QuestBeats - Privacy Policy

Privacy Policy

Last updated: July 4, 2026

QuestBeats ("the App") is an immersive music player for the Meta Quest headset developed by Anwar Studio Official ("we", "us", "our"). This Privacy Policy explains how the App handles information when you install and use it on your Meta Quest device.

1. Information We Collect

The App does not require account creation, registration or login. The App does not ask for your name, email, age or any other personal identifier. The App does not collect user data from third-party SDKs (it does not integrate Meta Horizon SDK user-data APIs, no Facebook SDK, no Google Play Services advertising ID). The only data the App processes falls into three local categories and one network category:

• User preferences – Playback settings (volume, speed, pitch, repeat/shuffle, gapless, sleep timer, ReplayGain), UI settings (theme, view mode, sort order) and the list of saved SMB connections (host, share, username). Stored locally in Jetpack DataStore and Room on your device. Never transmitted to any server operated by us.
• Music library metadata (local) – Cached scan results of audio files you have on the device (paths, sizes, last modified timestamps, embedded tag readouts). Used only to populate the file browser and now-playing screen. Never uploaded.
• Network share credentials – Username and password for SMB/CIFS servers you add. Stored locally in encrypted storage (Android EncryptedSharedPreferences/Jetpack Security). These credentials are used only to connect to the SMB shares you specify and are never transmitted to us or any third party.
• Online metadata lookups (network) – When you play a track, the App sends the artist name and track title to the iTunes Search API (https://itunes.apple.com/search) to fetch album name, release year and an album-art URL, and to several public lyrics endpoints (lyrics.ovh, lrclib, lyrist, and similar) to fetch plain lyrics. These requests do not include your Meta account, your IP address is sent as part of standard HTTPS, and the Apple/lyrics services may log those requests per their own privacy policies. You can disable lookups per-track by playing from "embedded only" sources; the lookups themselves are best-effort and degrade gracefully to null when offline.

2. How We Use Your Data

All locally stored data is used solely to make the App work on your device:

• User preferences – To remember your settings across app launches and to apply them on every new track.
• Music library metadata – To display your audio files in the browser, to determine when files have been added or removed, and to drive the queue-and-play flow.
• Network share credentials – To authenticate with the SMB server(s) you explicitly add, so the App can stream audio from them.
• Online metadata lookups – To enrich the now-playing view with album, year, cover art and lyrics. No data about you is sent beyond the artist+title that is already visible in the track filename.

We do not profile you, do not score engagement, do not target advertising, and do not sell or share any data with data brokers.

3. Data Storage

The App stores the following data locally on your device only:

• User preferences – Display, playback and browsing settings – stored in Jetpack DataStore under the app's private directory.
• Music library metadata – File paths, sizes, timestamps and tag readouts from the local scan – stored in the App's private database (Room).
• Recently played tracks – Track paths you have played – stored locally to power the "recent" list.
• Saved network connections – Host, share and (encrypted) credentials for SMB shares you have added.
• Cached media artwork – Embedded album art from your files plus thumbnails of cover art fetched online, cached by Coil in the App's private cache directory.

None of this data leaves your device except for the deliberate online lookups described above. All local data is fully deleted when the App is uninstalled.

4. Data Sharing

We do not sell, license, rent or share any user data with third parties. The only outbound traffic from the App is:

• Encrypted SMB traffic to network shares you have added — strictly on your local network, you control the destination.
• Optional HTTPS requests to Apple's iTunes Search API and to public lyrics endpoints, fired when you play a track and only with the artist/title needed to answer that request.
• Encrypted HTTPS requests to Coil's artworkUrl100 image CDN endpoints to render album art (Apple's image CDN).

We do not use any third-party analytics, advertising or tracking service. The App does not embed the Meta Horizon Platform SDK, the Facebook SDK, Google Firebase, Crashlytics, Sentry, Amplitude, Mixpanel, AppCenter or any equivalent.

5. Data Retention

All locally stored data is retained on your device only for as long as the App is installed. Uninstalling the App permanently deletes all local data, including preferences, music-library cache, saved SMB connections and recent tracks. Cached album art is cleared when the App's cache is cleared or when it is uninstalled.

