Your music, your network, your data.

01 Who we are

Serento is published by Dusty Enterprise SRL, registered in Bucharest, Romania. For the purposes of EU data protection law (GDPR), Dusty Enterprise SRL is the data controller for any information Serento processes about you. You can reach us at contact@serento.app for any privacy question or request - see Section 11 for your statutory rights.

02 What Serento is - and what it isn't

Serento is a UPnP / OpenHome control application. It runs on your iPhone, iPad or Mac, finds your music servers and renderers on your local network, asks them for the catalogue, and tells the renderer what to play. The audio bytes flow directly from your server (or the radio station you tuned to) to the renderer - they never pass through Serento or any infrastructure we operate.

• No accounts. There is no sign-up screen, no email address, no password, no "login with Apple / Google". Our entitlement service keeps exactly one row per Apple ID: a one-way key, when the trial started, when we last heard from that key, plus internal bookkeeping fields. That row carries no name, no email address, no purchase record and nothing about what you play. It is an anti-abuse anchor, not a user account.
• No centralised catalogue. We don't have a copy of your library. We don't index your music. We don't recommend tracks. Browse and Search read from your own UPnP servers in real time.
• No third-party tracking SDKs. We don't ship analytics SDKs (no Firebase, no Google Analytics, no Mixpanel, no Amplitude, no PostHog). We don't ship attribution SDKs (no AppsFlyer, no Branch, no Adjust). We don't ship ad SDKs or social-network SDKs. We do, however, collect our own first-party telemetry, stored under the key described in Section 02a below.
• No tracking of you. Our telemetry backend never logs your IP address, your library contents (no track / album / artist names, no file paths), your play history, or your search queries. It receives counts and percentages only, stored under your account key. We do not track you across other companies' apps or websites, and we never sell or share this data.

02a Pseudonymous telemetry (what we DO collect)

To understand which devices and OS versions are in use, which renderers people pair with, and - above all - how complete people's music metadata is across the field (so we can decide whether to build better metadata tools), the app sends us a small report. It contains no name, email or Apple ID, and the key is one-way, so it does not reveal who you are or the contents of your library. It is a condition of using Serento, disclosed here and in the Terms; there is no per-user opt-out. Specifically:

• Your account key. A one-way hash of your iCloud account identifier, computed on your device. It is not your Apple ID, not your name, not your email, and we cannot reverse it. It is the same key your free trial and subscription are stored under, so we can see that one person's reports belong together. It is stable: reinstalling does not change it, and it is the same on every device you are signed in to.
• A device identifier. A random identifier this app generated for itself and keeps in the keychain, so your iPad's reports can be told apart from your Mac's. It is not a hardware id and not an Apple identifier.
• Coarse device facts + app usage. Platform (iPhone / iPad / Mac), device model identifier, OS name + version, app version + build, total / available memory, your 2-letter region (from your device locale - never from your IP, which we never store), and how long the app was used (session durations, in seconds).
• The renderer you are playing to. Only the player you are currently connected to, and exactly six things about it: a one-way hash of its UDN, so we can recognise the same unit across reports without ever holding the UDN itself; its name; its model; and whether it supports DLNA, OpenHome and software volume control. The name is the one the device announces about itself, so if you have renamed it, the name you chose is what we receive. When you play to your own device instead of a network player, that is reported the same way, as "This iPhone", "This iPad" or "This Mac" together with your device model.
• Library composition - counts only. How many tracks / albums / artists your servers hold, how many files are DSD vs PCM, the breakdown by format (FLAC, ALAC, DSD, MP3, …) and resolution, and - the part we care about most - what percentage of your tracks have each tag field (title, artist, album, genre, year, …) filled in. Counts and percentages, never the names or contents of your music.

We cannot reconstruct your library from this, and the key is one-way, so it does not tell us who you are: no name, no email, no Apple ID. We never sell it. We delete raw reports after 13 months.

03 What stays on your device

The following is created and stored locally on your iPhone, iPad or Mac. None of it leaves the device unless explicitly noted in Section 02a (telemetry), Section 04 (iCloud sync) or Section 06 (diagnostic logs you choose to send):

