Privacy Policy

Last updated: March 6, 2026

1. Who We Are

LoonBox is operated by MPLS LLC, a company based in Minnesota, USA. This policy covers the LoonBox desktop application, the loonbox.app website, and any associated services including The Nest marketplace and Tremolo music platform.

Contact: privacy@loonbox.app

2. What We Collect

Account Information

When you create a LoonBox account, we collect:

• Email address — for authentication and account recovery
• Password — stored as a salted hash, never in plaintext
• Display name — your chosen public identity

Local Application Data

LoonBox stores the following data locally on your device only:

• Music library metadata (artist, album, track info, file paths)
• Cached album art
• Playlists, queue state, and playback history
• EQ presets and audio settings
• Feather (theme) preferences
• Extension configuration

This data never leaves your device unless you explicitly enable cloud sync.

Cloud Sync (Optional)

If you enable cloud sync, we store encrypted copies of:

• Playlists and favorites
• Feather and extension preferences
• Application settings

Your actual music files are never uploaded. Synced data is encrypted in transit and at rest.

Tremolo Purchases

When you purchase music through Tremolo, we store:

• Purchase history and download records
• Payment method (processed by our payment provider — we do not store full card numbers)

The Nest Downloads

When you download feathers or extensions from The Nest, we record:

• Which items you've downloaded (for update notifications)
• Extension permissions you've granted

MusicBrainz Lookups

When you use the auto-tagging feature, track metadata is sent to the MusicBrainz API for matching. This is a direct request to MusicBrainz — we do not proxy or log these lookups.

Website Analytics

The loonbox.app website does not use third-party analytics, tracking pixels, or cookies. We collect only standard server access logs (IP address, timestamp, page requested), which are rotated and deleted after 30 days.

3. What We Don't Collect

• We do not scan or fingerprint your music files
• We do not track what you listen to (unless you opt into a feature like scrobbling via an extension)
• We do not collect device telemetry or crash reports without your consent
• We do not use third-party analytics or ad networks in the application
• We do not sell, rent, or share your data with third parties

4. Extensions and Third-Party Services

LoonBox extensions (e.g., a Last.fm scrobbler) may connect to third-party services. Each extension declares its required permissions in its manifest, and you must approve them before installation. Extension network access is sandboxed — extensions can only reach domains listed in their manifest.

We are not responsible for the privacy practices of third-party services accessed through extensions. Review each extension's privacy disclosure on The Nest before installing.

5. Embedded Browser

LoonBox includes an embedded browser for accessing web content. The browser:

• Routes traffic through a local filtering proxy on your device
• Blocks ads and trackers using the Brave adblock engine
• Does not share browsing data with MPLS LLC or any third party
• Operates under a domain allowlist/blocklist you control

6. Data Storage and Security

Account data is stored on infrastructure operated by MPLS LLC. We use:

• TLS encryption for all data in transit
• Encryption at rest for sensitive data
• Salted password hashing (bcrypt)
• No shared cloud infrastructure for database storage

7. Data Retention and Deletion

You can delete your account at any time from within the application or by emailing privacy@loonbox.app. When you delete your account:

• All account data is permanently deleted
• Cloud sync data is permanently deleted
• Purchase records are retained only as required for financial compliance
• Disaster recovery backups are purged within 14 days

Local application data (your library, playlists, settings) remains on your device and is yours to keep or remove.

8. Your Rights

You have the right to:

• Access — request a copy of all data we hold about you
• Correction — update your account information at any time
• Deletion — delete your account and all associated data
• Portability — export your playlists, favorites, and settings

To exercise these rights, email privacy@loonbox.app.

9. Children's Privacy

LoonBox does not knowingly collect data from anyone under 13. If we learn that we have collected data from a child under 13, we will delete that data immediately.

10. Changes to This Policy

We will notify you of material changes to this policy at least 30 days before they take effect, via email or an in-app notification. Continued use after the effective date constitutes acceptance.

11. Contact

For privacy questions or data requests:

• Email: privacy@loonbox.app
• Mail: MPLS LLC, Minneapolis, MN, USA