Occano

Occano privacy policy

Effective 22 October 2026.

Occano is a free, non-commercial music player for music files you already have. There are no ads, no analytics and no tracking, and we never sell data. This page says what leaves your device, why, and who sees it.

"We" means the person who runs Occano and its server. Contact: lunabeauvois@gmail.com.

The short version

• Your music files, folders, library and listening history stay on your devices.
• To identify and describe songs, Occano sends a song's sound fingerprint and names to music databases such as MusicBrainz and AcoustID.
• Occano shares what it learns about each song (not who has it) with the Occano server, so other people's copies of Occano don't have to look it up again. You can turn this off in Settings.
• An account is optional. It lets your own devices find each other and sync your library directly, device to device.
• Feedback is a public forum for Occano users: what you post there, including any log lines you attach, can be read by other signed-in users. Don't include personal information.
• You can delete your account from inside the app.

What leaves your device, and why

Song identification and tags

When Occano adds a song, it makes a sound fingerprint and a sound "vector" (a list of numbers describing how the song sounds). It sends the fingerprint and length to AcoustID, and song, album and artist names or IDs to MusicBrainz, Last.fm, Discogs and Cover Art Archive, to work out what the song is and gather genres, tags and covers.

It then sends the song's sound vector and the tags it gathered to the Occano server, labelled with the song's public MusicBrainz ID and a random install ID made on first use. Other copies of Occano can read these, and they appear on the public catalogue at occano-cache.packthings.fyi. Your install ID, account and device are never shown there.

You can turn this off with Settings → Library → "Share what Occano learns about your songs" (on by default, set separately on each device). When it's off, Occano sends nothing about your songs to the Occano server, in normal or Hands-off mode. It still reads what other people shared, which sends only the song's public MusicBrainz ID.

Hands-off mode

In Hands-off mode Occano does no online lookups of its own. If "Share what Occano learns about your songs" is on (it is on by default), Occano sends each song's fingerprint, sound vector and your own tags for it to the Occano server: the song file's tags (title, artist, album, genres and so on) and any tags you added in Occano. The server identifies the song with AcoustID and keeps your tags with it. Once a song is identified, those tags can appear on the public catalogue as "Manual tags", without anything that identifies you. Turn the setting off and nothing is sent.

Lyrics

Occano looks up lyrics on LRCLIB using the song's title, artist, album and length. You can turn this off in Settings ("Look up lyrics online").

Sharing a song

When you open the Share dialog, Occano asks MusicBrainz, Apple's iTunes Search and Deezer for links to that song, using its title, artist and ISRC code.

Discover

The Discover page sends an artist's MusicBrainz ID to the Occano server. "More like this" sends the IDs of your 10 most-played songs and the IDs of the songs you already have, so the server can suggest songs you don't have. The server doesn't keep these lists.

Discord status (off by default)

If you turn it on, Occano tells the Discord app on your computer what you're playing (title, artist, album, time). To show the album cover, it may upload a small copy of that album's cover to the Occano server, where it is public at a web address that Discord displays. This is controlled by the Discord settings, not by the song-sharing switch above.

Updates and plugins

On Windows, Occano checks for updates when it starts and every 6 hours by downloading a small file from our storage (Cloudflare R2). It sends no ID with this check. The Plugins page downloads plugin lists and plugins from the Occano server, our storage, or sources you add yourself.

Plugins you install can ask for permissions, such as internet access. Some plugins include their own program, which can do things Occano can't control. Only install plugins you trust.

Accounts and syncing your devices

An account is optional. If you make one, the Occano server stores:

• your username;
• your password, stored only as a one-way hash (argon2id), never the password itself;
• for each signed-in device: its name (on Windows, the computer's name unless you change it), its type (Windows, Android…), its storage preference, when it was last seen, and the network addresses it can be reached at;
• sign-in sessions, stored as one-way hashes.

Your devices then sync directly with each other, encrypted end to end: your library data (songs, tags, ratings, edits, play history, lyrics, chosen covers), your music files, and your settings and plugins (including plugin values a plugin marks as secret, such as a login). This does not go through the Occano server. It can pass through public relay servers run by n0 (the makers of iroh) when your devices can't connect directly. The relays can't read it, but they see your devices' network addresses.

Feedback

Feedback is a public forum for Occano users. Every signed-in Occano user can read all feedback, including usernames, attached log lines and screenshots. Don't include personal information (your name, email, address, or anything else that identifies you) in what you write, attach or reply.

When you send feedback, the Occano server stores what you write, any screenshots you attach (we strip hidden photo data such as location first), the app version and your operating system. If you switch on "Attach the last 50 lines of Occano's log", it also stores the last 50 lines of Occano's log, which can include file and folder names from your computer.

Feedback is stored with your username, or as "anonymous install" if you're not signed in. If you're not signed in, you can only see your own feedback, but signed-in users can still read it.

What stays on your device

Your music files and folders, your library and listening history, Occano's log and crash reports (never uploaded unless you attach the log to feedback), your Hands-off file tags (unless shared, above), and the keys and tokens that keep your account and device secure.

The catalogue website

The public catalogue at occano-cache.packthings.fyi needs no account and runs no tracking or analytics. If you pick a sort order on a list (A–Z, Most played, Recently added), the site remembers it in a cookie named occano_sort that holds only that choice, for one year; it holds no ID and you can delete it any time. Album covers on the site load straight from Cover Art Archive (coverartarchive.org and archive.org), so your browser contacts those sites when it shows them.

Who we share data with

Only the services named above, and only what's described. We don't sell or rent data, and we don't share it with advertisers or data brokers. The Occano server runs on a rented server at Hetzner. Downloads and covers are stored with Cloudflare R2. Each service you connect to sees your IP address, as any website does.

Security

Everything Occano sends over the internet is encrypted (HTTPS, or end-to-end encryption between your devices). Passwords, sessions and install keys are stored only as one-way hashes. Other data on the server is not encrypted at rest. On your device, Occano's files are not encrypted beyond what your device does.

How long we keep data, and deleting it

We keep data until it is deleted. The server forgets IP addresses within an hour and doesn't record them anywhere.

Signing out also ends that device's session on the server. If you're offline, Occano signs you out on the device only; remove the device from another one to end its session on the server. You can remove a device from your account in the app (Account → your devices), which signs it out. You can change your password and sign out your other devices.

Delete your account: Settings → Account → "Delete account…". After you confirm with your password, the server deletes your account (username and password hash), its list of devices and every sign-in session straight away, and all your devices are signed out. Your music, library and settings stay on your devices.

What deleting your account doesn't remove:

• Feedback you posted stays readable, but its author is changed to "deleted account" and it's no longer linked to you. To have it removed, email us (below).
• Shared song data (sound vectors, tags and Hands-off submissions) was never linked to your account, only to a random install ID, so it stays. To stop sharing more, turn off "Share what Occano learns about your songs".

To delete feedback or anything else we hold, email lunabeauvois@gmail.com. To have shared song data removed, include your install ID: it's in the file cache-install.json in Occano's data folder.

Children

Occano is not aimed at children and doesn't ask for anyone's age.

Changes

If this policy changes, the new version will be posted here with a new date.