Sonofy Privacy Policy

Who is responsible for your data

Jose Armando Meza Vigueras (sole proprietor), trading as Axolotl Software, develops and publishes Sonofy and is the controller of the data described here, with an address at Toluca de Lerdo, Estado de México, 52140, Mexico.

This policy covers the app only. Data you send us by contacting us through the website is governed by the Axolotl Software privacy notice (in Spanish).

What the app does

Sonofy plays the music already stored on your device and shows synced, karaoke-style lyrics. It is not a streaming service: there is no catalogue, no accounts, and nothing to download from our servers, because we do not run any. The music is yours and it stays where it is.

What stays on your device

The app handles this data and never transmits it:

• Your audio files. The app reads them from device storage in order to play them. It does not copy them, upload them or share them.
• Each track’s metadata: title, artist, album, duration, cover art and any lyrics embedded in the file’s tags. All read on the device itself.
• The lyrics. They come from the tags of the file you own. The app does not query any online lyrics service, so we never tell anyone what you are listening to.
• Your playlists, including any cover you pick from your photos or take with the camera. The image is stored in the app’s private storage.
• Your preferences: theme, language, playback speed, sleep timer, lyrics view settings, and your last session so you can pick up where you left off.
• Any metadata edits you make: they are written to your own files, on your own device.

None of this travels anywhere. Uninstall the app and it goes with it — your music files, which are yours and were there first, stay.

What does leave your device

There is more here than in an offline-only app, and it is worth listing in full.

1. Usage analytics (Firebase Analytics)

The app records how it is used, so we know what is actually needed and what is not. It sends:

• The screens you open inside the app, and specific events: changing a setting, accepting or postponing the update prompt, opening the store listing from the review invitation.
• A random installation identifier, device model, operating system and version, app version, language, and the country Google infers from the IP address.

It does not send what music you have or what you listen to, nor file names, playlists or lyrics. And since the app has no login, there is no name, email or account to attach any of it to: the reports we see are aggregate and cannot identify you.

2. Crash reports (Firebase Crashlytics)

When the app closes unexpectedly or hits a serious error, it sends the error trace, the app version, the device model, the operating system version, the date and a random installation identifier. That is what lets us fix it. It does not include your library or your files.

3. Remote configuration (Firebase Remote Config)

The app fetches a handful of configuration values we can adjust without shipping a new release — for instance, the version below which an update is treated as mandatory. The request carries the installation identifier, the app version and the platform.

4. Update check

To let you know a new version exists, the app reads the app’s public store listing on Google Play or the App Store and compares the published version with the one you have installed. It is a request to Google or Apple carrying the usual technical data of any connection (IP address and client version). It does not go through us.

5. Review invitation

If the app invites you to leave a review, the window that opens is the system’s own: Google Play or the App Store handle it under their terms. We do not see who writes what; we receive public reviews like anyone else.

---

Firebase is operated by Google LLC and processes the data on servers in the United States, which means an international transfer. Google retains it under the Firebase policy and the retention configured in the console; crash reports are deleted after 90 days. You can read how they handle it in Google’s privacy policy and in the Firebase privacy information.

There is currently no switch inside the app to turn analytics off. If you would rather send nothing, uninstalling the app is the only way today. We are looking at adding that control.

Permissions the app requests, and why

On Android:

Permission	What it is for
Access to audio files	Find and play the music stored on your device. It is the app’s central permission.
Notifications	Show playback controls in the notification shade. Without it the music plays, but with no controls.
Foreground service (media playback)	Keep playing when you leave the app or turn off the screen.
Keep the device awake	Stop the screen from turning off in the lyrics view.

The app does not ask for photo access on Android: the image permission that audio libraries usually drag in was deliberately stripped from the package, because a music player has no business reading your gallery.

On iOS, iPadOS, macOS and visionOS:

Permission	What it is for
Media and Apple Music	Use the system audio framework to show controls on the lock screen and in Control Center. The app does not access Apple Music or your iCloud library: it only plays local files.
Photos	Pick a cover for a playlist. Only the image you select, and it stays on the device.
Camera	Take that cover on the spot, if you prefer.

On iOS you can also add your own audio files through the Files app; they live in the app’s space, on your device.

What the app does not do

• No ads and no advertising networks.
• Nothing is sold inside the app.
• No sign-up, no login, no accounts.
• No location, contacts or microphone access.
• Your music, playlists and cover art are never uploaded to any server.
• We do not sell, rent or share data with third parties for commercial purposes.

Children

The app is not directed to children under 13 and does not knowingly collect their data. There is no sign-up, no profile and no content a child could publish.

Security

Playlists, cover art and preferences live in the private storage the system assigns to the app, isolated from the rest. Whatever is sent to Firebase travels encrypted. No system is infallible, but where there are no accounts and no cloud library, there is no user database to leak.

How to delete your data

Uninstalling the app deletes what it keeps on the device: playlists, covers, preferences and session. Your music files are untouched, because they were never the app’s to begin with.

Analytics and crash reports are not linked to you, so we cannot find “yours” to delete one by one; they are removed once Firebase’s retention period is up. If you have a reason to request deletion of a specific record, write to us and we will take it up with Google.

Your rights

You can ask us at any time to access the data we hold, correct it if it is inaccurate, delete it, or object to a particular use, and you can withdraw your consent.

Write to contact@axolotl-software.com, telling us which app you mean, which right you are exercising and how to reach you. We reply within 20 business days at the latest and, where it applies, act on it within the following 15 business days. Under Mexican data protection law (LFPDPPP), if you believe your rights have been infringed you may also turn to INAI, the Mexican data protection authority.

Wherever you live, write to that same address and we will honour the rights your local law gives you.

Changes to this policy

Any change is published at this same address, with the update date at the top. The URL does not change: it is the one registered in the store listing.

Contact

Any question about this policy or about the app: contact@axolotl-software.com · +52 55 7428 0223.