Effective Date: Sep 9, 2026
At NoBars (referred to as “NoBars,” “our,” “us,” or “we”), safeguarding your privacy is not a feature we added — it is the reason the app exists. NoBars is an offline music and audio player: it plays the files you already own, from your own device, with no account, no streaming catalogue, and no advertising. This Privacy Policy outlines our practices regarding the collection, use, and disclosure of information we obtain from users of our mobile application (the “App”). This policy applies solely to the information you provide through the App. The copyright of this agreement is owned by the operator of NoBars, who reserves the right to interpret and amend it at any time.
Your library never leaves your device. Playing music, browsing your library, making playlists, importing files, editing tags, and using the trash involve no network requests at all — this is enforced in our source code by a build-time check that fails the release if any of that code touches the network, not merely promised in a document like this one.
NoBars has no user account. You never sign up, and there is nothing for us to hold. The App reaches the internet in only four situations, each described in full below: when you personally connect one of your own cloud or NAS accounts to import files from it, when you ask it to look up lyrics for a track, when it checks the store for a newer version of itself, and — unless you turn it off — when it sends anonymous usage counts. A single switch, Offline Lock, stops all four at once.
We do not show advertisements, do not embed advertising SDKs, do not collect an advertising identifier, do not build a profile of you, and do not sell or rent your data to anyone. There is no one to sell it to and nothing to sell.
We operate no server that your library, your listening, or your account data passes through. NoBars sends nothing to any backend of ours; the few outbound requests it makes go directly to the service concerned — your own cloud provider, a public lyrics database, your platform’s app store, or Google’s analytics service.
To provide the App’s core functionality, NoBars stores the following entirely on your device, inside the app’s private sandboxed storage:
.lrc file you import alongside it,
or fetched by you through the optional lookup described belowNone of this is transmitted anywhere. We never receive a filename, a track title, an artist name, a playlist, or a play count.
Settings contains a single switch called Offline Lock. While it is on, every outbound internet request the App is capable of making is refused before it leaves the device: the cloud and NAS connections, the lyrics lookup, the update check, and anonymous usage statistics. Features that would need the network are shown greyed out with an explanation rather than hidden, so you can always see exactly what the switch is holding back. Transferring files from your own computer over Wi-Fi keeps working, because that traffic never leaves your local network.
NoBars offers several ways to bring in music you already own. Each one is started by you, and each one is one-directional — files come in, nothing is sent out.
The Files app: You pick files through Apple’s standard document picker. This reaches your iCloud Drive, your device’s Downloads, and any other cloud service you have installed that provides a Files extension. NoBars only ever receives the specific items you select; it cannot see anything else, and Apple — not NoBars — runs that picker.
Upload from your computer: NoBars can start a small web server on your device so you can drag
files in from a browser on the same Wi-Fi network. That server runs on your device, is reachable only from
your local network, exists only while the screen is open (and stops itself after a period of inactivity),
and is announced over Bonjour (_crate._tcp) so your computer can find it. Nothing passes
through the internet or through any server of ours. This is why iOS asks for Local Network permission.
Apple Music (the Music app on your device): If you choose this, iOS asks for permission to your media library and shows Apple’s own track picker. NoBars receives only the tracks you select in it, and copies each one into its own storage. Tracks downloaded from an Apple Music subscription are DRM-protected and cannot be copied by NoBars or by any other app; they are counted and reported to you as skipped, never circumvented. NoBars does not read, index, or upload your wider media library.
NoBars can connect to storage you already own so you can browse it and copy files down to your device. These connections are always optional, always started by you, and always read-only — the App has no code that can upload, modify, rename, move, or delete anything on any of these services.
WebDAV and network drives (Nextcloud, Synology, QNAP, TrueNAS, and similar): You enter the server address, username, and password. These go directly from your device to your server. Your password is stored in your device’s Keychain and never written into the App’s database, so a backup or a copy of the App’s data contains no credentials.
Dropbox, Google Drive, and OneDrive: You sign in through the service’s own web page, shown in
an isolated system browser (ASWebAuthenticationSession) that NoBars cannot read. We never see,
receive, or store your password for any of these services. What comes back is an access token, which is kept
in your device’s Keychain and used only to list folders and download the files you choose.
The permissions each service grants us are the narrowest ones that let you browse and download:
account_info.read (to show which account is connected),
files.metadata.read (to list folders), and files.content.read (to download what
you pick)drive.file only — this grants access solely to the
files and folders you personally choose in Google’s own picker. NoBars cannot see, list, or search the
rest of your Drive, and has no way to request that abilityFiles.Read (to browse and download),
User.Read (to show which account is connected), and offline_access (to stay
connected without asking you to sign in repeatedly)For Dropbox and OneDrive, the account-identifying permission returns a name or email address, which is shown
as the label on that connection’s row and stored on your device with the connection. It is never sent
anywhere. Google Drive’s drive.file scope returns no account details at all.