6. Data Security

All data stored by the App is kept in the App's private storage, which is protected by Android's per-app sandbox. Network share credentials for SMB are protected with Android EncryptedSharedPreferences (AES-256). Outbound metadata requests use HTTPS. We do not operate any external server, database, or cloud storage of our own; therefore there is nothing on our side that could be breached.

7. Third-Party Services

The App uses the following external services, only for the purposes listed in this policy:

• Apple iTunes Search API (https://itunes.apple.com/) — to look up album name, release year and cover-art URL for a track you are playing. Governed by Apple's Privacy Policy.
• Public lyrics endpoints (lyrics.ovh, lrclib, lyrist/Genius and similar) — best-effort fetch of plain lyrics. Each is governed by its own privacy policy.
• Coil image loader for cached album art, including Apple's artworkUrl100 CDN.

The App does not integrate any other third-party analytics, advertising, payments or tracking tools.

8. Network Usage

The App can play audio from three sources you select:

• Device storage – Files you have placed on the Quest, plus mounted USB drives (exFAT/NTFS). All access is read-only for playback.
• SMB/CIFS network shares – Optional connections (typically a NAS or a PC) on your local network that you add manually. The App connects directly to the host you specify; this traffic stays within your own network and is not routed through, collected by, or stored on any server operated by us. Credentials you enter for a share are stored only on your device in encrypted form.
• Online metadata endpoints – As described above, lookups are best-effort and degrade gracefully when offline.

9. Sensors and Camera

The App uses the Meta Quest headset's head-tracking and controller input to let you navigate the 2D music panel. The App does not access the headset's cameras, microphones or pass-through stream. Sensors are consumed through the standard Quest input services for UI navigation only.

10. File and Storage Access

The App requests the following Android permissions, all of which are declared in its manifest:

• Media permissions – READ_MEDIA_AUDIO, READ_MEDIA_VIDEO, READ_MEDIA_IMAGES, READ_EXTERNAL_STORAGE, WRITE_EXTERNAL_STORAGE, MANAGE_EXTERNAL_STORAGE – to discover and play audio files on the headset and on connected USB drives. Files are read for playback only; they are never modified, copied off-device or uploaded.
• Network permissions – INTERNET, ACCESS_NETWORK_STATE, ACCESS_WIFI_STATE – to talk to your SMB shares and to fetch metadata.
• Service permissions – FOREGROUND_SERVICE, FOREGROUND_SERVICE_MEDIA_PLAYBACK, FOREGROUND_SERVICE_DATA_SYNC, FOREGROUND_SERVICE_SPECIAL_USE, POST_NOTIFICATIONS, WAKE_LOCK – to keep music playing in the background, show the system media notification and run file-operation foreground work.
• USB – android.hardware.usb.host – to read USB drives plugged into the Quest.

The App also exposes a deep link under the questfiles:// scheme for the optional file-sharing intent, and an AndroidX FileProvider configured for sharing files you choose to send to external apps (e.g. another player). Sharing is opt-in per file.

11. Children's Privacy

QuestBeats is suitable for all ages and contains no user-generated content, advertising or social features. The App does not require any personal data to function and therefore does not knowingly or unknowingly collect data from children. Because the App is intended for general audiences, we make no age-verification request; we simply do not collect any data that would warrant one.

12. Your Rights and Data Deletion

Regardless of your location, you have the right to request deletion of any data associated with your use of the App. All locally stored data resides exclusively on your device. Uninstalling the App permanently deletes all locally stored data, including preferences, music-library cache, recent tracks and saved SMB connections. No fees are charged for data deletion, and no justification is required.

For data held by the third-party endpoints described in section 7 (Apple iTunes, lyrics services), please refer to those services' own privacy policies and account tools. The App does not transmit any account identifier to them — only the artist and track title of the song you are playing.

If you need any assistance with deleting your data or have questions about this process, please contact us at psopala93@gmail.com and we will be happy to help.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be reflected on this page with an updated revision date. We encourage you to review this page periodically.

14. Contact

If you have any questions about this Privacy Policy, wish to request data deletion, or have any privacy-related concerns, please contact us at: