Privacy Policy
Short version: Lyrimuse has no account system, no telemetry and no analytics, and the developer runs no server that receives anything from the app. Finding lyrics means asking lyric sources about the song that's playing, so the app does contact third-party services. This page lists every one of them.
1 Who this covers
This policy covers the Lyrimuse macOS app, the lyrics engine that ships inside it, and this website at yudaotor.github.io/lyrimuse. Lyrimuse is an open-source project kept by one developer (Yudaotor). There is no company behind it.
2 What we collect: nothing
There is no sign-up, no user ID, no crash reporter and no usage analytics. The developer runs no server that receives data from the app, so there is no data about you to export, correct or delete.
The source code is public, so this is something you can check rather than take on trust.
3 What stays on your Mac
Everything the app remembers is written to your own Mac, mainly under ~/.config/lyrimuse:
- your settings
- the lyrics cache, so a song you have played once also works offline
- your local listening history, which the charts and On This Day are built from
- credentials for services you chose to connect, such as a Last.fm session key or a ListenBrainz token
- the outbound request log described below
None of it is uploaded. Delete that folder and it's gone; the bundled uninstall.sh --purge removes it along with everything else.
4 Which servers the app contacts
Apart from the account credentials listed in the tables, none of these requests carries anything that identifies you or your Mac. Each service sees the request itself and, as with any website, your IP address.
During normal use
| Purpose | Service | What it receives |
|---|---|---|
| Finding lyrics | NetEase Cloud Music, QQ Music, Kugou, Kuwo, Migu, Soda Music, Musixmatch, LRCLIB, LyricFind (through YouTube Music), Deezer, VIBE (Naver), Genie (KT) and the AMLL lyrics library (on GitHub, with jsDelivr as a backup). Apple Music too, once you connect your account | Artist, title and album, plus the duration for some sources. Apple Music also gets your media user token, which only goes to Apple |
| Artist names | MusicBrainz | An artist's name, when no source found the song and it looks for other names; when Last.fm matching meets an artist it hasn't seen; and MusicBrainz IDs, for the country and links of artists in the charts |
| Artwork and the idle screen | iTunes Search. Covers are also downloaded from where they already live: the player's own image server (Spotify, KKBOX, Amazon Music, YouTube Music, and the Kuwo and Migu servers behind LX Music's covers) or the lyric source that found the song | Artist and title. Downloading an image sends only its address |
| Song, album and artist notes | Apple Music's public album and artist pages first, no Apple Account needed. When they have nothing: Soda Music (songs played in it, Chinese interface only), NetEase Cloud Music (Chinese interface only), the Wikipedia articles YouTube Music shows, and Last.fm. Song notes come from QQ Music (Chinese interface only) or Last.fm | Song, album or artist IDs or names |
| A recording's original title | Apple Music's public catalog, no Apple Account needed, and Deezer, looked up by the recording's ISRC code | The ISRC code, or artist and title |
| Spotify links in the charts | MusicBrainz and Spotify's public embed pages, at most one round every 6 hours | MusicBrainz IDs and Spotify album IDs |
| Telling songs from audiobooks and other spoken programs in QQ Music | QQ Music, once per song while QQ Music plays | The song's QQ Music ID |
| Soda Music album track lists | Soda Music's public album pages, while you play in Soda Music | Album ID |
| Lining lyrics up with music videos on YouTube Music | SponsorBlock | The first 4 characters of the video ID's SHA-256 hash, which can't tell it which video it is |
| Looking up Musixmatch's address | Cloudflare (1.1.1.1) and Google (8.8.8.8), over DNS over HTTPS | The domain name |
| Checking for updates | The update feed on GitHub Releases, with no system information. With beta updates on, the GitHub API's release list, at most once an hour | Nothing about you |
| The star count in About | GitHub API, at most once every 6 hours | Nothing about you |
Only after you turn something on
These are off until you set them up:
| Purpose | Service | What it receives |
|---|---|---|
| Scrobbling | Last.fm and ListenBrainz, whichever you connect | What you play, with your account's credentials |
| Online translation fallback (off by default, and only when Apple's on-device translation can't help) | Google's web translation first, then MyMemory for whatever is left | The lyric text, in chunks. Requests to MyMemory carry a randomly made-up email address, not yours |
| Listening summaries (daily, weekly, monthly, yearly) | The push channels you set up: Bark, ntfy, DingTalk, WeCom, Discord, Feishu, ServerChan, Telegram, Slack, or a webhook address you enter | The summary text |
| A shareable now-playing page | The relay you deploy yourself. Its top 10 artists page asks Deezer for artist pictures | What is playing now; artist names |
| Showing what you play on Discord (off by default) | The Discord app on your Mac, over its local connection. Discord then shows it on your profile | Song title, artist, album, cover address, player and progress, plus the line being sung and your button links if you turn those on |
| Web Lyrics and OBS Output (off by default) | A page Lyrimuse serves on this Mac (ports 3939 and 3940). Only this Mac can open it until you allow local network access; with Allow Remote Control on, the page can also control playback | Nothing is sent anywhere by itself. Devices that open the page with its link see the current lyrics, cover and progress |
| LX Music's Open API (when you turn it on in LX Music) | LX Music, over its own port on this Mac | Playback commands. Nothing leaves your Mac |
| Reporting a problem | GitHub, in your browser, and only if you submit the form | The app version, macOS version and player, plus the song and lyric source for lyrics reports. You see and can edit all of it before submitting |
Each of these services has its own privacy policy and logging, which the developer doesn't control.
5 The outbound request log
Every network request the app makes is written to a log on your Mac. It records the service, the operation, the hostname, the HTTP status and how long it took, and never the full address, the parameters, the body or any credential.
You can read it in Console.app, or include it in a diagnostics export from Settings. Exporting is always something you do by hand, and the file goes wherever you save it.
6 Permissions the app asks for
- Automation, for Apple Music, Spotify and Kaset when you pick them: it reads the current track and position and sends play controls. If you listen in a browser and turn on accurate web player progress, it also asks for Automation over that browser, to read the player's real position on the page.
- Accessibility, optional: QQ Music, NetEase Cloud Music, Kugou Music, Soda Music and Amazon Music use it for their shuffle, repeat and Favorite buttons, and reAMP for shuffle and repeat, pressing the player's own menu items or buttons when you click them; while another app holds Now Playing, it also sends play, pause and skip to QQ Music, NetEase Cloud Music and Soda Music; for Amazon Music it also keeps the playback position accurate; for YouTube Music in a browser it presses Skip on ads when automatic skipping is on.
- Full Disk Access, optional: QQ Music, NetEase Cloud Music and Kugou keep their play queue and the lyrics they downloaded in a protected folder, and Soda Music its play queue. With access, Lyrimuse prepares lyrics for the songs coming up next and can use the lyrics these apps already have; without it, those steps are simply skipped.
Other players are read through the system's Now Playing information and need no permission. None of these permissions are used for anything but following what you play.
7 This website
These pages are static files on GitHub Pages, with no cookies, analytics or trackers. The only thing they store is the language you pick, in your own browser's local storage. When you open the download menu, the page asks the GitHub API for the latest version number. GitHub, as the host, logs requests the way any web server does; see GitHub's privacy statement.
8 Children
Lyrimuse is not directed at children and collects no personal data from anyone, of any age.
9 Changes
When the app's data behaviour changes, this page changes with it and the date at the top is updated. Its history is public in the repository.
10 Contact
Questions or corrections: open an issue on GitHub.