Occano: Google Play Data safety answers
Draft answers for the Play Console "Data safety" form, mapped from docs/DATA-FLOWS.md (audit of 22 October 2026). Privacy policy: https://occano-cache.packthings.fyi/privacy
Overview questions
| Question | Answer |
|---|---|
| Does your app collect or share any of the required user data types? | Yes |
| Is all of the user data collected by your app encrypted in transit? | Yes (HTTPS to the Occano server and every API; QUIC/TLS end to end between a user's own devices) |
| Do you provide a way for users to request that their data is deleted? | Yes: in the app (Settings → Account → "Delete account…") and by email to lunabeauvois@gmail.com for anything else (feedback, shared song data by install ID) |
| Does your app allow users to create an account? | Yes, an optional username + password account (no email, no OAuth) |
| Delete-account URL (required when accounts exist) | https://occano-cache.packthings.fyi/privacy (section "How long we keep data, and deleting it"). In-app: Settings → Account → "Delete account…" (password confirm; deletes the account, its devices and sessions at once) |
Data types
Optional = the user can use Occano without it. Shared = it reaches a third party or becomes public, beyond the Occano server.
| Play data type | What it is in Occano | Collected | Shared | Optional? | Purposes |
|---|---|---|---|---|---|
| Personal info → User IDs | Account username, account id, device id | Yes | No | Optional (account only) | Account management, App functionality |
| Device or other IDs | Random install id (created on first use), device public key (node id), device name, device network addresses for sync | Yes | No | Install id: created whenever the Occano server is used (song sharing, feedback without an account); the rest optional (account only) | App functionality, Account management, Fraud prevention, security, and compliance (rate limits, device-list signing) |
| App activity → Other user-generated content | Song fingerprints, sound vectors and gathered tags, linked to a song's MusicBrainz ID; in Hands-off mode, the song file's own tags; feedback text and replies | Yes | Yes: song data is public on the catalogue and fingerprints go to AcoustID; feedback is visible to all signed-in users | Song data: optional, Settings → Library → "Share what Occano learns about your songs" (on by default, per device, both modes); feedback optional | App functionality |
| Photos and videos → Photos | Screenshots attached to feedback; small album-cover copies uploaded for the Discord status (desktop only) | Yes | Yes: feedback screenshots visible to signed-in users | Optional | App functionality (support) |
| App info and performance → Crash logs | Last 50 lines of the app log, only when the user switches on "Attach the last 50 lines of Occano's log" when sending feedback | Yes | Yes: visible to signed-in users with the feedback | Optional | Analytics (diagnosing bugs). Pick "App functionality" too |
| App info and performance → Other app performance data | App version and OS name sent with feedback | Yes | Same as feedback | Optional | App functionality |
Answer "No" for: Location, Financial info, Health and fitness, Messages, Audio (files are never sent to us), Files and docs, Calendar, Contacts, Web browsing, Personal info other than User IDs, Installed apps, In-app search history.
Not declared, and why:
- Music files and library sync between a user's own devices: sent device to device, end to end encrypted (relays can't read it), never received by us.
- "More like this" (most-played + owned song IDs) and Discover artist IDs: processed in memory to answer the request and not stored (Play's "ephemeral processing" exception).
- IP addresses: kept in memory for at most an hour for rate limiting, never written or used for location.
- Song names and IDs sent to MusicBrainz, Last.fm, Discogs, LRCLIB, iTunes Search and Deezer: catalogue lookups about songs, not about the user.
Security practices
- Encrypted in transit: Yes.
- Users can request deletion: Yes. Account: in the app (Settings → Account → "Delete account…"), immediate. Feedback is kept with its author anonymised ("deleted account"); shared song data isn't linked to the account (random install id). Both can be removed on request by email (lunabeauvois@gmail.com).
- Independent security review: No.
- Committed to Play Families policy: Not applicable (not aimed at children).