// privacy policy

Extraordinary CD Player — the iPhone app "CD Player" and the companion "CD Server" for Mac. Last updated 2026-10-03.

Where your discs go

You choose, per disc and per transport. All three carry the same audio and none of them involves us.

• Your local network. The Mac serves the disc straight to your iPhone over Wi-Fi. Nothing leaves the building.
• Your private iCloud. The Mac writes the audio and the disc's details into your CloudKit private database. Apple stores it under Apple's privacy policy. RobotArmy cannot access it.
• Your Google Drive. If you link a Google account, the Mac writes the same audio into that account's hidden application data folder, which only this app can see. We never receive your Google credentials: the sign-in happens with Google, and the Mac keeps the resulting token in your keychain. Unlinking removes it.

What stays on your devices

• On-device cache. The iPhone caches downloaded audio so it can play without a connection. The cache is encrypted on the device, and it is removed when the disc is ejected or its offline window runs out.
• Playback progress — which track you are on, what you have finished — is stored on your device and goes nowhere else.
• Diagnostic logs. The iPhone hands its own log to your Mac, so a problem that happened on the phone can be read on a keyboard. Those logs are kept on that Mac for about two days and are deleted after that. They do not leave it on their own. See The two times we hear from the app below.

Family sharing

If you choose to share your library, Apple's CloudKit sharing creates a private link granting read-only access to the people you send it to. Shared audio streams from your iCloud storage. RobotArmy is not involved in that sharing and cannot see it.

Every network destination, in full

This is the complete list. There are no others.

• Apple iCloud / CloudKit — moving your discs between your own devices.
• Google Drive — the same, and only if you have linked a Google account.
• Apple's public iTunes Search API — cover art. The Mac sends an artist and album name to find a picture. It sends nothing about you.
• MusicBrainz — disc names. Some CDs carry no names at all and macOS mounts them as "Audio CD" with numbered tracks. The Mac looks the disc up by an identifier calculated from the lengths of its tracks. That identifier describes the pressing, not you, and no account or device information goes with it. MusicBrainz is a volunteer-run public music database; see their privacy policy. The Mac also asks the Music app on your own Mac first, which involves no network at all.
• robotarmy.com — only in the two cases below.

The two times we hear from the app

Both are listed here because a privacy policy that omits the small automatic thing is not worth reading.

• A daily hello from the Mac app, and it is the one automatic thing. Once every 24 hours the Mac server requests a single URL so we can count how many servers are running. It carries the app version, the macOS version and the processor type, and no identifier of any kind — not a serial number, not an account, not a random id of our own. That is deliberate: it buys a count, not a population, and a count is the whole question. The exact text it sends is shown in the Mac app's Settings, and a switch there turns it off. Our web server sees the request's IP address, as every web server does; we neither ask for nor keep anything more.
• Feedback, when you press Send. Tap Send feedback in the iPhone app, write or dictate what happened, and your words go to us with the app version and the iOS version. Nothing else goes with them.
  There is a separate switch on that screen for technical details. It is off. Turn it on and a log of what was slow or failed goes too, stripped of anything about your accounts and anything about your discs — no album names, no track names, no email addresses, no machine names. You can read the exact text that will be sent, scrubbed, before you send it.
• Diagnostics from the Mac, when its owner sends them. The Mac holds its phones' logs, so this is the bigger one and it takes more to send. Send Bug Reports has to be on in the CD Server menu, which it is not by default. Then somebody has to choose Send Diagnostics Now. Then a dialog says what is about to happen and offers to show the exact text first. The same scrubbing applies.
• Nothing is sent in the background, ever. Both routes above run from a button. There is no timer, no retry queue, and no send you did not start.

What we never do

• No accounts, sign-ups, or passwords collected by us.
• No analytics, advertising identifiers, or third-party tracking SDKs.
• No access to your location, contacts, photos, or health data.
• No profile of you, your listening, or your collection — anywhere, ever.
• Nothing sold or shared with anyone.

Children

This app is not directed at children and collects no personal information from anyone, of any age.

Changes

If this policy changes, the date above changes and the new version is posted at this address.

Contact