Vesqen Privacy Policy

• Effective date: September 26, 2026
• Last updated: November 1, 2026

This policy explains what information the Vesqen Android app handles, where that information stays, what the app sends over the network, and what we receive when you contact us or join a test. It applies to every build of Vesqen we distribute, including Google Play and GitHub Releases, and to the Vesqen website.

Summary

• Vesqen plays music stored on your device. It has no account, advertising or tracking, and it contains no third-party analytics or crash-reporting software.
• Playback and your library never use the network. Your library, favorites, playlists and play history stay in the app's private storage on your device, and we never receive them.
• From version 1.0.0-beta.2, Vesqen uses the network for a usage statistics message at most once a day and for device reports that you choose to upload. The GitHub version also checks for updates. Each is described below, and you can turn each of them off.
• Usage statistics carry no install or device ID, and never include your location, your music or what you listen to. In the EU, the European Economic Area, the UK, mainland China and South Korea, Vesqen asks before sending them. Elsewhere they are on by default, and the first screen lets you turn them off.
• We also receive what you choose to send us, such as a support email, or your email address if you join a test.
• The Vesqen website has no advertising or tracking cookies. It counts visits with Cloudflare Web Analytics, which uses no cookies, and uses a cookie to remember your language only if you allow it.

Network requests at a glance

The table lists every network request Vesqen makes. The version from Google Play makes all of them except the update check and update download, because Google Play updates it. Playback and your library never use the network. Every request shows your IP address to the server that receives it, because that is how network connections work. Our services do not store IP addresses, but Cloudflare, which runs them, keeps a sample of request records that we can see for up to 31 days, as described under "Cloudflare request records" below.

When usage statistics are on, the latest version information may arrive with the statistics reply, and then the GitHub version does not make a separate update check. The version from Google Play does not use this information.

Who we are

Vesqen is developed and published by Sumire Studio. Sumire Studio is the publishing name of an independent developer, who is responsible for the processing described in this policy. You can contact us about privacy at vesqen@sumirenokai.com.

Information the app handles on your device

Vesqen processes the following information on your device. None of it is sent to us or to anyone else, unless you put it in a device report yourself.

• Your music library. From the audio files and folders you allow Vesqen to access, it reads the file name, folder name, size, modification time, tags (such as title, artist, album, album artist, genre, year, and track and disc numbers), embedded artwork, and audio format details (such as codec, sample rate, bit depth, channel count and bitrate).
• Your activity in the app. Favorites and their order, playlists (names, contents, order, and when they were created or changed), how many times each track has been played and when it was last played, your current queue and playback position, and your settings.
• Your playback chain. To show the Chain view and to operate strict USB output, Vesqen reads audio route information that Android provides: the current output device's name and type (including connected Bluetooth audio devices), and for USB audio devices, the vendor ID, product ID, name, USB descriptor version and supported audio formats. Vesqen does not request direct access to USB devices. On Android 13 and later, if you allow Nearby devices, Vesqen also receives the Bluetooth codec that Android reports for the connected headphones or speaker, such as LDAC at 96 kHz, and shows it in Chain. It stays on your phone and is cleared when the device disconnects.
• Output verification records. If you import a verification record file, Vesqen stores it in its private storage. To decide whether to show BIT-PERFECT VERIFIED, it compares the record with your current setup: the installed app's version and package hash, your phone's manufacturer, model and Android version, a hash of the system build fingerprint computed on the device, the connected USB audio device, and the audio format being played.
• Recent errors. Vesqen keeps a short record of recent playback errors, strict USB stops and the reasons Android gave for closing the app: at most 100 events from the last 7 days. For a track that failed to play, it keeps the track's format and file name. The record exists so you can choose to include it in a device report.
• Crash details. If Vesqen crashes because of an error it did not handle, it saves the error type and the code locations that led to it (class, method and line number), including the errors that caused it, with the app version and the time. It never saves the error's message text, which can contain a file path or a song title. It keeps the last 3 crashes for at most 7 days. It deletes them after you upload them in a report or select Do not send. After you share or email a report, it keeps them until they expire, because Vesqen cannot tell whether you sent it.
• Your region. To decide whether to ask before sending usage statistics, Vesqen reads the region of your phone's language settings, the country codes of your SIM card and mobile network, and the country of your time zone setting. The time zone can only make Vesqen ask first; it never turns statistics on. This needs no permission. The result is used on the device and is not stored or sent.

Vesqen never modifies or deletes your music files.

Permissions

Only reading your music is essential. If you refuse notifications, folder access or Nearby devices, Vesqen still plays the music it can read. Vesqen does not request location, contacts, phone, camera or microphone permissions.

When information leaves the app

• Android media controls. While music plays, Vesqen gives Android the current track's title, artist, album, artwork and playback position for the notification and lock-screen controls. Android may pass this to devices and services you connect or authorize, such as Bluetooth car audio, watches or voice assistants. Only Android's system components, and apps you have allowed to read notifications or control media (such as a smartwatch app), can connect to Vesqen's playback session. Other apps on your phone cannot.
• Moving to a new phone. Vesqen does not move its data to a new phone. Your library, favorites, playlists, play counts and last-played times, queue, settings and output verification records stay only on your old phone. On the new phone, you need to allow Vesqen to read your audio files again, or add your music folders again. Vesqen turns off Android cloud backup, so this data is not backed up to Google Drive, and it asks Android not to copy this data during device-to-device transfer. Some phone makers' transfer tools may not follow this request and may still copy the app's data to the new phone.
• Supporting development. The GitHub version has a Support development link in About, and now and then it asks whether you would like to support Vesqen. Both only open our Buy Me a Coffee page in your browser; Vesqen itself sends nothing. To decide when to ask, the app keeps on your device how many times it has asked, when it last asked and whether you chose not to be asked again. The version from Google Play has neither.
• Network features. The app uses the network only for usage statistics, device report uploads and, in the GitHub version, update checks, including the status file and downloads that belong to them. The next three sections describe them.

Usage statistics

• What is sent. At most once a day, when you open Vesqen, it sends one message with: the app version and the distribution channel; the Android version, phone manufacturer, model and system build name; whether a connected USB audio device offers Android's bit-perfect mode, when Android can tell; whether a USB audio device was connected in the last 7 days; and whether this is the first message today, this week and this month.
• What is never sent. No install or device ID, no account, no location or country, and nothing about your music, file names or what you listen to.
• Information stored on your device. Vesqen remembers when it last sent statistics and when it last saw a USB audio device. It needs these times to send at most once a day and to fill in the fields above.
• Destination. The message goes to our statistics service, which runs on Cloudflare. The service adds the message to daily totals and does not keep the message itself. It does not store IP addresses. Cloudflare handles your IP address to deliver the request and to protect the service, as our service provider, and keeps the request records described under "Cloudflare request records". The reply can include the latest version information, which the GitHub version uses for update checks.
• Your choice. In the EU, the European Economic Area, the UK, mainland China and South Korea, and whenever Vesqen cannot read a country, it asks first, with neither answer selected, and sends nothing unless you agree. Elsewhere statistics are on by default: the first screen explains them and has the switch, and nothing is sent before you leave that screen. You can turn statistics off at any time in Settings → Privacy & data → Usage statistics, and Vesqen stops sending at once. Statistics already sent are part of daily totals that are not linked to you, so they cannot be removed one by one.
• Service availability checks. Right before it sends statistics or uploads a report, Vesqen reads a small status file on our website to check whether we have paused the service, at most once every 10 minutes. With statistics off, it reads the file only when you upload a report. The request carries nothing about you beyond what every web request carries, such as your IP address.

Device reports

• Creating a report. In Settings → Privacy & data → Export device report, you can create a report to help us with a problem. The report always includes the app version and build, your phone's manufacturer, model, Android version and system build name, and when it was made. You choose whether to add: your audio output's capabilities (including USB audio devices' vendor and product IDs and supported formats); the values on the Chain page (such as formats, decoder, buffering, battery and processor readings, and the Bluetooth codec Android reported); the recent errors described above; the crash details described above; the formats of tracks that failed; and, separately, their file names. Bluetooth device names, output route names, decoder names and the processor model are removed. You see the complete report before it leaves the app.
• After a crash. If Vesqen crashed or stopped responding, the next time you open it, it asks once whether to send a report. Review and send opens Export device report with the crash details and recent errors selected. There you see the complete report and then choose to upload, share or email it. Do not send deletes the saved crash details. Nothing is sent unless you choose to send it.
• Sending it. You can share the report with an app you choose, email it to us, or upload it. Sharing and email go through the app you pick. Vesqen keeps the latest report files in its cache for sharing, and removes files older than a day the next time you share.
• Uploading it. An upload sends the report to our service on Cloudflare. The service stores the report with a random receipt number and the time it arrived, and does not store IP addresses. The report is not linked to you unless you send us its receipt number. We keep uploaded reports for 7 days and then delete them. To delete a report sooner, email us its receipt number.

