Prosody Privacy Policy

Prosody is an app for Android and iOS that plays audiobooks from an Audiobookshelf server that you choose. Prosody has no analytics, no advertising and no third-party tracking. The developer runs two services the app can reach: the optional hosted Sign in with Plex service for server owners, described under Single sign-on, and a public demo server for trying the app, described under The demo server.

What Prosody stores on your device

• The address of your Audiobookshelf server and, if you chose to pin it, that server's certificate fingerprint.
• The sign-in token your server issues after you enter your username and password. Your password itself is not stored.
• A copy of your library listing, cover images, listening progress, bookmarks and any audiobooks you download, so the app works offline.
• Your preferences (playback speed, skip lengths, sleep timer, download settings).

All of this lives in the app's own storage, and uninstalling Prosody removes it. On Android 10 and older, apps you have allowed to read your storage may also be able to read downloaded audiobooks. On iPhone and iPad, iOS keeps the sign-in token, and the copy of the current book the home-screen widget reads (its title, author, chapters, position and a small cover), in the device's keychain even after the app is deleted, so sign out first to remove those too.

Signing out asks you to confirm, then deletes that account's sign-in token, downloads, copy of the library (covers included), listening progress and bookmarks, and any listening not yet sent to your server. Your preferences, the random device identifier described below, the certificates you approved, and the server addresses and usernames the sign-in screen offers again stay until you uninstall; you can remove a saved server on that screen.

What Prosody sends, and where

Prosody talks to the Audiobookshelf server you entered. It sends:

• your username and password when you sign in, always over HTTPS (Prosody does not connect to plain HTTP addresses);
• your listening position, listening time, bookmarks and "finished" marks, so your progress syncs between your devices;
• what you search for, so it can find matching books;
• a random device identifier, your device's make and model, its system version and Prosody's version, which Audiobookshelf shows in its listening-session history along with the IP address each session came from.

Chromecast is in the Android app only. When you cast, Prosody gives the Cast device the book's title and author and the addresses of its cover and audio, which carry your sign-in token, and the Cast device fetches the audio directly from your server using Google's standard media receiver. Google's Cast library, part of Google Play services, finds Cast devices on your local network and, according to Google, sends Google anonymous information about Cast device discovery, casting sessions, the phone and the app.

If you ask Siri (on iPhone, iPad or in CarPlay) or Google Assistant (in Android Auto) to play a book, the assistant passes Prosody what you asked for and gets back the title and author of the book that plays. Apple and Google handle the voice request under their own privacy policies.

Two other services are involved: Google Play Billing (Android) or the App Store (iPhone and iPad), which Prosody asks whether your Plus subscription is active each time you open it, and which handle buying and restoring it (see Purchases); and the hosted Sign in with Plex service, when a server owner sets it up (see Single sign-on).

The demo server

The developer also runs a public Audiobookshelf server at demo.prosodyaudio.app, with public-domain recordings, so anyone can try Prosody and app store reviewers can test it. If you sign in to it, it receives what Prosody sends any Audiobookshelf server, as listed above, and the developer, who administers it, can see what it stores. Its public login is shared: everyone using it sees the same progress and bookmarks, and the same listening-session history, with the device details and IP address of each session. Use your own server for anything you want to keep private.

Single sign-on

If your server owner uses the hosted Sign in with Plex service run for Prosody, that service keeps, in a Google Cloud Firestore database operated by the app developer: the owner's Plex account id, username and email, the Plex servers they chose, their Audiobookshelf address and a hash of the secret Audiobookshelf uses; while the owner is signed in to the dashboard (two hours at most), it also holds the list of Plex servers their account can see. For people signing in, it holds only the sign-in in progress (minutes) and the access token Audiobookshelf reads once (one hour), which carry the Plex account id, username, display name, email and profile picture link it passes to Audiobookshelf; expired records are deleted automatically, normally within a day. Your Plex password never passes through it and your Plex token is not stored. Owners can delete their server's sign-in from the owner dashboard at any time, which deletes that server's record.

