Privacy Policy

Last updated: October 15, 2026. This is a courtesy translation; the German version is the legally binding text.

In short

NAS Player collects no personal data and sends nothing to the developer or to third parties. The app only connects to the NAS whose address you enter. There is no advertising, no tracking, no analytics, and no third-party libraries.

1. Controller

Dominik Kunze
Straßburger Str. 6
10405 Berlin, Germany
Phone: +49 1567 8518844
Email: mobile_bumbles_6z@icloud.com

2. What the app stores on your iPhone

Everything stays on your device:

• Connection data: the address and user name of your NAS in the app settings; the password in the iPhone keychain.
• Library list: title, artist, album, genre, and file size of your music, which the app fetches from your NAS so you can browse it without a network.
• Downloaded music and covers: files you download to the iPhone and cached covers. This data is excluded from iCloud and computer backups.
• Favorites and play history (recently played, play counts) and the playback state (song, position, queue).

This data does not leave your device. If you delete the app, it is removed (the keychain password is deleted with “Remove connection”).

3. Connection to your NAS

The app communicates only with the address you provide, encrypted via https and only with a valid certificate. Your user name and password are sent to your NAS to sign in, and your music and covers are fetched from there. You, or the operator of your NAS, are responsible for this connection; the developer has no access to it. The app also occasionally checks whether your NAS is reachable.

Under iOS the app asks for access to the local network when your NAS is on your home network. It is used only for that.

Searching for your NAS

If you tap “Search for NAS on the network”, the app looks for devices in your local network (Bonjour). For each hit it requests, without any sign-in data, the public list of interfaces and reads the server certificate to suggest the address. This happens only on your iPhone and only on your local network; nothing is sent to the developer or to third parties.

4. CarPlay, Siri, and Shortcuts

In CarPlay the app shows lists and covers from your iPhone. The data stays on the iPhone; the display is handled by Apple and the vehicle. If you use Siri or Shortcuts (for example “Play my favorites with NAS Player”), Apple processes your voice input under its own privacy terms. The app only receives the recognized request (for example an album or artist name) and plays it from your library.

5. Demo mode

In demo mode the app uses sample music from the app bundle. No connection is made.

6. Apple (App Store, TestFlight)

When you download the app via the App Store or TestFlight, and for crash reports you share with Apple, Apple processes data under its own responsibility; see Apple's privacy information. If you have agreed in iOS to share data with app developers, the developer receives aggregated usage statistics and crash reports from Apple. They contain technical details such as device model and iOS version, but no name and no contact details. They are used only to find errors and improve the app; the legal basis is the legitimate interest in an error-free app (Art. 6(1)(f) GDPR).

7. This website and GitHub

These pages are provided through GitHub Pages (GitHub Inc., Microsoft). When you visit them, GitHub processes technically necessary data such as your IP address in server logs; the developer has no influence on this. The legal basis is the legitimate interest in a secure and reliable provision of these pages (Art. 6(1)(f) GDPR). GitHub also processes data in the USA. The transfer relies on the European Commission's adequacy decision on the EU-US Data Privacy Framework (Art. 45 GDPR), under which GitHub is certified. More information: GitHub's privacy statement.

If you write on GitHub Issues, your posts and your GitHub user name are publicly visible. Please do not post personal data or credentials there. When I reply, I process your post on the basis of my legitimate interest in handling questions and bug reports (Art. 6(1)(f) GDPR).

If you send an email, I use your address and message only to reply and delete them once the matter is settled. The legal basis is my legitimate interest in answering your request (Art. 6(1)(f) GDPR). Emails are received and stored through Apple iCloud Mail. Apple may also process data in the USA; Apple is also certified under the EU-US Data Privacy Framework (Art. 45 GDPR). The same applies to calls: I use your number and request only to resolve it.

You are not obliged to give me any data. Without an email address, phone number, or GitHub account, however, I cannot reply to you.

8. Your rights

Under the GDPR you have the right of access, rectification, erasure, restriction of processing, data portability, and objection (see section 9). Since the app does not collect data from you, there is usually nothing to delete at the developer; contact the email address above with any questions. You also have the right to lodge a complaint with a supervisory authority, for example the Berlin Commissioner for Data Protection and Freedom of Information.

9. Right to object

Where I process data on the basis of my legitimate interest (Art. 6(1)(f) GDPR), you may object to this processing at any time on grounds relating to your particular situation (Art. 21 GDPR). I will then stop processing the data unless there are compelling legitimate grounds that override your interests, or the processing serves to establish, exercise, or defend legal claims. An informal objection to the email address above is sufficient.

10. Changes

If the app changes in a way that changes data processing, this policy will be updated; the date above shows its status.