its logs and retention. Use HTTPS when available; a configured HTTP endpoint does not encrypt traffic.

Last.fm sign-in sends your username and password to Last.fm over HTTPS. Spindle retains the returned session key and account name in encrypted local preferences, not your Last.fm password. If you enable scrobbling, track, artist, album, and listening information are sent to Last.fm. Turn off scrobbling or sign out to stop future submissions. Manage previously submitted history with Last.fm.

Choosing to fetch missing artwork sends artist and album search terms to Apple's iTunes service and downloads matching artwork. Apple receives these requests and the network information needed to answer them. This lookup does not upload your audio files.

Google Play purchases

Google Play processes the one-time permanent unlock. Spindle receives product and purchase-status information to display prices, complete purchases, and restore ownership. Spindle does not receive payment-card details. Google handles transactions under its own policies; Raindog can access the transaction information made available to developers in Play Console. The Google Play Billing library sends Google technical billing information, including app and device details, billing operation and error events, and a randomly generated billing-client session identifier, for service diagnostics. This is separate from reports you choose to send to Raindog.

Optional diagnostic reports

Spindle's Send bug report feature prepares text only when you choose it, with the app version, device model, Android version, and recent app log lines. It attempts to remove URLs, storage paths, email addresses, and credential patterns. Inspect it before sharing because redaction cannot guarantee removal of every personal detail. You choose the recipient and sharing app.

Your controls

You can use local music without Last.fm or a remote server, disable scrobbling, sign out, and choose whether to request online artwork or share diagnostics. Removing local app data does not delete files or history held by your server or other providers. Preserve music and playlists you want before deleting app data.

Support and privacy requests

If you email hello@raindog.ai, Raindog receives your message and attachments through its email provider. Zak Brown is the only person at Raindog who handles support and accesses these records. They are used to respond to and investigate your request, not for advertising.

Our support retention schedule is to delete messages within 12 months after a case closes and diagnostic attachments within 30 days after resolution. We review retained support records monthly. On request, we delete support information earlier, except for the minimum records required by legal or accounting obligations.

For privacy questions or deletion requests, email hello@raindog.ai. Raindog cannot delete data controlled by Google, Apple, Last.fm, or your music-server operator. Contact those providers for their account and history controls.

Changes.

If this policy ever changes, we'll update this page. Questions? hello@raindog.ai.

Last updated: October 20, 2026 · raindog, Richmond VA