lofi

Native Android player · privacy

Quiet about your data.

This notice explains the native Lofi Android music player, its public station catalog, and the network services it uses. It does not describe the separate Lofi web experience.

Lofi · Cozy Music Radio Package name: ai.lofi.android Effective October 19, 2026

At a glance

The native app has no sign-in, native analytics SDK, advertising, advertising identifier access, or in-app purchases. It plays a public catalog and remote audio, and keeps a local copy of the last successfully downloaded catalog to support an offline fallback.

What the app sends

When the app refreshes stations, it makes a public GET request to https://lofi.ai/api/feed. When it loads artwork or audio, it requests the remote media URL supplied by that catalog. These requests necessarily include ordinary network metadata, such as an IP address and user-agent, as they pass through Cloudflare-hosted services. Cloudflare hosts the public feed service and serves the audio and artwork through its media/CDN path. The app does not add a name, email address, account ID, advertising ID, or device identifier to those requests.

When you choose a station, the app makes a bodyless POST to that station’s /play endpoint. This increments an aggregate play counter for the station. The request is not a login or a user profile, and the Android app does not submit an identity with it.

How the public service protects the counter

The station-play endpoint uses a fixed one-hour rate-limit window for each IP and station combination. To avoid placing a raw IP address in the rate-limit table, the service stores a deterministic SHA-256-derived hash of the IP and station key in Cloudflare D1. The counter resets when its window rolls. The stored rate-limit rows are not immediately purged when a window rolls, so this page does not promise immediate deletion of those rows.

Aggregate means aggregate. The station play count is a station metric. It is not presented as a personal listening history in the Android app.

Optional server-side diagnostics

If the service’s optional PostHog configuration is enabled, the backend may send server-side error reports and station-level events to PostHog. Station events use the station ID as their event identity and include the station ID as an event property; they do not use a user ID. The native Android binary does not load the PostHog SDK or send browser analytics.

What stays on your device

After a successful catalog request, the app stores the catalog in its private Android app cache directory as lofi-stations.json. This lets the player show the last downloaded stations when a later refresh is unavailable. It is local app cache data, not an account, and Android may clear it when it needs space. Artwork and audio are fetched from their remote URLs for playback; the app does not upload your personal files.

What the native app does not provide

  • No native login or account profile.
  • No native advertising or cross-app tracking.
  • No advertising identifier access, native analytics SDK, or in-app purchase flow.
  • No form in the player for your name, email, contacts, location, photos, or microphone.

Questions and support

For privacy questions or playback support, contact jeremy@coralsourcing.com. Please include only the app version, device, Android version, station, and relevant error text; do not send passwords or financial information.