Update checks

• Checking. The GitHub version of Vesqen can check for new versions. It checks automatically at most once a day when you open the app, and whenever you select Check for updates. A check reads a version file from our website, vesqen.sumirenokai.com, which Cloudflare hosts. When usage statistics are on, the version information can arrive with the statistics reply instead. A check carries no identifiers, only what every web request carries, such as your IP address. You can turn automatic checks off in Settings → Updates → Check automatically.
• Downloading. Vesqen downloads an update only when you select Download. The file comes from GitHub, and GitHub's privacy statement applies to that download. Before installing, Vesqen checks the file's SHA-256 and signing certificate, and Android asks you to confirm. If the file fails these checks, Vesqen deletes it. A file that passed them stays in Vesqen's private storage until the next time you open the app, so a cancelled installation can be retried without downloading it again.
• Other stores. The version from Google Play has no update check of its own, because Google Play updates it. If another app, such as an F-Droid client, manages the GitHub version's updates, automatic checks start turned off.

Information we receive

• Emails you send us. If you contact us, we receive your email address and whatever you include in your message, including any device report you attach. We use it only to reply to you. Mail to our sumirenokai.com addresses is forwarded by Cloudflare's email routing and stored in our Microsoft Outlook mailbox.
• Statistics and reports. From usage statistics we see only daily totals. From device reports we see the reports you upload, for the 7 days we keep them.
• Closed testing. If you join a test of Vesqen on Google Play, the email address of your Google account is added to the test's tester list in Google Play Console, so Google can give you access. We also see any feedback you send through Google Play. We use this only to run the test.
• Purchases. Vesqen has no in-app purchases yet. If a later version adds one, we will update this policy before that version is released.
• Support through Buy Me a Coffee. If you support Vesqen on Buy Me a Coffee, Buy Me a Coffee shows us your name or display name, email address, message, and the amount and date, as its privacy policy describes. Stripe processes the payment, and we never see your card number. By default your name and message also appear on our Buy Me a Coffee page; you can change this in your Buy Me a Coffee settings. Support unlocks nothing in the app. We use this information only to keep a record of support and to reply if you write to us.
• Google Play statistics. Google may give us aggregated statistics about installs and app stability, including crash reports from people who have chosen to share usage and diagnostics data with Google. We use them only to find and fix problems.
• GitHub downloads. If you download Vesqen from GitHub, in a browser or through the app's update check, GitHub's privacy statement applies to that download.

The Vesqen website

The Vesqen website (vesqen.sumirenokai.com) is hosted by Cloudflare. It has no accounts, forms or advertising. It also serves the version files and the status file that the app reads.

• Serving the site. To deliver pages and files and protect the site from abuse, Cloudflare processes each request, including your IP address, browser information and the address of the page. Cloudflare does this on our behalf, and it may also use this network data to protect its own services, as its privacy policy describes. Cloudflare shows us statistics, such as the number of requests by country or region, and the sampled request records described under "Cloudflare request records". We do not use this information to identify visitors.
• Choosing a language. When you open the home page, the site shows English, Simplified Chinese, Traditional Chinese or Japanese based on your browser's language setting. If that does not decide it, the site uses the country or region Cloudflare estimates from your IP address. This check runs on each visit and stores nothing.
• Visit statistics. The site counts visits with Cloudflare Web Analytics. A small Cloudflare script on each page reports the address of the page, the page you came from and how quickly the page loaded, and Cloudflare adds the country or region and the type of browser and device. The script uses no cookies and stores nothing in your browser. We only see aggregated statistics, which Cloudflare shows us for up to six months. Visits through Cloudflare's data centers in the EU, the European Economic Area and the UK are not counted.
• Cookies. On your first visit, the site asks whether it may remember your language. It sets at most two cookies, and neither is used for tracking:

You can change your answer at any time with "Cookie settings" at the bottom of each page. If you reject, the site deletes vesqen-lang. If Cloudflare needs to check that a visit is not automated, it may set its own security cookies, such as __cf_bm or cf_clearance. Cloudflare needs these cookies to run the service, and they are not used to track you. Neither the app nor the website tracks you across other sites or apps, so a browser's Do Not Track setting changes nothing here.

