What Symphonymph and lavishleaf.org collect, what they do not, and who can see what.
Online StoreLast updated 2 October 2026. This policy covers the Symphonymph app and the website at lavishleaf.org, both published by Lavish Leaf Inc.
Symphonymph has no accounts, no advertising, and no advertising or analytics libraries. What you listen to, what you save and what you search for stay on your phone. We cannot see any of it, because it is never sent to us.
The one thing the app tells us is a count. Once a day, unless you turn it off, it sends which version it is, whether it is the Android or the iPhone app, and how many minutes were listened on each day. Nothing in it says who you are or what you played, and it is described in full below.
That is not a promise about our intentions; it is a description of how the app is built.
All of it. Specifically: your library, playlists, collections and Liked list; every playback position and bookmark; your listening history and listening time; your subscriptions; your settings, filters and search history; and anything you have downloaded. It lives in a database inside the app's private storage, and it is removed when you uninstall the app.
Android's own automatic backup is switched off for this app, so none of it is copied to your Google account either. If you want a copy, the app has its own Backup and Restore, which writes a file to wherever you choose.
Symphonymph does not host, copy or relay audio. When you play something, your phone connects directly to the library, archive, broadcaster or publisher that holds it: the Internet Archive, LibriVox, the Library of Congress, Podcast Index, Radio Browser, SomaFM, Audius, Wikimedia Commons and others. Those requests reach them, not us, and like any request to any website they carry your IP address and an identifying User-Agent line that names this app and its version. Each of those organizations has its own privacy policy, and we have no access to their logs.
We send an honest User-Agent rather than disguising the app, because several of these archives are run by volunteers and deserve to know who is asking.
Once a day at most, the app downloads a short public file from this website, lavishleaf.org/withdrawn.json, listing recordings their owners have asked us to stop listing (an artist withdrawing a submission, for example), and hides them. That request carries nothing but what any web request carries: your IP address and the app's User-Agent line. It is not used to count or identify anyone. If it fails, nothing else happens.
Once a day, unless you turn it off in Settings, the app sends one anonymous count to lavishleaf.org: which version and build of the app it is, whether it is the Android or the iPhone app, and how many minutes were listened on each day since the last count. It carries no name, no account, no device identifier, and nothing about what you play or how you have set up the app.
We keep only the daily totals: how many phones used the app that day, and how many minutes were listened in all. Like any request to any website, it arrives with your IP address: our counter looks at it only to stop one address flooding it, and never stores it. (Netlify, which hosts this site, keeps the ordinary server logs described under “The website” below.) We do not keep the message itself either, so nothing we hold can be traced back to one phone, and we could not tell you which counts were yours if you asked. Settings > Share anonymous usage counts turns it off, and turning it off also forgets any days not yet sent.
If you share a playlist, the app writes the list (titles, artists and the
public pages of the recordings) into a link or a file, and your phone's own share
sheet sends it wherever you choose. The list sits after the # in the
link, the part a browser never sends to any server, so opening a shared link, in
the app or on lavishleaf.org/p, tells us nothing about who
shared it or what is in it. Nothing about your listening goes with it.
If you tap the microphone in the search bar, the app hands the audio to Android's own speech recognizer, which is a separate app on your phone made by your phone's manufacturer or by Google. Depending on your device and its settings, that app may send the audio to its own servers to turn it into text. Symphonymph never records, stores or transmits audio itself, and it receives only the resulting text. The microphone is requested the first time you tap it, never at startup, and the feature can simply be left alone.
When a search finds very little, the app may send the words you typed, and nothing else, to Datamuse (api.datamuse.com), a free word-suggestion service, to find the spelling you probably meant ("sherlok holms" becomes "sherlock holmes"). No account, device identifier or listening history goes with them. The words you search for are also sent to the catalogs being searched, which is how any search works.
The app has a way to send us a bug report or a suggestion. Nothing is sent unless you fill it in and press send. What you write is submitted to a form hosted on this website, together with the app version, your Android version and your device model, because a bug report without those is usually unanswerable. Giving an email address is optional and is used only to reply to you. It is never added to a mailing list.
Sharing a recording, opening a source's own page, searching for lyrics or opening a donation page hands the link to another app on your phone: your browser, your mail app, or the system share sheet. From that point you are on that service, under its rules, and we are not told where anything went.
When you pick a Cast speaker or TV, the app sends that device the address of the recording, and the device fetches the audio directly from the source. A recording from your own music server is never cast, because its address carries your sign-in.
Android Auto, watches and other apps on your phone can list your playlists, likes, downloads and queue only if you turn on “Let your car and other apps see your library” in Settings. It is off until you do.
It contains no analytics library, no crash-reporting library, no advertising library and no advertising identifier. It does not build a profile, does not use cookies, does not fingerprint your device, and does not sell or share data with anybody. The only thing it ever sends us is the anonymous daily count described above, which you can turn off. There is no sign-in, so there is no account for anything to be attached to.
