Your music stays yours.

Access uses a Pragmatic Media Pass account. Pragmatic receives the email address used to sign in, an opaque account identifier, opaque device-link identifiers, the app and platform linked, entitlement status, and store transaction references needed to validate, restore, refund, and support purchases. It does not receive your media-server password, library, searches, listening history, playlists, likes, lyrics, or playback URLs.

Monthly and annual subscriptions may be purchased through supported app stores or independently on the Pragmatic website. Apple, Google, Amazon, Stripe, and other payment providers process payment details under their own policies; Pragmatic retains entitlement and transaction-reference data, not full card numbers.

Tonarr connects only to services you choose, such as Plex, Jellyfin, or OpenSubsonic/Navidrome. Those services may return account identity, library metadata, artwork, lyrics, playback URLs, playlists, ratings, and play history needed for features you use.

When you start content-label verification, Tonarr sends the selected tracks' artist, song, album, duration, and available public recording identifiers directly to Apple and Deezer so their public catalogues can return advisory clean or explicit metadata. Tonarr does not send audio, file paths, server addresses, credentials, listening history, account or device identifiers, or advertising identifiers with those lookups.

Discover retrieves public charts and recording metadata from Apple Marketing Tools, MusicBrainz, ListenBrainz, and Cover Art Archive. Private Daily Mixes and taste ranking run on your device. Artist-based discoveries are optional and off by default: enabling them sends up to three artist names selected from your local taste to MusicBrainz and ListenBrainz, and public recording identifiers to ListenBrainz for metadata. No listening events, account identity, server address, credentials, file paths, or audio accompany those requests. Turning sharing off cancels the refresh and removes the related recommendation cache on that device.

Optional music requests connect directly to the DroppedNeedle, Tonarr Connector, or Lidarr service the listener configures. Tonarr provides no media catalogue or acquisition sources itself. The selected service controls approval, availability, processing, and request retention. Request features depend on the platform and build you use; they remain separate from your playable media library.

Media-server sign-in, library, playback, download, search, rating, and playlist traffic goes directly from your device to the service you selected. The content-label lookup described above goes directly to Apple and Deezer. Pragmatic Developments does not proxy that traffic and does not receive your server credentials, listening history, library, searches, or content-label queries.

When DroppedNeedle is enabled, you sign in directly to the selected private server with the account its owner created. Tonarr stores the server-issued revocable session in secure storage on that device and does not retain the entered password. The server owner controls account roles, approvals, limits, automation, availability, and request history. DroppedNeedle remains separate from Plex, Jellyfin, or OpenSubsonic/Navidrome, which continues to be the source for library browsing and playback. Pragmatic does not receive those request credentials or requests.

Connector and Lidarr tools likewise communicate only with the endpoint the listener configures. Pragmatic does not receive those credentials or requests.

Server credentials are stored in Apple Keychain or Android Keystore-backed encrypted storage. Downloads, library caches, preferences, likes, content-label results, and optional listening history remain on your devices.

On Apple platforms, optional Device Harmony uses your private iCloud/CloudKit database to synchronize encrypted credentials and selected playback state across devices signed in to your Apple Account. Apple states that private CloudKit records are not visible to the developer through its portal. Android does not upload Tonarr app-continuity data to a Pragmatic-operated or owner-hosted relay.

Local-network access is requested when connecting to a server on your network. Notifications, media controls, widgets, Spotlight/App Shortcuts, CarPlay, Android Auto, Cast, and Wear features are used only when their related feature is enabled. Apple and Android system media surfaces receive the now-playing information Tonarr publishes for playback controls. Tonarr does not sell data or use advertising identifiers.

On Android, Google's Cast Sender SDK automatically sends encrypted, anonymous app-activity and device diagnostics to Google so Google can improve Cast reliability and performance. Google says this SDK telemetry does not contain user or content metadata, is not used to model an individual user, and cannot be disabled or deleted by Tonarr or Pragmatic Developments.

Media Pass account, device-link, and entitlement records remain while the account is active and as needed for fraud prevention, refunds, tax, accounting, and legal obligations. Sign in at pragmatic.onl/media/activate to remove linked screens or permanently delete the Pragmatic account. Account deletion cancels an active Stripe Media Pass subscription immediately; subscriptions bought from Apple, Google, or Amazon must also be cancelled in that store account.

Disconnecting a media server removes its saved credential from that device; on Apple platforms, “everywhere” actions also remove the app-managed private CloudKit record. Listening history can be cleared in Settings, downloads can be removed in the app, and uninstalling removes local app data according to the operating system's rules. Data held by your own media services must be managed with those services.

Disconnecting DroppedNeedle asks that server to end the saved session before Tonarr removes it locally. If server-side revocation cannot be confirmed, the session may remain valid until you retry or the server owner revokes it. Requests and history retained by DroppedNeedle, a legacy connector, or Lidarr must be deleted under that private service's controls and policy.

Public servers must use HTTPS. Plain HTTP is permitted only for listener-selected loopback, local-DNS, private-address, or Tailnet hosts. Credentials are never accepted inside a server URL.

For Tonarr privacy, support, accessibility, or deletion requests, contact Pragmatic Developments Inc.

[email protected]