Cadence

Privacy Policy for Cadence

Last updated: October 5, 2026

Cadence is a podcast player for Android. cadenceplayer.com is its public website. This policy describes how the current app, catalog API, and website handle data. The app stores its library and playback state on your device. Search, Charts, and Discovery use the Cadence catalog API and Podcast Index. The optional automatic ad and promotion skipping feature is currently limited to explicitly enabled Internal Android builds; ordinary release artifacts keep it off. It analyzes only downloaded episodes that you chose to save and never downloads an episode for analysis. With your consent, the exact completed audio download and limited public podcast metadata are temporarily sent to Cadence's private analysis service as described below. The app sends crash reports and sanitized diagnostic logs to Sentry for debugging when "Share diagnostics" is enabled. This is on by default and can be turned off in Settings. The website uses page and interaction analytics, performance measurements, session recordings, and heatmaps as described below.

Who we are

Cadence (com.cadenceplayer.cadence) is independently developed. The current Android app stores its main app data on your device and does not use a Cadence-operated account or sync service. Cadence operates a catalog API for public podcast Search, Charts, and Discovery and an opt-in service for automatic ad and promotion analysis. Sentry is used for crash reporting and diagnostics as described below. The public website is hosted separately and does not store app libraries or playback state.

What we collect

App data. The current version has no sign-in, so catalog requests and diagnostic reports are not tied to a Cadence account. Cadence does not sell personal data or use app activity for advertising or profiling.

The one exception is crash reporting and sanitized diagnostics (see below): if the app crashes, hits an unexpected error, or performs a refresh/backup/DB recovery step that helps diagnose bugs, a technical report or structured log may be sent to Sentry. These reports contain no account or identity data and are not used to track, advertise to, or profile you. You can turn this off with "Share diagnostics" in Settings; local crash handling still remains on-device.

The product website separately uses the limited website analytics described in the Website analytics and session recording section below. If you join the Android waitlist, it also processes your email and subscription consent as described in Waitlist emails.

Catalog API

When you use Search, Charts, or Discovery, the app contacts api.cadenceplayer.com, a Cadence-operated Cloudflare Worker. The Worker asks Podcast Index for public podcast catalog data and returns a normalized result to the app.

Search terms are sent in a POST request body to the Cadence API and forwarded to Podcast Index to answer the search. Cadence does not retain search terms in Workers KV or custom application logs. Search responses are not cached by Cadence. Podcast Index may process the search request under its own privacy policy and terms.

Categories, Charts, and Discovery responses may be held temporarily in Workers KV only when Podcast Index response headers permit caching, and never beyond the permitted lifetime. This cache contains public podcast metadata, not accounts, app libraries, playback state, or search histories, and can be discarded without affecting user state.

Cloudflare processes routine request metadata needed to deliver, secure, rate limit, and diagnose the API, such as IP address, user agent, request timing, and route. The catalog routes create no account or stable analytics identifier and perform no behavioral analytics, user-state storage, or AI processing. Automatic skipping uses separate routes, storage, identifiers, and processing described in the next section. For abuse prevention, the Worker derives a keyed pseudonymous rate-limit bucket from the connection IP and sends only that bucket to Cloudflare's rate limiter. The raw IP and derived bucket are not written to Workers KV or custom application logs; the bucket is used only for the active one-minute rate-limit windows.

Optional automatic ad and promotion skipping

Automatic skipping is off until you review its first-use disclosure and choose to enable it. Cadence records that choice as versioned consent. On a supported downloaded audio episode, Cadence analyzes the completed local media file that you explicitly chose to save. It never downloads an episode just for automatic skipping and does not analyze streamed-only playback. You can revoke permission for new analysis by turning automatic skipping off in Settings; ordinary download and playback continue without it.

Cadence computes the exact downloaded file's SHA-256 and byte length, then sends the compressed file over HTTPS in resumable 8 MiB parts. It does not send the enclosure URL or ask the analysis service to fetch media from the publisher. Automatic analysis is scheduled only while Android reports that the device is charging and using an unmetered network. A manual analysis can use cellular only when you enable "Allow manual ad-analysis uploads on cellular" in Settings.