Service providers and international transfers

Cloudflare acts as our service provider for the website, the statistics and report service and email forwarding. It is certified under the EU-U.S. Data Privacy Framework, its UK Extension and the Swiss-U.S. Data Privacy Framework, and its data processing terms include the EU Standard Contractual Clauses. Information in this policy may be processed outside your country, including in the United States. It reaches these providers over encrypted connections when you use a feature that needs them, and each provider's privacy policy explains how to contact it. If you do not wish to use these services, turn statistics and automatic checks off and do not upload reports. Playback and your library keep working.

Cloudflare request records. Cloudflare processes every request to the website and to our statistics and report service. Its dashboard shows us a sample of these requests for up to 31 days. Each sampled record has the time, the IP address, the domain and path requested, the browser or app type, and the country or region Cloudflare estimates; the dashboard also shows statistics made from these records. Cloudflare uses this data to protect the services as well: when one IP address sends more than 5 statistics or report requests within 10 seconds, it is blocked from them for 10 seconds. We access these records only to keep the services working and to stop abuse. We do not match them with statistics, reports or emails, and we do not use them to identify you.

Retention and deletion

• On your device. Removing a music folder deletes its library records. You can also delete playlists and remove favorites in the app. To delete all app data, open Android Settings → Apps → Vesqen → Storage and clear storage, or uninstall Vesqen.
• Information held by our service. Expired statistics and reports are deleted within about an hour of the time shown above. Cloudflare's database keeps its own point-in-time backups for up to 30 days, after which deleted records are gone from those backups too.
• Deletion on request. We delete emails, tester entries and uploaded reports sooner if you ask.

Security

• Data on your device is kept in Vesqen's private storage, protected by Android's app sandbox. The app sends only the network messages described in this policy.
• All network requests use HTTPS. Vesqen installs an update only after checking its SHA-256 and that it is signed with the same key as the installed app.
• Vesqen's access to your music folders is read-only.
• Our statistics and report service writes no IP addresses or request logs to its database. Cloudflare's own request records are described under "Cloudflare request records".
• Our support mailbox is protected with two-step verification.

Children

Vesqen is not directed at children, and we do not knowingly collect personal information from children. If you believe a child has sent us personal information, contact us and we will delete it.

Your choices and rights

• In the app. You control everything Vesqen stores on your device, as described above. You can turn usage statistics off in Settings → Privacy & data → Usage statistics, and, in the GitHub version, automatic update checks off in Settings → Updates. Uploading a report is always your choice.
• Your rights. You can ask us to confirm whether we hold information about you, to access, copy, correct or delete it, to explain how we use it and who we share it with, to restrict or object to that use, or to withdraw consent. Email vesqen@sumirenokai.com. We respond within 15 working days.
• Complaints. You can complain to us at the same address. We acknowledge a complaint within 30 days and inform you of the action taken. You can also complain to the data protection authority where you live, such as the Information Commissioner's Office in the UK or the ANPD in Brazil.
• Legal bases. Where EU or UK data protection law applies, we rely on your consent for usage statistics, the language cookie and the reports you upload. In mainland China and South Korea, usage statistics also rely on your consent. Where Brazilian law applies to statistics, we rely on our legitimate interest in learning which phones and Android versions Vesqen runs on, and you can object at any time by turning statistics off. For update checks, answering you, running tests, and keeping the website and our service available and secure, we rely on our legitimate interests in those things.

Changes to this policy

When this policy changes, we will update this page and its "Last updated" date. Significant changes will also be mentioned in the release notes. Earlier versions remain in the history of the Vesqen repository on GitHub.

Contact

Sumire Studio — vesqen@sumirenokai.com