Files downloaded from these services go straight from the service to your device over an encrypted connection. They do not pass through, and are never stored on, any server operated by us. You can disconnect any connection at any time from the Import tab, which deletes its stored token from the Keychain immediately.
This section states, in one place, exactly what NoBars does with data obtained through Google APIs.
What we access. Only the drive.file scope is requested, and it is not combined
with any other Google scope. That scope reaches only the files and folders you personally select in
Google’s own file chooser. For those items NoBars reads the file name, size, type, modification date, and —
when you ask for it — the file content, so it can be copied to your device. For a folder you select, the same
details for the items inside it. NoBars cannot see, list, or search anything else in your Google Drive, and
it has no technical means to request that ability. It does not receive your Google account name, email
address, profile, or contacts.
How we use it. File names and details are used to show you the list you are choosing from. File content is used to copy the tracks you selected into the App’s own storage so they can be played offline. That is the entirety of the use.
How we store it. Downloaded files are stored in the App’s private, sandboxed storage on your device, alongside the rest of your library. The OAuth access and refresh tokens are stored in your device’s Keychain, readable only after the device has been unlocked, and the App’s database holds a reference to the Keychain entry rather than the token itself. None of this is stored on, or passes through, any server operated by us — files travel directly from Google to your device.
How we share it. We do not. Google user data is not transferred to us, to any third party, to any advertising network, or to any AI or machine-learning model, and it is not read by any human. It is not sold, and it is not used to build a profile of you.
How long we keep it, and how to remove it. Tokens are deleted from the Keychain the moment you disconnect the connection in the Import tab. Files you already copied to the device are yours and stay in your library until you delete them, empty the trash, or remove the App — deleting the App removes everything it stored. You can also revoke NoBars’ access from your Google Account’s third-party access settings at any time, independently of anything you do in the App.
Limited Use. NoBars’ use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements.
NoBars asks for the following only at the moment a feature needs them, and works without any of them:
Local Network: to receive files from your computer over Wi-Fi, as described above.
Media & Apple Music: to show Apple’s track picker when you import from the Music app.
Photo Library: only when you choose to set an image as album artwork. NoBars receives the single image you pick and does not scan or upload your library.
Notifications: only if you turn reminders on, as described below.
Background audio and background processing: so playback continues when the screen is off and a long import can finish after you leave the screen. Neither involves the network.
NoBars can remind you about a track you left part-way through, an audiobook you have open, an import you have not listened to yet, or something you have not played in a long time. This is off until you switch it on in Settings, and you can choose which of those four kinds you want.
These are local notifications only. There is no push token, no APNs or FCM registration, and no server of ours deciding when or what to send: the App reads its own on-device database, works out the sentence, and hands the finished notification to the operating system to show later. The text can contain your own track or book titles, because that is what makes a reminder useful — and it never leaves your device, because nothing about this feature involves the network. Turning notifications off in Settings, or revoking the permission in your device settings, stops them entirely.
Settings contains a switch called Anonymous usage stats. It is on by default, you can turn it off at any time, and Offline Lock disables it entirely regardless of its position. When it is on, the App sends counts of what happened — for example that an import started, which channel it used, whether it succeeded, and which screen was opened.
These events come from a fixed vocabulary written into the App that contains no free-text field of any
kind. Every value is chosen from a closed set of options: an outcome is
success/partial/failed/cancelled, a library size is a
bucket such as 20-99 or 1000+, a file type is mp3 or
flac. There is no field a filename, a track title, an artist name, or a folder path could
travel in, and a build-time check plus a runtime tripwire in our source code enforce that. This is a property
of the system rather than a promise about our intentions.
Alongside the events, the App records a small number of anonymous properties used to segment them: a library size bucket, whether Offline Lock is on, whether any cloud or NAS connection exists, and which import channel you first used successfully.
Who processes this. The statistics are collected through Google Analytics for Firebase, provided by Google. This is the only third-party SDK in the App that sends anything anywhere. Collection is switched off in the App’s native configuration at launch and is only ever enabled after your settings have been read, so an install with Offline Lock on transmits nothing at all — not even a session start. Along with our events, Firebase collects its own standard data, including a randomly generated app instance identifier, your device model, operating system version, app version, language, and a coarse region derived from the network address the request arrives from. That identifier is not your Apple ID, your advertising identifier, or your device’s serial number, and it identifies an installation rather than a person. Google’s handling of this data is governed by Google’s Privacy Policy and the Firebase privacy documentation.
When you turn the switch off, the App both stops collecting and instructs Firebase to delete the analytics data held for your installation. We do not use any advertising SDK, any attribution SDK, or any other analytics provider.