The resolve and upload requests include:

The service reconstructs the parts and accepts the upload only when its full SHA-256 and byte length match the values computed on the phone. A private Cloudflare Container uses a pinned FFmpeg build to reject corrupt, video, unsupported, or over-limit media and normalize accepted audio once to 16 kHz mono AAC at 32 kbps. The resulting overlapping windows are sent through the Nova-3 speech-recognition and Gemini classification stages. Publisher transcripts and chapters are hints only; they cannot by themselves authorize an automatic skip. Cadence returns verified coverage and segment times, categories, and confidence. When a publisher transcript can be matched to the exact downloaded audio, the service also returns passage indices, aligned playback intervals, matching confidence, and a transcript digest. These timings support transcript highlighting and timestamp seeking; they do not authorize automatic ad skipping. Unmatched passages remain readable without synchronized playback controls.

Source parts, normalized audio, and generated transcripts are private temporary objects. Cadence deletes them after success, failure, or cancellation. An unfinished upload expires after six hours, and a separate 24-hour sweep removes orphaned objects as a backup. D1 retains the pseudonymous analysis and quota records needed for idempotency, abuse prevention, and result reuse, including the timing-only transcript alignment for the exact file. Generated recognition text is not retained with that result. Detailed operational events contain stage timings, byte and retry counts, cleanup outcomes, detector/configuration identities, status, error class, and cost, but no show or episode name, description, transcript text, audio, media/feed URL, local path, or credential. Request failures can also include a route template, request ID, and error class so we can trace a failure through our services. Opted-in Internal app diagnostics also record why analysis work was scheduled, its planned wake time and server retry estimate, whether it was user initiated, its charging and unmetered-network requirements, and the app build and pseudonymous installation/analysis IDs. These requirements describe the work request, not continuous monitoring of your phone's battery or network. These detailed events are retained for 30 days; anonymous daily aggregates are retained for 13 months. Routine Cloudflare request metadata may still be processed to deliver, secure, rate limit, and diagnose the request.

On the phone, Cadence retains the downloaded-file fingerprint, resumable upload state, a hash of the normalized public classification context, verified coverage, detector/configuration identity, content-free analysis outcomes, and classified segments and timing-only transcript alignments for bounded reuse and diagnosis. Transcript timing reuse requires the same audio fingerprint and publisher transcript digest. A result is reused only when the exact downloaded file and classification context match, preventing a different media variant at the same URL from inheriting unsafe timestamps.

Cadence uses an app-generated, pseudonymous installation credential and Google Play Integrity results to protect the analysis service from abuse. These are not used for advertising, cross-app tracking, or behavioral profiling. Raw Integrity tokens are not stored in custom logs.

Undoing a skip always works locally. The current Internal preview keeps the server feedback gate disabled, so it does not retain uploaded corrections. If correction sharing is enabled later, it will also require a separate opt-in: Cadence may then send the exact media fingerprint and manifest revision plus the correction type, category, and segment timing. Corrections contain no free-form text, audio, show or episode title, feed URL, or detailed listening history. Turning off correction sharing stops new correction uploads. Turning off automatic skipping stops new analysis, and removing or replacing a download cancels its open upload so temporary source objects can be deleted or expire.

Podcast publishers can request an opt-out at the contact address below. The analysis service blocks opted-out feed identities and rechecks the opt-out before serving a cached manifest.

Cached results do not reveal which other listeners requested an analysis. Cadence does not sell analysis data or use it to build listening profiles. Cloudflare states that Workers AI customer content is not used to train or improve models without explicit consent.

Automatic skipping does not proxy the publisher's original media stream. Streamed-only playback is not analyzed. Because publishers can dynamically insert different audio into the same episode, Cadence refuses to reuse a result unless the exact downloaded-file fingerprint and classification identity match.

The current Internal-hardening milestone does not require payment and does not authorize a public beta. If Cadence Pro subscriptions are enabled later, Google Play and RevenueCat will process the purchase. Cadence will receive a pseudonymous RevenueCat customer identifier, product, entitlement status, renewal or expiration dates, and purchase-event metadata needed to grant the subscription. Cadence does not receive or store payment card details. There is no Cadence account, and Google Play provides purchase restoration and subscription management.