• Library cache. When you connect a UPnP server (MinimServer, Plex, Twonky, Asset, JRiver, etc.) we fetch album / artist / track names, durations, codecs, sample rates, file paths, and artwork. Those are written to a SwiftData store that lives in the app's sandbox. They are read only by Serento on the device, only when the app is running.
• App preferences. Theme, default queue method, gapless playback flag, silent-network delay, alphabetical-index-bar toggle, volume-control toggle, album-version-grouping configuration, last-selected renderer / server / library / tab. Stored in UserDefaults.
• Discovery cache. The UPnP servers and renderers Serento has seen on your local network - IP addresses, friendly names, UDNs, supported services. Used to surface them in the picker without re-running a full SSDP sweep on every launch. Cleared if you delete the app.
• Recent searches. The last few queries you typed in the Search tab. Used to populate the "Recent" section. Cleared via the Clear button in Search.
• Plex authentication tokens. If you sign in with a Plex account, the Plex API returns an access token. Serento stores it in the Keychain (protected by your device passcode / Face ID / Touch ID). Tokens are read only by Serento; they are never sent to Dusty Enterprise SRL.
• Diagnostic log file. A rolling log of UPnP discovery, playback transitions, renderer responses, and error conditions. Stored in the app's sandbox. Never transmitted unless YOU tap "Send Logs to Developer" in Settings (see Section 06).
• Keychain values that survive deleting the app. A small number of values live in the Keychain and are deliberately not removed when you delete Serento: the device identifier described in Section 02a, which keeps each device's settings separate and is also the identifier sent with the telemetry so your devices can be told apart, and a timestamp used to bound offline access so that reinstalling the app cannot restart the free trial.

04 What syncs across your own devices via Apple iCloud

Serento uses Apple's CloudKit to keep a small set of personal-curation data in sync across the Apple devices signed into the same Apple ID. The data lives in YOUR private iCloud container - Apple's documentation guarantees that even Apple staff cannot read it; Dusty Enterprise SRL has no server-side access to it either (we write and read it only from the device, never from a backend). What syncs:

• Favorites. Tracks, albums, artists, and radio stations you've favourited.
• Playlists. Names and track lists for the playlists you create in Serento.
• Tags & bookmarks. Tags you create and the items you've tagged; bookmarks you save.
• Listen Later list. Items you add to Listen Later.
• Custom radio stations. Stations you add (name + stream URL + codec hint).
• Album & track ratings. The 1–5 stars you assign.
• Per-device app settings. Each device keeps its own settings row, so an iPhone and a Mac can be configured differently. Stored in your private container under the device identifier described in Section 02a.

05 Network traffic Serento generates

Every connection Serento makes from your device. Nothing else.

• Your local network - UPnP discovery. SSDP multicast probes (UDP 1900) to find UPnP servers and renderers. Plex's GDM (UDP unicast) to find Plex Media Servers. Bonjour mDNS for Plex on networks that publish it. All confined to your LAN.
• Your local network - control. HTTP / SOAP requests to your UPnP servers (ContentDirectory) and renderers (AVTransport, OpenHome Playlist / Product / Volume / Info, RenderingControl). Used to browse the library and drive playback.
• Your local network - audio stream. When you press Play, Serento tells the renderer the stream URL of the chosen track. The renderer fetches the audio from your server directly. Bytes do not pass through Serento or any infrastructure we operate.
• Apple iCloud / CloudKit. Sync traffic for the data listed in Section 04. Goes to Apple's servers under your Apple ID - Apple's privacy policy governs this leg of the trip.
• Apple App Store / StoreKit. For purchases, restore-purchases, and the signed receipt Apple issues. Purchases are verified on the device against Apple's signature and are never sent to us. Handled by Apple's StoreKit framework; Apple's privacy policy applies. Each purchase also carries an app account token: a UUID derived from the same one-way account key, so that when Apple tells us months later that a subscription renewed or a refund was granted, we can match that notice to the right account. Apple receives and stores that value. It is still one-way and it is still not your Apple ID.
• Serento entitlement service. When the app starts, it asks our own server whether your free trial is still running. It sends an account key and your app version, and nothing else. The account key is a one-way hash of your iCloud account identifier - the same value the telemetry already uses - and it cannot be turned back into an Apple ID. The server keeps the date your trial started, and the date it last heard from your key, so that reinstalling the app cannot restart the trial. It is never told what you have bought, and we never receive your name, your email address, your Apple ID or any payment detail.
• plex.tv (Plex users only). If you sign in with Plex, Serento talks to plex.tv to authenticate and look up your accessible Plex servers. Plex Inc.'s privacy policy applies to that leg. If you don't use Plex, no plex.tv traffic happens.
• Internet radio streams. When you play a station, your device fetches the audio directly from the broadcaster's URL. We have no visibility into what you play. The broadcaster sees your IP.
• serento.app. Three things. The telemetry described in Section 02a, which carries your account key and your device identifier. Metadata lookups: to fill in an album's year, credits, lyrics, classical works or an artist's biography, the app asks our own copy of the public music databases, sending only the artist, album, track or composer name it needs an answer for. Those lookups carry no account key, no device identifier and no account of any kind - unlike the trial check described above, which does carry your account key. The lookups that send a name travel in the request body rather than in the address, so they are not written into any server or proxy log along the way; the ones that send only a public release identifier use the address, because that identifier is not yours. We neither store them nor build any profile from them. And one hosted image, the Plex logo shown beside a Plex server in the picker. No IP address is stored on our side.
• Resend (only when you tap "Send Logs"). When you explicitly tap "Send Logs to Developer" in Settings, the diagnostic log file is delivered to contact@serento.app via Resend's transactional email API. See Section 06.
• Wikipedia. For artist and album biographies, the app queries the Wikipedia of your app language, falling back to the English one. It sends the artist or album name it is looking up. The Wikimedia Foundation sees your IP and applies its own privacy policy.
• Wikidata. Used to turn an identifier into the right Wikipedia article title before the request above. Sends only that identifier, never a name you typed. Also operated by the Wikimedia Foundation.
• Last.fm. For an artist's popular tracks. Sends the artist name. Last.fm (CBS Interactive) sees your IP and applies its own privacy policy.
• Deezer. For artist photos and genre images, when you run the image downloads in Settings. Sends the artist or album name being searched, and fetches the picture from Deezer's image CDN. Deezer sees your IP and applies its own privacy policy.
• Cover Art Archive. For an album cover when you use Identify Album. Sends the release identifier the identification resolved to, never a name. Operated by MetaBrainz alongside MusicBrainz.