This version of NoBars contains no crash reporting SDK and sends no crash reports. If a crash report reaches us, it is because you chose to send it through Apple’s or Google’s own diagnostics setting, which is controlled entirely by your device settings and delivered to us by the platform in aggregated, de-identified form. If we introduce our own crash reporting in a future version, it will be described here and covered by Offline Lock.
The App can check whether a newer version has been published, and tells you once rather than nagging. On iOS this is a single request to Apple’s public iTunes Lookup endpoint asking for the current public version of NoBars; on Android it uses Google Play’s in-app update service. Neither request carries anything about you or your library — the App asks about itself. Both are blocked by Offline Lock, and both go to Apple or Google rather than to us.
If you ask NoBars to find lyrics for a track, it sends the track’s title, artist, album, and duration directly to LRCLIB, a free public lyrics database that requires no account and no API key. The request identifies the app by name and nothing else. It never sends the filename, the file path, or any identifier from your library, and it does not pass through any server of ours.
Results are always returned as a list of candidates for you to choose from — NoBars never silently rewrites a track. The feature does nothing unless you use it, and is disabled entirely by Offline Lock. LRCLIB’s own handling of the requests it receives is governed by its terms, not by this policy.
NoBars may occasionally ask whether you would like to rate it, using Apple’s or Google’s own rating prompt. That prompt is drawn and handled by the operating system; the App is not told whether you rated it or what you said, and your review is between you and the store.
“Send feedback” in Settings opens your own email app with our address and your app version filled in. Nothing is sent until you send it, and what you write reaches us as an ordinary email, which we keep only as long as needed to answer you.
This version of NoBars contains no in-app purchases and no subscriptions. Every feature is available without paying, and the App asks for no payment details. Should a paid upgrade be offered in a future version, it would be a one-time purchase sold and billed entirely through the Apple App Store or Google Play — we would never see, collect, or store your payment card or billing details — and this policy would be updated to describe it before it shipped.
We do not sell your personal information. Information reaches a third party only in these ways:
Google (Firebase): processes the anonymous usage statistics described above, while that switch is on.
LRCLIB: receives a track’s title, artist, album, and duration when you personally ask for lyrics.
Apple and Google: distribute the App and answer its update check, and operate the rating prompt.
Services You Connect Yourself: when you connect Dropbox, Google Drive, OneDrive, or a WebDAV server, your device communicates with that service directly. Your relationship with them is governed by their own privacy policies, not this one.
Legal Compliance and Protection: We may disclose information if required by law, or where we believe in good faith it is necessary to comply with legal process, protect our rights, or ensure the safety of our users.
Business Transfers: If NoBars is involved in a merger, acquisition, or asset sale, information we hold may be transferred as part of that transaction, subject to this Privacy Policy.
Your library is stored in your device’s app-sandboxed storage, protected by the operating system’s own file protection. Every credential — a WebDAV password, a Dropbox, Google, or Microsoft access token — is stored in the platform Keychain, marked so it is readable only after the device has been unlocked at least once, and the App’s database holds a reference to the Keychain entry rather than the secret itself. All network traffic is encrypted in transit (HTTPS/TLS), except the local Wi-Fi upload server, which does not leave your network. No method of transmitting or storing data is completely secure, and we cannot guarantee absolute security.
Your library is retained on your device until you delete it or remove the App. Deleted items sit in the trash for up to 30 days before being purged. Because there is no account and your library is never uploaded, there is nothing on our side to retain, delete, or export. Anonymous usage statistics are held by Google for a limited period under the retention setting configured for our Firebase project, and are deleted for your installation as soon as you turn the switch off.
NoBars is a general-audience media player and is not directed at children. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us and we will delete it promptly.
Depending on where you live, you may have rights to access, correct, or delete personal information held about you, or to object to its processing. Because NoBars operates without an account and keeps your library on your device, we hold almost nothing that could identify you; where we do, you may contact us at the address below to exercise these rights.
The few requests the App does make leave your country in the ordinary course of using an internet service: anonymous usage statistics are processed by Google on infrastructure in the United States and elsewhere, a lyrics lookup goes to LRCLIB, and an update check goes to Apple or Google. These destinations may have different data protection laws than your country of residence. Your library is not among the things transferred.
The App may open external links, such as a service’s sign-in page or the App Store, using your device’s native handlers. Those destinations are governed by their own privacy policies, which we encourage you to review.
We may revise this Privacy Policy from time to time. If we make material changes, we will notify you by updating the effective date above and, where appropriate, through an in-app notice. Continued use of the App after changes take effect constitutes acceptance of the revised policy.
For any questions about this Privacy Policy or your data, please contact us:
Email: service@oxcellion.com