Privacy Policy

Last updated: October 23, 2026

Private Press is built on a simple principle: your music data is yours. Scanning your collection, checking artwork, and changing your files happen mainly on your Mac. Features that connect to online services send the information described below.

Data Processed by Keynell

The app has no advertising or third-party tracking software. Keynell receives information when you use online features such as Identify or license activation. Each feature is explained below. Identify does not send us your audio files, listening history, or local file paths.

What Stays on Your Device

The app stores the following information on your Mac. Some album and track details are also sent when you use online search or Identify, as explained below. The separate iCloud collection-sync feature is still in development.

• Collection details from Apple Music and selected local or network folders, including album names, artists, file paths, and audio quality
• Your accepted artwork choices and press history
• A history that adds a record for each press without rewriting earlier records
• Preferences, settings, and Smart Rules
• Discogs connection credentials, which the app retrieves through Apple's CloudKit service
• Saved macOS permissions for the folders you have allowed the app to access
• Local information used to keep the app working reliably

Network Connections

Artwork search. The app sends album and artist names to the search providers you enable:

• Apple's iTunes Search API
• MusicBrainz and Cover Art Archive
• Discogs

The app does not add your device identifier, location, or other personal details to these search queries. You choose which providers are enabled. Each provider's own privacy policy applies.

Search accuracy. Images, album titles, and edition details come from those providers. Keynell does not control or verify their accuracy. Confidence scores compare your album details with a provider's listing; they do not guarantee a correct match. Review matches before pressing, especially in large batches.

Selected folders. Private Press uses macOS permissions to access the folders you select. Reading and changing files happens locally. Audio files and local folder paths are not sent through artwork search or Identify. Those features may send album and track details from the selected folders.

Update checks. The app downloads a release list from releases.keynell.com and checks your installed version on your Mac. The request sends no message body, license key, device identifier, or information about your collection. The server sees the connecting IP address, as it does with other web requests.

Audio Identification

Getting access. Identify first asks api.keynell.com for an access token, a code that authorizes the identification request. If the app has a saved license key, it sends that key and the token is linked to your license.

Without a saved license key, the app sends a random identifier stored in your Mac's Keychain. We use it to meter free identification and prevent abuse. It is not based on your hardware. It can remain across reinstalls if its Keychain entry remains.

The app then sends the token to Keynell's identification service with any of these details that are available:

• Album title and artist
• Number of tracks
• Year and a country hint
• Track titles, positions, and disc numbers
• Track lengths
• ISRC recording identifiers
• An app-generated track ID used to match each result to the right track
• A Chromaprint acoustic fingerprint

A Chromaprint is a signature calculated from audio, not an audio file. It can still identify a recording. Keynell processes your request and may send the fingerprints and track lengths to AcoustID to find matches. Your audio files and local file paths are not sent through Identify.

Direct AcoustID fallback. If Keynell's service cannot be reached, limits the request, or cannot authorize it, the app tries AcoustID directly at api.acoustid.org. This happens automatically during the same Identify action, for one album or a batch. There is no separate setting for it, and Keynell's server is not involved in that direct request.

The direct request contains:

• The acoustic fingerprint
• The track length in seconds
• Our AcoustID application key, which identifies the app rather than you
• A request for recording and release details in the reply

It does not contain album names, artist names, track titles, ISRCs, your license key, or a device identifier. AcoustID's privacy policy applies.

Caching and service analytics. Keynell may save fingerprint lookup results so they can be reused. The lookup key is a hash calculated from the fingerprint using SHA-256, rather than the fingerprint itself.

We also keep limited information about identification results to check reliability, evaluate scoring, and plan capacity. It includes counts, timings, scores, operating details, and identifiers coded with a key held by the service, instead of the original album, artist, track, ISRC, or fingerprint values. These coded identifiers let us group related results without placing those original values in the analytics records.

We do not store users' complete identification requests or results for troubleshooting.

Licensing and Press Credits

Activating a Mac. The app contacts api.keynell.com with your license key and the public part of an authentication key created on your Mac. We store that public key. Its matching private key stays in your Mac's Secure Enclave and never leaves your Mac.

The service sends a random device ID and a challenge. The app returns that device ID and a signed answer proving that your Mac holds the private key. The activation request also states which licensing protocol version the app uses.

This activation flow, introduced in Private Press 1.6.1, enforces device limits without sending a hash of your Mac's hardware UUID. The service-generated device ID is random, not based on your hardware. Later requests from an activated Mac use it to identify that activation. You can still use owner-verified privacy recovery if that Mac is lost.

Counting presses. On Test Pressing and Press Run, the app reserves credits when you accept artwork or start a batch press. After the file is written, it reports the press. These requests include:

• Your license key, device ID, and product ID
• An album identifier, explained below
• For older-format press reports, a reservation token, timestamp, event type, authentication code, and the version of the signing key

The service returns your remaining credits. The app can also request your balance separately. Free-tier presses are counted on your Mac and are not reported to the licensing service. These licensing requests do not include album titles, artist names, track lists, or file paths.

Pro does not reserve credits, but it may still report an album identifier after a completed press.

Your Album Identifier

The album identifier is a code used to count presses and recognize repeat presses of the same album.

