Privacy

Short version: Bòcan doesn't spy on you.

This covers both Bòcan for Mac and its companion app, Bòcan Music for Android. Longer version follows.

Bòcan for Mac

What Bòcan sends

Nothing. No usage statistics. No anonymous metrics. No crash reports unless you explicitly approve a specific report. No "phone home" to check that your licence is valid, because there is no licence.

The only network traffic the app makes by default is:

• Checking for updates (daily, can be disabled) by fetching a single XML feed from https://bocan.app/appcast.xml. Your IP shows up in our web server's logs along with everyone else's.

What Bòcan sends only if you turn it on

• Scrobbling to Last.fm, ListenBrainz, or Rocksky. Off by default. Per-account, with credentials you supply, sent only to the service you authorised.
• AcoustID lookups to AcoustID, when you ask it to identify a track. Sends an audio fingerprint (not the audio) plus the track's existing tags.
• Lyrics fetches to Last.fm when you toggle the lyrics pane and the file has none. Sends artist + title.
• MusicBrainz cover art. Sends an MBID, gets back an image.
• Crash reports via MetricKit. Off by default. Each report is shown to you in full before sending; you decide. We never auto-submit.

What we collect on this website

Standard web server logs (IP, user-agent, request path, timestamp), kept for 30 days, used only to spot abuse. No cookies. No analytics. No tracking pixels. No "we use cookies to enhance your experience" banner because we don't and we don't.

What's stored on your machine

• Your library database, in ~/Library/Application Support/Bocan/.
• Logs, in ~/Library/Logs/Bocan/.
• Preferences, in ~/Library/Preferences/io.cloudcauldron.bocan.plist.

Delete those folders to delete everything Bòcan knows about you.

Bòcan Music for Android

The Android app is a companion player. It pairs with a Mac running Bòcan and syncs your music one way, from the Mac to the phone, over your own Wi-Fi. There is no Bòcan account, no cloud service, and no server of ours anywhere in the picture.

What the Android app collects

Nothing. No analytics, no telemetry, no crash-reporting SDK, no advertising ID, no device fingerprinting. We hold no data about you because we never receive any.

What leaves your phone

Only two kinds of traffic, and both stay under your control:

• Sync with your Mac. The app talks only to the Mac you paired it with, on your local network, over pinned mutual TLS (each device verifies the other's certificate). Music, artwork, playlists, and metadata flow one way, from the Mac to the phone. None of it is uploaded to us or to any cloud.
• Scrobbling, only if you turn it on. Off by default. When you enable Last.fm, ListenBrainz, or Rocksky, the app sends that play (track, artist, album, timestamp) directly to the service you chose, using credentials you entered. We never receive or relay it. Podcasts never scrobble.

What's stored on your phone

• Synced music and artwork, in the app's own private external-storage folder. The app is a player, not an editor: it never modifies your files, tags, or playlists.
• Scrobble-service credentials, encrypted with the Android Keystore, never in plain preferences or the database, and redacted from all logs.

Unpairing, or the "remove media" action, wipes all of this from the device. Uninstalling the app removes everything it stored.

Permissions, and why

The list is deliberately minimal: no storage permissions, no location, no advertising ID. Network permissions connect to your paired Mac and detect connectivity; notification and foreground-service permissions run playback and show sync progress; a wake lock keeps the CPU awake only during active playback or an in-progress sync. Nothing here reads your files outside the app's own folder or identifies you.

Source & verifiability

The source code is public. If you don't believe us, run a packet sniffer. Charles or Little Snitch will both confirm the above.

Contact

Questions? Open an issue on GitHub.