Crash reporting and diagnostics

To keep the app stable, Cadence uses Sentry (sentry.io) to capture crashes, unexpected errors, and sanitized diagnostic logs. When "Share diagnostics" is on, Cadence may send technical context such as:

This diagnostic data is used solely to diagnose and fix bugs. It may include technical app/device information, sanitized error messages, feed hosts, hashed feed/podcast identifiers, counts, and recovery-step names. It does not include:

Personal-data collection is explicitly disabled (sendDefaultPii is off), and the app scrubs diagnostic fields before sending them. Unavailable or unrecognized test-device signals are reported as unknown. Expected permission denials and handled cancellation do not create standalone error reports. Development and sandbox builds disable remote Sentry reporting by default; developers can explicitly enable it for diagnostics testing. An error message can still incidentally identify the podcast or episode involved in a failure. We use that context to investigate the error, rather than to build a listening profile.

Sentry processes these reports on our behalf as a data processor; the data is not sold or shared with third parties for their own purposes. Sentry's own handling of the diagnostic data is governed by its privacy policy.

Website analytics and session recording

When you visit cadenceplayer.com, the website sends usage events to analytics.garrod.house so we can understand which pages are useful and improve the site. The standard analytics event can include:

Analytics payloads accept only the site's known public page paths and fixed launch campaign labels. Other query parameters, URL fragments, referring-page paths, and arbitrary identity or event-data fields are removed before sending. Interaction events use fixed names and approved labels; they contain no form values, email addresses, response text, or detailed form errors. Only LinkedIn, X, and t.co referring origins are retained; other referrers are omitted. These website events are not linked to waitlist email addresses. The website also sets a no-referrer policy so outgoing page and resource requests do not include the current page URL in an HTTP referrer header.

Session recording and heatmaps are configured for 100% of visits to the home, privacy, and support pages when the browser can run the analytics scripts. Recordings capture page structure, visible public text, navigation, scrolling, clicks, and other interactions. They use the analytics service's moderate masking level, which masks all form inputs, and stop after a maximum of twenty minutes. Forms, inputs, text areas, selects, iframes, and elements marked private are excluded from recordings. Heatmaps collect click coordinates, scroll depth, and page and viewport dimensions. Before recording begins, the website removes arbitrary query parameters and URL fragments from the browser address, retaining only approved campaign labels and the public Features section anchor. The same cleanup applies to subsequent navigation within a recorded document. Session recording and heatmaps are not loaded on the waitlist page. Links to the waitlist open a new page document, ending any recording from the previous page before the signup form appears. The embedded signup form is not included in Cadence session recordings. Analytics are also disabled inside embedded page frames, including the private heatmap viewer.

Website analytics and recordings are used only to understand and improve the Cadence website. They are not used for advertising, cross-site tracking, or personal profiling. The website does not send app-library data, subscriptions, playback history, backups, or diagnostic reports to the analytics service.

The website is hosted as a Cadence-operated Cloudflare Worker. Like other web hosting services, Cloudflare may process routine request metadata needed to deliver the site, maintain security, and diagnose service problems. Cadence also stores website failure or slow-request codes, route templates, HTTP status, duration, and Worker version in its private operations dashboard when available. These records contain no IP address, URL, query, referrer, request body, or visitor identifier. Detailed records are kept for 30 days and anonymous daily counts for 13 months.

Waitlist emails

The optional Android waitlist uses Brevo to collect your email address, record your consent, manage subscription preferences, and send beta invitations and launch news. It does not create a Cadence app account and does not give Brevo access to your podcast library or listening history.

The website embeds Brevo's form and loads its form styling and scripts. Form submissions go directly to Brevo; Cadence's website has no signup API or subscriber database.

After submitting the form with the consent checkbox selected and a successful bot-verification check, you join the waitlist without a confirmation email. This signup process does not verify ownership of the email address. Joining does not guarantee a beta invitation or a release date. We do not add social followers or support contacts to this list without their consent.

Cloudflare Turnstile protects the signup form from automated abuse. Brevo and Cloudflare process technical information needed to deliver and protect the form, such as your IP address, browser information, and challenge results. Brevo also processes email-delivery events, such as bounces and unsubscribes. Email engagement tracking uses Brevo's anonymous setting, which may still process anonymized aggregate open and click statistics. Their processing is described in Brevo's privacy policy and Cloudflare's privacy policy.