Older identifiers. Private Press 1.5.1 and earlier creates this code from the album's artist and title using your license key. Newer apps may also use that method until privacy setup is enabled, where the license allows it. The artist and title are not sent in licensing requests. However, we can test possible album names against these older codes using information already held by the licensing service.

That also applies to older identifiers already stored by the service. Older apps, including those using an existing Pro license, may continue to send them.

Optional privacy setup. Introduced in 1.6.1, this option creates new album identifiers using a secret generated on your Mac. The licensing requests do not include that secret or your personal recovery code. We receive the new album identifiers but cannot calculate them from our license records alone.

This protection applies to new identifiers from the app where you enabled privacy setup. It does not change old records or what older apps send. Requests also include the licensing protocol and privacy-setup versions, plus the service-issued verification information needed for the operation.

Recovery and reset. Privacy setup keeps your existing license key. You verify ownership through the email address registered to that license. The app sends an action-specific request and a check value calculated from its secret. We store that check value and the setup version, and email a one-use ownership-verification code.

That emailed code is different from your personal recovery code. Recovering on another Mac restores the same private setup. If you lose the private setup and explicitly verify a total-loss reset, the app starts a new set of private album identifiers. The reset request includes the existing version and your acknowledgement of the consequences.

A reset does not change your license or remaining credits. On a credit-based license, pressing an album again may cost a credit if its old identifier is no longer recognized as a repeat.

What we can still see. Even with privacy setup, we can see how many albums you press, when you press them, whether an identifier repeats, and which activated Mac was used. Licensing also receives your license key, device ID where applicable, connecting IP address, and request time. Private album identifiers do not make your use anonymous.

Technical details of older identifiers and press reports

Older identifiers use HMAC-SHA256 over the album artist and title, lowercased with repeated whitespace collapsed into artist|title. The key is the SHA-256 hash of your license key, which the service stores. That lets the service calculate identifiers for candidate album names and compare them with stored identifiers.

In an older-format press report, the authentication code covers the album identifier, timestamp, and event type. The reservation token is sent separately and is not covered by that code. Privacy-enabled operations use service-issued proofs or signed reservation tokens as required.

Identify is separate. Audio identification uses the separate service and sends the information listed under Audio Identification, including its authorization request.

Connecting activity across services. Licensing requests omit album and artist names, but Identify sends the details described above. Both services receive the connecting IP address and request time. Someone with access to both sets of request records could link an identified album to a license by matching the IP address and nearby request times. The current design does not prevent this. We will update this policy as those protections change.

Privacy Recovery and iCloud Keychain

Optional privacy setup saves a recovery backup in a Keychain item that can sync through Apple's iCloud Keychain. It contains your personal recovery code and the secret used for private album identifiers. It can reach your other Macs when iCloud Keychain is available for your Apple Account. It is not sent to Keynell's licensing server.

Keep your own copy of the recovery code so you can recover if iCloud Keychain is unavailable.

This is separate from collection sync. It does not sync music files, artwork choices, press history, or app settings.

iCloud Sync (In Development)

Collection-state iCloud Sync is not available in the current release. This section describes the feature being developed.

It is being built as an optional Pro feature that you turn on yourself. It uses your own Apple Account's private CloudKit database. The synced information does not pass through Keynell's servers, and we cannot read it. Turning the setting off stops syncing.

The feature would sync:

• Album state, including original and accepted names and artists, the source it came from, artwork and preview URLs, confidence scores, provider, MusicBrainz and collection IDs, track count, and pressed status
• Press history, including the source and its URL, artwork dimensions, confidence, the pressed image's SHA-256 hash, the outcome, and timestamps
• Review queues, including the name of the Smart Rule that queued an album
• Smart Rules, including names, enabled status, conditions, actions, priority, and annotation templates
• Settings, including your backup folder path, scanned source IDs, backup retention period, artwork resolution, auto-accept threshold, and latest Autopilot report
• Records that keep an album's identity stable across rescans, including album title, artist, and source ID

Album names, artists, and some local paths would therefore leave your Mac when this feature is on. A folder source's ID is its folder path. That path appears in album records, album-identity records, and the list of scanned sources. Your backup folder path also syncs.

This information goes to Apple, not Keynell. Apple's iCloud terms govern its handling and encryption. End-to-end encryption depends on your Advanced Data Protection setting; the app does not control that setting. Your audio files are not uploaded.

Purchases

Our payment provider handles the sale and processes your payment. It sends Keynell order and customer information needed to fulfill the purchase, manage your license and refunds, and provide support. This includes your email address, order and customer IDs, the product purchased, amount, and currency.

Your license key arrives by email and is activated in the app. The app does not store payment information.

File Access

Private Press reads audio files to inspect artwork and changes metadata when you press. Identify does not send the audio files themselves.

Backups of files before a press are on by default. You can change or disable them in Settings. The app prepares changes before replacing a file. If a write or replacement fails, it reports the failure and uses any available recovery information or backup.

No Advertising or Third-Party In-App Tracking

This Website

The privatepress.app website uses Vercel Web Analytics to measure page views and website traffic. That is separate from the app and from the identification service's result analytics.

Children's Privacy

Private Press is not intended for children under 13. Keynell does not knowingly collect personal information from children under 13.

Changes to This Policy

When this policy changes, we update the date above. Our core commitment stays the same: your data stays yours.

Contact

Questions about this policy? Email support@keynell.com.