Your music, your business.

Effective date: October 5, 2026

What Kord does

Kord is a native music player for iPhone. It plays audio files stored on your device or imported from cloud storage you connect. There is no Kord account, no streaming service, and no server that stores your library.

Data we collect

Kord has no Kord account, advertising, or third-party analytics SDK. Kord stores your library, playback preferences, history, artwork, lyrics, and settings on your device. Google Drive and a Jellyfin server you choose receive requests needed for their connections. Artwork and metadata lookups may also run automatically when you import music or open your library, artist details, or Now Playing; external providers receive the requested song and artist information and ordinary connection information, including your IP address, and may keep request logs under their own policies. Kord does not send your complete audio library to the developer or metadata providers.

Google user data

Kord can optionally connect to your Google Drive so you can import audio files into your local library. Connecting Google Drive is optional, and Kord works without it. When you choose to connect, Kord uses Google's Picker and requests access to the individual files you select:

• Selected-file access through Google's drive.file permission. Kord reads the metadata and FLAC audio for files you explicitly choose. It does not browse your whole Drive or automatically authorize other files in a folder.
• Connection identity returned by Google, including the account email and permission identifier, used to show the connected account and distinguish its authorized files.

Your Google credentials are handled entirely by Google — Kord never sees or stores your Google password.

How Kord uses Google user data

Kord uses selected-file metadata and audio to build your local library and play your music. It does not edit or delete Drive content, and it does not send your Google credentials, Drive file contents, file IDs, folder listings, or account email to metadata providers. Kord's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

How Kord retains and deletes Google user data

Kord has no server that stores your Google Drive files, Drive account data, or library. Kord stores your Google account email, permission identifier, authorized file IDs, library entries, and downloaded or cached audio on your device for the purposes described above. It stores the refresh token in Keychain and holds a short-lived access token in memory while connected. Local data remains until you remove it or it is evicted by Kord's cache rules. Deleting the app removes its app-container data, but Keychain credentials may survive depending on the operating system. Apple Developer Technical Support documents this behavior in its Keychain guidance. Sign out of Google Drive before deleting Kord if you want the stored OAuth credentials removed immediately.

• OAuth tokens — Kord stores Google's refresh token in your device's Keychain to stay signed in between sessions; it holds the short-lived access token in memory. Kord removes the local credentials when you sign out or disconnect Google Drive in Kord's settings. Revoking Kord's access from your Google Account prevents future API access; Kord removes the local credentials when it next discovers that the session has expired.
• Library entries — Kord saves the selected file IDs and music metadata in its local library database until you remove the tracks or erase Kord's local app data. Signing out removes the Google credentials, but does not automatically delete library entries already imported.
• Cached audio — Kord may download a Drive track into a private cache folder on your device for playback. You can clear that cache in Google Drive settings.
• No background browsing — Kord does not keep a background connection to Drive or retain unselected folder listings after the selection flow.

To remove Google user data from your device, sign out of Google Drive, tap Clear Drive Cache, and delete any Drive tracks you no longer want in your library. If you delete Kord without signing out first, the local Keychain credentials may remain and must be removed by reinstalling Kord and signing out. You can also revoke Kord's access at any time from your Google Account permissions page.

Third-party services

Kord may contact the following external services during normal use:

• Jellyfin — if you connect a server you choose, Kord sends the username and password you enter to that server for authentication, stores its returned access token in Keychain, and requests library metadata, artwork, and original FLAC audio. Authentication and subsequent requests include a random Kord-generated device identifier, the app version, an "iPhone" client label, and (after sign-in) the access token; the catalog request also includes your server account ID. Kord stores the identifier in Keychain, so it may persist after uninstalling the app. The server operator controls request logs and retention. If you use a server over HTTP rather than HTTPS, the connection does not encrypt credentials or requests.
• Artwork and metadata providers — after you add music, Kord may automatically send artist, album, and track names or public music identifiers to MusicBrainz, Cover Art Archive, Wikidata, Wikimedia Commons, image hosts, or ListenBrainz to find artwork, artist information, credits, or aggregate popularity. Providers can receive your IP address and may keep request logs. Kord does not send your listening history to ListenBrainz.
• Lyrics source — the Release app has no preset online lyrics source. If you enter one, Kord may send the track title, artist, album, and duration to that server and store returned lyrics locally. That server's operator controls its privacy practices.
• AutoEq catalog — browsing headphone profiles downloads catalog and profile files from GitHub. Searches run on your device.
• Google Drive — only if you connect it, as described above.

Analytics and tracking

Kord does not include an analytics SDK or ad tracker, and it does not maintain a Kord analytics account. The app records operational errors through Apple's logging system. Apple may make diagnostics available under your device's system sharing settings.

Data stored on your device

Kord stores your library database, playback settings, EQ presets, and cached metadata locally using Apple's standard frameworks (SwiftData, the file system, and the Keychain for credentials). Depending on your device and backup settings, app data may be included in device backups. Device security settings protect locally stored data.

Children's privacy

Kord is not directed at children under 13. We do not knowingly collect personal information from children. Connected services may process information under their own policies.

Changes to this policy

If we change this policy, we'll update the effective date at the top and post the new version here. For material changes, we'll note it in the app's changelog.

Contact

Questions about this policy? Email support@kordsound.com.