Symphonymph is not directed at children under 13. It is a door onto public archives and a directory of independent podcasts, which we neither own nor moderate, so some of what it can reach is intended for adults. An explicit-content filter is built in, and it is off by default, which means an adult has to decide. The Kids & family section always applies it, whatever that setting says, and every recording has a “Report this” action. We do not knowingly collect personal information from anyone, of any age.
lavishleaf.org is hosted by Netlify, which keeps ordinary server logs. The site uses Google Analytics to count visits and which buttons get clicked, and Microsoft Clarity to see how pages are used (where people click and how far they scroll, including recordings of visits with anything typed into a form hidden). Both set cookies. If you would rather they did not, any browser setting or extension that blocks them will work, and nothing on the site depends on them. Neither runs on the shared-playlist page. The download links on the Symphonymph page also count each tap, by file name only, so that we know how many times the app was downloaded from here; that count uses no cookie and no identifier. Forms on this site (contact, newsletter, artist submissions, app feedback) are delivered by Netlify Forms and reach a Lavish Leaf inbox. We do not sell or pass on your details. When you contact us, join the newsletter, place an order, sign up for a pick-up, register for a league, make a donation or create an account, we keep your name, email address and phone number (if you gave one) on our own contact list (stored with Netlify) and may send you our occasional newsletter through Amazon SES. Every newsletter, and every receipt and notice we send, has a one-click unsubscribe link; once you unsubscribe, a later purchase never adds you back, and unticking "news and updates" on a form keeps you off the list. We do not send marketing text messages unless you separately agree to receive them. If you claim the store's first-order discount, we keep your email, phone, whether you agreed to texts, and a one-way code made from your internet connection's address (never the address itself), so the offer can be claimed once per customer. A paid order gets an emailed confirmation, and a signed-in customer who leaves something in the cart may get one reminder email about it, which the link in that email turns off. The Social page shows our own Instagram and Facebook posts. We fetch them on our server, so your browser only loads the post pictures from Meta's image servers. Where that feed is not available the page falls back to Behold's Instagram widget and Facebook's own plugin, which are loaded from Behold and Meta and may set their own cookies under their own privacy policies. The rest of the site does not load them.
Lavish Leaf texts offers and news only to people who ticked "Text me offers" on one of our sign-up forms (the store's first-order offer or a newsletter form) and gave a mobile number. That consent is separate from email, optional, and never a condition of buying anything. Message frequency varies, up to 4 texts a month. Message and data rates may apply. Every text starts with "Lavish Leaf" and ends with how to stop: reply STOP to any of our texts to stop them at once (you get one confirmation and nothing after it), and reply HELP for help, or write to support@lavishleaf.org. Carriers are not liable for delayed or undelivered messages. We send texts only between 9 am and 8 pm Central time. We do not share or sell mobile numbers or text-message consent with anyone, including affiliates, for their marketing. Numbers are sent only to Amazon Web Services, which delivers the texts for us.
Accounts are for the online store only and are optional: you can buy without one, and the Symphonymph app has none. If you create one, Netlify Identity keeps your email address and a scrambled form of your password (or the fact that you signed in with Google), and Netlify Blobs keeps your wish lists, your cart, the order you arranged the shelves in, and a list of orders you paid for while signed in (date, items, total, and how it was delivered). Both are run by Netlify, in the United States. We use this only to show it back to you, never for advertising, and we never sell or pass it on. Card details never reach us: PayPal handles payment. To deliver an order, we give the supplier that ships it (Bangalla, AliExpress or CJ Dropshipping) only what the parcel needs: your name, shipping address, and the phone and email for delivery updates.
In Your account on the store you can download everything we hold about your account as a file, or delete the account. Deleting removes your lists, cart, settings and sign-in straight away. Records of paid orders that the tax law requires us to keep (in PayPal and our accounts) are kept as they would be for a guest order. Accounts are for people aged 13 and over.
Signing up for a pick-up asks for your name, phone number, email, street address, preferred pick-up day, any instructions, and whether you want our bucket. To check the address is inside our pick-up area, it is sent to the US Census Bureau's address lookup, which returns its location and keeps nothing about you. The sign-up is kept in Netlify Blobs (in the United States) and emailed to us, so we can run the route and contact you about it. We use it only for your pick-ups, never sell or share it, and delete it within a year after you cancel. Email support@lavishleaf.org to see, correct or delete it sooner.
Registering a player or a team asks for each player's name, phone number and email (and the team name), and for your agreement to be contacted about league play and to play in both Eufaula and McAlester. It is kept in Netlify Blobs (in the United States) and emailed to us, and used only to run the league: schedules, weather calls, results and the next season. A team captain who enters teammates' details confirms they have agreed to this. We never sell or share it. Email support@lavishleaf.org to see, correct or delete it.
App data: uninstalling the app removes everything on your phone. The anonymous daily totals are kept, and because nothing in them points to a phone or a person, there is nothing of yours in them to delete. Form submissions and email: kept while they are useful and deleted on request. Write to support@lavishleaf.org and we will delete what we hold about you.
Where the GDPR, the UK GDPR or the CCPA apply to you, they give you rights to see, correct, delete and port the personal data an organization holds about you, and to object to its processing. For the app the honest answer is that we hold nothing about you to show: the daily counts carry no identifier, so no part of them can be matched to a person. For anything you have sent us through a form or by email, write to the address above and we will act on it.
If this policy changes we will update the date at the top. If a change ever means the app starts collecting something it does not collect today, that will be said plainly in the app itself, not only here.
Lavish Leaf Inc
support@lavishleaf.org