We use your waitlist email only for the stated beta and launch messages and subscription administration, not a general newsletter. Each beta or launch email includes an unsubscribe link. You can also contact us to unsubscribe or request deletion. Consent records and a minimal suppression record may be kept to document permission and prevent further messages after you unsubscribe.

Cadence does not put subscriber email addresses in website analytics or page URLs. Social links may include campaign labels to measure visits from a channel; those labels do not identify individual subscribers. Website visit counts and active-subscriber counts are separate measurements; subscriber counts do not imply verified email ownership.

Data stored on your device

In the current version, core app data is stored locally on your device in a private app database (SQLite via the app's Kotlin/Room persistence layer). It does not leave the phone unless you explicitly export it. This data includes:

This data stays on the device. It is not backed up to any server we control. It is removed when you uninstall the app or clear the app's storage. The OPML and backup export features write files only when you choose to, and share them only through the destination you pick in the system share sheet. Backup file contents are never sent in diagnostic logs. Cached publisher-media ranges, model files, analysis-window hashes, and skip segments are derived data and are excluded from Cadence backups. Android bounds the shared media cache to 256 MB and ages analysis-window state with that cache.

Network activity

Cadence needs an internet connection to find and play podcasts. The app uses:

The Cadence catalog API does not proxy RSS feeds or episode media. Catalog requests do not include a Cadence account, advertising identifier, or custom tracking token. Cloudflare, Google Play, RevenueCat, Podcast Index, Sentry, and podcast publishers process their respective requests under their own privacy policies.

Cadence does not currently promise that optional analysis stays in a particular processing region. Provider, processing-location, data-processing, deletion, and publisher-rights review is an explicit external gate before public rollout.

Permissions and why they are needed

The current Android release manifest contains the permissions below. Some are declared directly by Cadence and some are merged from AndroidX or media dependencies at build time. Cadence does not use these permissions for advertising, behavioral profiling, or undisclosed data collection. The INTERNET permission carries the catalog search terms and optional diagnostics described in this policy, along with public podcast and media requests.

Permission Why it is present
INTERNET Contact the catalog and optional ad-analysis APIs, upload completed audio downloads after consent, fetch RSS feeds, and stream episode media.
FOREGROUND_SERVICE / FOREGROUND_SERVICE_MEDIA_PLAYBACK Keep playback running and show the media notification while the app is in the background.
POST_NOTIFICATIONS Show playback/download notifications on Android 13+; the app asks before using notification surfaces.
WAKE_LOCK Allow playback and scheduled background work to continue while the screen is off.
ACCESS_NETWORK_STATE Let networking and background-work libraries check whether the device is online before attempting work.
RECEIVE_BOOT_COMPLETED Let AndroidX WorkManager restore scheduled background work after a device reboot; Cadence does not start playback on boot.
com.cadenceplayer.cadence.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION App-scoped AndroidX permission that protects non-exported dynamic broadcast receivers inside the app.

Cadence does not request location, contacts, microphone, camera, calendar, storage/media-library access, advertising identifiers, or any other sensitive permission. The release permission set is generated at build time from the app and its libraries. Google Play Data safety declarations are based on the app's actual collection and sharing behavior, including optional Sentry diagnostics, not on permissions alone.

Children's privacy

The Cadence app does not knowingly collect personal information from anyone, including children. The current version contains no advertising or in-app behavioral tracking. Neither the catalog nor automatic-skipping service creates behavioral profiles. Automatic skipping is opt-in, and the downloaded-only Internal preview keeps correction feedback disabled unless the user separately opts in and the server feedback gate is deliberately enabled. The website analytics are not intended to identify visitors. Crash reports and sanitized diagnostics can be disabled in Settings.

Changes to this policy

If this policy changes, the updated version will be published at the same location with a revised "Last updated" date.

Contact

Questions about this policy can be raised via email at austin@cadenceplayer.com.

Austin Garrod, Cadence
PO BOX 99900 DD 603 486, STN MAIN
PORT PERRY, ON, L9L 0A6, Canada