Privacy Policy for Mureka Player

Last updated: 9 October 2026

Mureka Player is a free, open source music player for the songs on mureka.ai. It comes in three versions: a browser add-on for Firefox and Chromium based browsers, a bookmarklet for browsers without add-ons such as Safari on iPhone, and an Android app. All three run the same player. It is developed by EvTheFuture (Magnus Sandin) and is not affiliated with, endorsed by, or operated by Mureka.

Summary

• No version collects anything for the developer. There are no developer servers, no analytics, no telemetry, no crash reports and no advertising.
• The player talks to Mureka on your behalf, with the login you already have on mureka.ai, the same way Mureka's own website does.
• What the player keeps, your song list, stored songs, ratings and settings, stays on your device.
• The bookmarklet loads the player's code from the internet each time it starts, see below. The add-on and the app contain all of their code.
• The Android app can show the player to other browsers on networks you allow, such as a car's browser on the phone's hotspot. That stays on those local networks.

What every version does

Requests to Mureka

These are made only while the player runs on mureka.ai, using your Mureka login, and only for what the player shows or what you ask it to do:

• mureka.ai: the songs in your library or of a creator you browse, song details such as lyrics, play counts and likes, and the actions you choose: like, publish, unpublish, rename, allow or disallow remixing, trim, delete, and change a cover.
• static-cos.mureka.ai and other mureka.ai hosts: the audio files, cover images and waveforms of those songs.
• A new cover you choose is uploaded to Mureka's file storage, at the address Mureka's own upload service gives for it, the way Mureka's website uploads one.
• When a song plays, a play is reported to Mureka, as Mureka's website does. This can be turned off in the settings.

Kept on your device

• Your song list and the songs' details, such as title, genre, length and publish state, so the list opens at once and works offline.
• Stored songs, covers and waveforms, so playback works without signal.
• What you add yourself: ratings, tempos, instrumental marks, saved creators, the play queue and your settings.
• A debug log of what the player did, only while you switch it on under Developer or show a debug overlay. It also lists the requests made to Mureka, with anything that looks like a token, password or signature blanked out. It stays on the device and only leaves it if you copy or export it yourself, so look through it before you share it.

None of this is sent anywhere. It is removed when you clear the site data for mureka.ai, remove the add-on, or uninstall the app.

Export, import and the clipboard

• An export is made only when you ask for it: as a file you save or share, or as text copied to the clipboard. Where it goes from there is up to you.
• The player reads the clipboard only when you tap Paste in the import box.
• An imported file is read on your device. Links to songs and covers in an imported file are only used when they point at mureka.ai.
• Google Drive backup is not turned on in any published version. If it is ever turned on, this policy will say so first.

The browser add-on

• It runs only on mureka.ai and contains all of its own code. It never downloads or runs code from elsewhere.
• The downloads permission is used for one thing: when you download songs, they are saved as mp3 files in a Mureka folder in your downloads. Only Mureka's own song files are saved this way, never anything else, and your existing downloads are never read.
• Its data is kept in the browser's storage for mureka.ai.

The bookmarklet

• Each time you tap it, the bookmarklet loads the player's code from the project's public repository on GitHub, through the jsDelivr content network (cdn.jsdelivr.net), or from GitHub Pages (evthefuture.github.io) for the test version. Like any download, that request shows the host your IP address and browser. Nothing else is sent.
• The code it loads runs inside the mureka.ai page with your Mureka login, so it is the published source code on GitHub, open for anyone to inspect.
• Its data is kept in the browser's site data for mureka.ai, such as Safari's on an iPhone.

The Android app

• The app opens mureka.ai in its own built in browser and keeps your Mureka login there, on the phone. Another site opened from Mureka, a sign in page say, is shown in the same browser but gets no access to the app. Frames from other sites inside Mureka's page are only shown from Mureka itself and a few sign in and payment services.
• It keeps playing in the background and shows what plays on the lock screen, in its notification and on Bluetooth devices such as a car.
• The web view. The app runs a small web server on the phone, so a browser on another device can show and control the player: a car's browser on the phone's hotspot, or a computer on your Wi-Fi. Only devices on the networks you allow in the settings can reach it, never the mobile network, and nothing goes through the internet. It answers only pages it served itself, never requests sent from other websites. A password for it can be set in the settings. Only a salted hash of the password is kept, on the phone. A browser that signs in keeps a random sign in key in a cookie that only the phone's web view gets, until the password changes or all browsers are signed out. Without a password, anyone on an allowed network can use it while the app runs, so allow only networks you trust.
• Local name. The phone answers a local name (murekaplayer.local by default) on the networks it is on, so the web view can be found by name.
• Public address (VPN). When you turn it on, the app starts a VPN that carries no traffic at all. It only gives the phone one fixed address on the hotspot for car browsers that refuse private addresses.
• Hotspot helper. To turn the hotspot on and off for power saving, the app can pair with the phone's own wireless debugging, once and with your confirmation. That connection stays inside the phone.
• Bluetooth. The names of paired Bluetooth devices are read only so you can choose which ones start or end power saving. They stay on the phone.
• Battery, heat and hotspot. The charging state, the battery's temperature, Android's heat level and whether the hotspot is on are read on the phone, for power saving and for the badges in the web view. They go only to the web view and are not sent anywhere else.
• Files you export are saved to the phone's Downloads folder, only when you ask.

Children

Mureka Player is not directed at children and collects no data from anyone, regardless of age.

Changes to this policy

If this policy changes, the updated version will be published on this page with a new date at the top.

Contact

Questions about this policy can be raised as an issue at github.com/EvTheFuture/MurekaPlayer. The full source code of every version is available there for inspection.