06 Diagnostic logs (you choose when)

The diagnostic log helps us reproduce playback issues, discovery failures, and renderer quirks that we can't see otherwise. It is OPT-IN by action: nothing leaves your device unless you tap the "Send Logs to Developer" button in Settings.

• What the log contains. Timestamps + structured records of: UPnP discovery results (server / renderer names, IPs, UDNs, supported services), playback events (track started, paused, advanced, errored), SOAP responses from your renderer (HTTP status codes, SOAP fault codes), volume changes, library sync progress, app version + build, OS name + version, device model, memory tier, locale.
• What the log does NOT contain. We deliberately exclude: your Apple ID, your email address, your real name, your location, your contacts, your audio content, your Plex token (redacted), your passwords, anything from other apps.
• Where it goes. The log is wrapped in an email and sent via the Resend transactional email service to contact@serento.app. Resend (resend.com) processes the email on our behalf as a data processor under EU GDPR Art. 28.
• How long we keep it. Logs are retained in our inbox for the duration of the support case (typically days, occasionally weeks if we're working on a difficult renderer bug), then deleted. We don't archive them long-term.
• Rate-limit. There's a short cooldown between sends so the same device can't accidentally flood our inbox.

07 Crash reports

If Serento crashes, the crash stack is handled entirely by Apple's built-in system. We don't ship any third-party crash SDK. If you have enabled Share with App Developers - under Settings → Privacy & Security → Analytics & Improvements on iOS and iPadOS, or System Settings → Privacy & Security → Analytics & Improvements on macOS - we receive an anonymised stack trace via App Store Connect, with no personal data attached. If you've turned that off, we receive nothing.

08 Third-party services we depend on

These are the only third parties involved in delivering Serento. Each has its own privacy policy that you should read if you care about what they do with their share of the data flow:

• Apple Inc. App Store distribution, iCloud / CloudKit sync, StoreKit billing, crash reporting. apple.com/legal/privacy
• Plex Inc. Only relevant if you have Plex servers and sign in with a Plex account. plex.tv/about/privacy-legal/privacy-policy
• Resend. Email delivery service for the diagnostic logs you choose to send. resend.com/legal/privacy-policy
• Your UPnP server vendor. Whatever you run on your network (MinimServer, Plex, Asset UPnP, Twonky, JRiver Media Center, Kodi UPnP, etc.) is governed by its own license and privacy terms. Serento doesn't see what they do.
• Internet radio broadcasters. When you play a station, you connect to its servers directly. The broadcaster sees your IP and is governed by its own terms.
• Wikimedia Foundation. Wikipedia and Wikidata, for biographies. foundation.wikimedia.org/wiki/Policy:Privacy_policy
• Last.fm. Popular tracks for an artist. last.fm/legal/privacy
• Deezer. Artist photos and genre images, only when you run the image downloads. deezer.com/legal/personal-datas
• MetaBrainz Foundation. The Cover Art Archive, for album covers via Identify Album. metabrainz.org/privacy

09 What we DO NOT have

For symmetry with the list above - and because the absences matter as much as the presences:

