Privacy Policy

Last updated: 24 September 2026

Kodama is a desktop app for listening to YouTube Music. It runs on your computer. There is no Kodama account, and Kodama does not collect personal data about you on servers of its own. This page explains, in plain terms, what the app sends, to whom, and why.

Who is responsible

Kodama is an independent open source project. For any question about this policy or your data, write to kodama@kiyoshi.dev.

What stays on your computer

These are stored only on your own device and are never sent to the Kodama project:

• Your YouTube Music sign-in. When you sign in, Kodama keeps the session cookies Google issues in a file on your computer. They are only ever sent to Google and YouTube, to act on your behalf. The same applies to the browser data of the sign-in window.
• Your settings, history, downloads and caches, including cached lyrics, artwork and audio.
• Tokens for services you connect, such as Last.fm or ListenBrainz.

Anonymous usage statistics

Once a day, Kodama sends a short anonymous signal so the project can count how many installations are active. It contains:

• two random tokens derived from an ID stored on your device, one that changes every day and one that changes every month. The ID itself never leaves your device, and the tokens cannot be traced back to you or linked across days;
• the Kodama version, your operating system (Windows, macOS or Linux) and the app language.

The country is taken from the request by our hosting provider, Cloudflare. Your IP address is not stored. Only daily and monthly totals are kept. When you install something from the store, the same service counts one download for that item, once per installation, without any identifier.

You can switch this off under Settings, Playback, Privacy ("Anonymous usage stats"). Nothing is sent while it is off.

Store ratings

If you rate an item in the store, Kodama sends the item, your star rating and a token made from your device's random ID and the item. The token is different for every item, so ratings you give cannot be linked to each other or to you. You can remove a rating at any time, which deletes it.

Bug reports

Only if you send one yourself. A bug report is delivered to a private channel of the Kodama developer on Discord and contains what you type into the form, plus technical details to diagnose the problem: Kodama version, operating system, whether you are signed in (yes or no, not your account), the song that was playing, recent error messages, the current appearance settings, and, if you leave the options on, app logs and a screenshot. A contact name is only included if you enter one. Reports are kept as long as they are useful for fixing the problem.

Services Kodama talks to on your behalf

To do what you ask, Kodama contacts other services directly. Each of them receives your IP address as part of the connection and handles data under its own privacy policy:

• Google and YouTube: your library, search, recommendations and the music itself, using your sign-in.
• Lyrics providers such as LRCLIB, Musixmatch, NetEase, Kugou, QQ Music (through Paxsenix) and Better Lyrics: they receive the title, artist and length of the song you are listening to.
• Unison (community lyrics, run by Better Lyrics): if you vote, report or set a nickname, it receives a public key that Kodama generates for you, your signed action and the nickname you chose.
• Google Translate: the lyrics you choose to translate.
• Return YouTube Dislike: the video ID, to show like and view counts.
• GitHub: checking for and downloading updates, and loading the store catalogue.
• Google Fonts: the fonts you can pick in the settings.

Only if you turn them on or install them:

• Discord: the song you are playing is passed to the Discord app on your computer and shown on your Discord profile. Nothing is sent to the Kodama project.
• Last.fm: what you listen to and the songs you like.
• Extensions from the store: each one lists what it may do and which services it may reach before you install it. For example, ListenBrainz sends what you listen to to ListenBrainz, and the Composer opens its editor from composer.kiyoshi.dev.
• Remote control: only within your own local network, between devices you pair.

Shared song links

A link you share points to a page on kodama.kiyoshi.dev that contains the song's ID. The page is hosted on GitHub Pages; opening it is subject to GitHub's privacy policy. Kodama itself does not record who opens it.

Your rights

If you live in the EU, the UK or a place with similar laws, you have rights to access, correct and delete your personal data, and to complain to a data protection authority. Because the statistics and ratings are anonymous, the project usually cannot tell which records are yours; your local data you can delete at any time by removing Kodama's data folder or signing out. For a bug report you sent, write to the address above and it will be deleted.

Children

Kodama is not directed at children under 13 and does not knowingly collect data from them.

Changes

If this policy changes, the new version is published on this page with a new date. The full history is on GitHub.