Hum privacy

Applies to the Hum app for iOS and Android (repository name hum-music): a client for Subsonic-compatible music servers (Navidrome, Airsonic, Gonic and others) that you run yourself. The app links here from its connect screen and from Settings → About.

This service is operated by llab08, Hong Kong, and these terms are governed by the laws of Hong Kong. The section below explains this product’s data handling and current availability.

Your own server, not ours

Hum ships with no server, no music library and no account with us. On first run you enter the address of a music server you operate or have been given access to, together with your username and password for it. Every request the app makes — sign-in, browsing, searching, streaming, playlists, starring — goes only to that server, at the address you typed. We do not run, see or relay any of it.

What is stored on the device

The server address, username and password are kept in the device’s secure storage (the iOS Keychain; Keystore-backed encrypted storage on Android) so you do not have to sign in again; “Log out” in Settings removes them. Cover art is cached on the device for speed, and playback state may be kept locally. Nothing is stored anywhere else.

What your server receives

As the Subsonic protocol requires, each request carries your username, a salted token derived from your password (not the password itself), and the client name “hum”. What the server keeps or logs is decided by whoever operates it.

Plain-HTTP servers

Self-hosted servers on a home network are often reachable only over plain HTTP, so the app allows it. On such a connection your sign-in and the music travel unencrypted across that network; use an https address whenever your server offers one.

No ads, no analytics, no accounts

The app shows no advertising, contains no analytics or crash-reporting SDK, and has no sign-in with us. We receive no data from it.

Permissions

Internet access, to reach the server you enter; background audio with a playback notification, so music keeps playing with the screen off. No location, contacts, microphone or camera.

Children

The app is not directed at children under 13 and does not knowingly collect personal data from them.

Contact: hello@llab08.com · Updated 7 September 2026 · All privacy notices