• No user profiles. Our entitlement service keeps exactly one row per Apple ID: a one-way key, when the trial started, when we last heard from that key, plus internal bookkeeping fields. That row carries no name, no email address, no purchase record and nothing about what you play. It is an anti-abuse anchor, not a user account. We keep pseudonymous records keyed to the one-way account key and the device identifier described in Section 02a. They show us that one person uses three devices; they do not show us who that person is: no name, no email, no Apple ID, no contact details.
• No IP address logs. We run no backend that logs your IP address. Apple sees your traffic when it touches iCloud / the App Store, but that's Apple's relationship with you, not ours.
• No listening history. What you play, when you play it, and how often - none of that reaches us. The data exists only on your device and (for the curation items in Section 04) in your private iCloud container.
• No content access. We don't see album titles, artists, or any other metadata from your library. Your servers send that to your device directly.
• No location data. We don't ask for, request, or use your device location.
• No contacts, calendars, photos, or microphone. Serento doesn't request access to any of these. For the full permission list, check Settings → Serento on iOS and iPadOS, or System Settings → Privacy & Security on macOS.

10 Children

Serento is not directed at children under 13 years of age, and we do not knowingly process personal data from minors under 13. If you believe a child has somehow provided personal data to us, contact contact@serento.app and we will delete it.

11 Your rights under the GDPR

Because Dusty Enterprise SRL is established in the European Union, the EU General Data Protection Regulation (Regulation 2016/679) applies to any personal data we process about you. Your statutory rights include:

• Right of access (Art. 15). Ask us what personal data we hold about you and obtain a copy.
• Right to rectification (Art. 16). Ask us to correct inaccurate personal data.
• Right to erasure (Art. 17). Ask us to delete your personal data. There are three places it can be: a diagnostic log you previously sent, the entitlement row keyed to your account, and the telemetry reports carrying that same one-way key. Deleting the entitlement row also removes the record that your trial has already run. The telemetry reports are stored under the same one-way account key, so we can find and delete yours. They are deleted automatically after 13 months in any case; if you send us that key, we can remove the reports carrying it sooner.
• Right to restriction (Art. 18). Ask us to limit processing of your data in specific cases.
• Right to data portability (Art. 20). Receive your data in a structured, machine-readable format.
• Right to object (Art. 21). Object to processing on legitimate-interest grounds.
• Right to lodge a complaint. Complain to your national supervisory authority - in Romania that's ANSPDCP (dataprotection.ro). You can also complain to the authority in your country of residence.

12 Data retention

Because we hold so little, retention is short:

• On-device data. Lives as long as the app is installed. Uninstalling the app wipes it (see Section 03).
• iCloud-synced data. Lives as long as your Apple ID has the data. Apple's standard iCloud retention rules apply. You can delete it by removing items in-app or by signing out of iCloud.
• Diagnostic logs you've sent. Retained in our inbox for the duration of the support case, then deleted (usually days, occasionally weeks).
• Entitlement row. The single row per Apple ID described in Section 02. This is the one thing we keep indefinitely rather than briefly, because deleting it would let the same account start a fresh trial. You can still ask us to erase it (see Section 11).
• Subscription / billing records. Payment itself is handled by Apple and we never see a card, a name or an address. Serento does send us a subscription snapshot from your device - which plan you are on, its status (active, in trial, in a billing grace or retry period, expired, or revoked), whether it is currently active, whether you are in the trial, whether it auto-renews, the App Store storefront country, whether the purchase came from the App Store or from a test environment, and the purchase, expiry and trial dates - tied to the same one-way account key and device identifier as the rest of the telemetry and kept for 13 months. This snapshot lives with the telemetry and never in the entitlement row: they carry no name, email or Apple ID; they are stored under the one-way account key, which we cannot reverse.

13 International transfers

Dusty Enterprise SRL operates from Romania (EU). The third parties listed in Section 08 process some data outside the EU (Apple uses global infrastructure; Plex is based in California; Resend operates from the United States; the Wikimedia Foundation, Last.fm and MetaBrainz operate from the United States; Deezer from France, inside the EU). Each of these vendors implements the Standard Contractual Clauses or equivalent mechanism for EU-to-third-country transfers, as required by the GDPR. If you'd like the specifics for any of them, contact us.

14 Security

Local data on your device is protected by the operating system's app sandbox and (for the Keychain items - your Plex token in particular) by your device passcode and biometric authentication. CloudKit data is encrypted in transit by Apple and stored in your private container. Diagnostic logs travel over HTTPS to Resend. Our entitlement service holds one row per account: a one-way account key, the date your trial started, the date we last heard from that key, plus internal bookkeeping fields. It holds no purchase record, no name, no email address and no payment detail, and the key cannot be reversed into an Apple ID.

15 Changes to this policy

When the legal copy changes materially we update the effective date at the top of this page and, when the change affects what data we collect or where it goes, surface a notice in-app. The latest revision is always the version you see in Settings → About Serento → Privacy Policy.

16 Contact

For any question, request, complaint, or rights exercise: contact@serento.app. We answer within 30 days as required by GDPR, usually much faster.