Setting up the hosted service needs Prosody Plus. When a server owner taps Open setup or Re-link in Prosody, Prosody sends the store's proof of the owner's subscription to the service at sso.prosodyaudio.app: a Google Play purchase token, or the App Store's signed transaction, which also carries the purchase's dates, price, currency and App Store country. The service verifies it (asking Google, or checking Apple's signature on it), and links it to a Plex account only when the owner, signed in on the dashboard, confirms. It then keeps, with the owner's Plex account id, the purchase token (Android) or original transaction id (iOS), the subscription's state, when its paid period ends and when it was last checked, and a one-way hash of the token so that one subscription can be linked to only one Plex account. It asks Google or Apple about the subscription again once its last answer is an hour old: at the next sign-in to one of the owner's servers, or when the owner next sets up a server or links a subscription. A proof the owner does not confirm stops working after 15 minutes and is deleted.

This subscription record is kept until the owner deletes their last server on the owner dashboard, which deletes it. To have it deleted sooner, or if you linked a subscription without setting up a server, email the address at the end of this policy.

The service's operational logs, kept for up to 30 days, record each request it receives (the web address asked for, the time, the IP address, and the browser or app it came from, whose description can name the device model and system version) and what it did, which can include the Plex account id and username of the server owner or the person signing in, and the server they sign in to.

If your server offers single sign-on, Prosody opens your browser at your server's identity provider (for example a Plex login) and receives only the resulting Audiobookshelf sign-in token. The password you type there never passes through Prosody.

Purchases

Prosody Plus is an optional auto-renewing subscription, monthly or yearly, bought through Google Play Billing in the Android app or the App Store on iPhone and iPad. Google or Apple processes the payment and every renewal under its own privacy policy; Prosody receives only a purchase token or signed transaction that says the subscription is active and stores a yes/no flag on the device (on Android, after Open setup, also a one-way hash of the purchase token it sent, so it can tell when a new purchase needs linking). If you are a server owner and use Open setup, that proof is also sent to the hosted sign-in service, as described under Single sign-on. Cancelling is done in Google Play or your Apple ID subscription settings and takes effect at the end of the paid period. No card or billing details reach the app or the developer.

What Prosody does not do

• It does not collect data for the developer, apart from what the hosted Sign in with Plex service handles, described under Single sign-on, and what you send the demo server if you sign in to it, described under The demo server. Your library and listening sync only with the server you sign in to.
• It does not use advertising identifiers, analytics SDKs or crash reporters.
• It does not access your contacts, location, camera, microphone, photos or files outside its own storage.

Permissions

On Android, Prosody asks for:

• Internet / network state: to reach your server and to know when you are offline or on Wi-Fi.
• Notifications: the playback and download notifications.
• Foreground service (media playback, data sync) and preventing the phone from sleeping: to keep playing with the screen off and to finish downloads.
• Run at startup: the home-screen widget's update scheduler uses it to pick up again after the phone restarts.
• Google Play billing: to buy Prosody Plus and check whether it is active.
• Bluetooth connect (optional, Android 12+): only if you turn on "Open Car Mode when a car connects", to tell a car's Bluetooth from headphones.
• Nearby devices (local network access, Android 17+): only when your server is on your home or local network, to reach it there.

On iPhone and iPad, it asks for Siri, so you can play books by voice, and iOS asks for Local Network access the first time Prosody connects to a server on your home network. You can change either in the Settings app.

Your data and your choices

Your account, listening history and bookmarks are held by the Audiobookshelf server you sign in to, which its administrator runs (you, on your own server; the developer, on the demo server). Deleting them is done there. Signing out of Prosody deletes that account's downloads, library copy, progress and bookmarks from the device (see What Prosody stores on your device). A server owner can have what the hosted Sign in with Plex service keeps about them deleted as described under Single sign-on.

Children

Prosody is not directed at children under 13 and does not knowingly collect information from them.

Changes and contact

If this policy changes, the new version will be published at the same address with a new date. Questions: robbie@3gtdata.com