Your music stays yours.

Access uses a Pragmatic Media Pass account. Pragmatic receives the email address used to sign in, an opaque account identifier, opaque device-link identifiers, the app and platform linked, entitlement status, and store transaction references needed to validate, restore, refund, and support purchases. Your media library, listening history, playlists, likes, lyrics, and playback URLs are not uploaded as part of Media Pass sign-in. Optional connected-library setup and family features are described below.

Monthly and annual subscriptions may be purchased through supported app stores or independently on the Pragmatic website. Apple, Google, Amazon, Stripe, and other payment providers process payment details under their own policies; Pragmatic retains entitlement and transaction-reference data, not full card numbers.

Media Pass stores household membership and managed profiles, including the profile name, avatar choice, adult, teen or child setting, access rules, and links to the selected media-server identity. Parent PINs are stored as hashes, not readable PINs. These records are linked to the household account so its authorized members can manage shared-device access. Your media server still controls which media that identity can access.

If a parent enables Ask a parent, Pragmatic stores the title the child types, its profile and household, request status and dates, and any parent response note. These family wishes are visible to authorized members of that household. They are separate from DroppedNeedle or other acquisition requests: parent approval does not itself download or acquire music. Disabling requests cancels pending wishes; it does not delete their records.

When you choose automatic setup for a shared library, Pragmatic processes the owner-approved server identity, service addresses, access permissions, and setup status. Completing a connection can temporarily process a provider session or authorization proof to deliver that connection to your device. This setup does not upload your listening history or complete library.

Tonarr connects only to services you choose, such as Plex, Jellyfin, or OpenSubsonic/Navidrome. Those services may return account identity, library metadata, artwork, lyrics, playback URLs, playlists, ratings, and play history needed for features you use.

When you start content-label verification, Tonarr sends the selected tracks' artist, song, album, duration, and available public recording identifiers directly to Apple and Deezer so their public catalogues can return advisory clean or explicit metadata. Tonarr does not send audio, file paths, server addresses, credentials, listening history, account or device identifiers, or advertising identifiers with those lookups.

Discover retrieves public charts and recording metadata from Apple Marketing Tools, MusicBrainz, ListenBrainz, and Cover Art Archive. Private Daily Mixes and taste ranking run on your device. Artist-based discoveries are optional and off by default: enabling them sends up to three artist names selected from your local taste to MusicBrainz and ListenBrainz, and public recording identifiers to ListenBrainz for metadata. No listening events, account identity, server address, credentials, file paths, or audio accompany those requests. Turning sharing off cancels the refresh and removes the related recommendation cache on that device.

Optional music requests connect directly to the DroppedNeedle, Tonarr Connector, or Lidarr service the listener configures. Tonarr provides no media catalogue or acquisition sources itself. The selected service controls approval, availability, processing, and request retention. Request features depend on the platform and build you use; they remain separate from your playable media library.

After connection setup, media-server library, playback, download, search, rating, and playlist traffic goes directly from your device to the service you selected. The content-label lookup described above goes directly to Apple and Deezer. Pragmatic Developments does not proxy those direct connections. The optional Media Pass setup and family records described above are separate.

When DroppedNeedle is enabled, you sign in directly to the selected private server with the account its owner created. Tonarr stores the server-issued revocable session in secure storage on that device and does not retain the entered password. The server owner controls account roles, approvals, limits, automation, availability, and request history. DroppedNeedle remains separate from Plex, Jellyfin, or OpenSubsonic/Navidrome, which continues to be the source for library browsing and playback. Pragmatic does not receive those request credentials or requests.

Connector and Lidarr tools likewise communicate only with the endpoint the listener configures. Pragmatic does not receive those credentials or requests.

Server credentials are stored in Apple Keychain or Android Keystore-backed encrypted storage. Downloads, library caches, preferences, likes, content-label results, and optional listening history remain on your devices.

On Apple platforms, optional Device Harmony uses your private iCloud/CloudKit database to synchronize encrypted credentials and selected playback state across devices signed in to your Apple Account. Apple states that private CloudKit records are not visible to the developer through its portal. Android does not upload Tonarr app-continuity data to a Pragmatic-operated or owner-hosted relay.

Local-network access is requested when connecting to a server on your network. Notifications, media controls, widgets, Spotlight/App Shortcuts, CarPlay, Android Auto, Cast, and Wear features are used only when their related feature is enabled. Apple and Android system media surfaces receive the now-playing information Tonarr publishes for playback controls. Tonarr does not sell data or use advertising identifiers.

On Android, Google's Cast Sender SDK automatically sends encrypted, anonymous app-activity and device diagnostics to Google so Google can improve Cast reliability and performance. Google says this SDK telemetry does not contain user or content metadata, is not used to model an individual user, and cannot be disabled or deleted by Tonarr or Pragmatic Developments.

Media Pass account, device-link, and entitlement records remain while the account is active and as needed for fraud prevention, refunds, tax, accounting, and legal obligations. Sign in at pragmatic.onl/media/activate to remove linked screens or permanently delete the Pragmatic account. Account deletion cancels an active Stripe Media Pass subscription immediately; subscriptions bought from Apple, Google, or Amazon must also be cancelled in that store account.

Disconnecting a media server removes its saved credential from that device; on Apple platforms, “everywhere” actions also remove the app-managed private CloudKit record. Listening history can be cleared in Settings, downloads can be removed in the app, and uninstalling removes local app data according to the operating system's rules. Data held by your own media services must be managed with those services.

Disconnecting DroppedNeedle asks that server to end the saved session before Tonarr removes it locally. If server-side revocation cannot be confirmed, the session may remain valid until you retry or the server owner revokes it. Requests and history retained by DroppedNeedle, a legacy connector, or Lidarr must be deleted under that private service's controls and policy.

Family profile and wish records remain with the household until removed through the applicable profile or account deletion. Permanently deleting the associated profile or household deletes its dependent family wishes. Cancelling or declining a wish only changes its status. These actions do not delete records held by an external music or request service.

Public servers must use HTTPS. Plain HTTP is permitted only for listener-selected loopback, local-DNS, private-address, or Tailnet hosts. Credentials are never accepted inside a server URL.

For Tonarr privacy, support, accessibility, or deletion requests, contact Pragmatic Developments Inc.

[email protected]