Open web app

Privacy

FXM is built so that there is nothing to collect: no analytics, no accounts, no cookies set by FXM, and your data stays on your device unless you turn on sync.

Last updated

The short version

  • No analytics or tracking. This website and the FXM apps contain no analytics, trackers or ad scripts.
  • No accounts. There is nothing to sign up for, so FXM never has your name, email address or password.
  • No cookies set by FXM. FXM doesn't set cookies or use them to follow you. If you connect your Spotify account (coming soon), FXM uses your Spotify login as described in Your Spotify login.
  • No FXM servers. Searches and plays don't pass through FXM, so FXM can't see what you look for or listen to.

Where your data lives

Your library (likes and playlists), listening history and settings are stored on your device: in your browser's storage for the web app, or in the app's own storage on desktop and Android. So are your downloads. FXM can't see any of it.

The token and keys of a scrobbling account you connect are stored there too, and library backups leave them out.

If you turn on sync, a copy also goes to a secret gist on your own GitHub account, so your other devices can read it. The token that lets FXM write it stays on your device. GitHub keeps every earlier version of the gist, and anyone with the gist's link can read them all. Removing something in FXM, or clearing your history, doesn't remove it from those versions: delete the gist to remove everything.

Clearing this site's data in your browser, or uninstalling the app, deletes what is on your device for good. A sync gist stays on GitHub until you delete it there, or turn off sync in FXM and choose to delete it.

Services your device talks to

FXM gets music, information and lyrics straight from the services below. Your device connects to them directly; in the web app, FXM Connect adjusts some of these requests so the services answer. As with any website you visit, they receive your IP address and the requests made for you, such as a search or the song you're playing, and their own privacy policies apply.

YouTube
YouTube Music and YouTube: search, song and video details, audio, the playlists you import, recommendations for your home feed (YouTube Music radio, started from the artists you pick and the songs you play), and song radio (coming soon). Without FXM Connect, the web app also sends YouTube Music one request when it starts, to check whether the experimental Lite tier works in your browser. Only while one of FXM's experimental ways of playing YouTube songs is switched on (they ship switched off), also Google's BotGuard service, to get the token YouTube asks for before it plays a song.
Spotify
When the Spotify integration is on (the default in the apps, and in the web app with FXM Connect; you can switch it off in Settings): search, related artists, the playlists, albums and songs whose links you import, recommendations for your home feed, and song radio (coming soon). If you connect your Spotify account (coming soon), also your recommendations, liked songs and playlists, and Spotify then knows these requests come from your account.
Spotify key source
When the Spotify integration is on: a community-maintained file with the current key of Spotify's web player, which FXM needs to get an anonymous Spotify token, and a second such file if the first can't be read. Both are in third-party repositories on GitHub, which FXM doesn't run, and GitHub serves them from raw.githubusercontent.com, so GitHub's privacy policy applies to those requests.
LRCLIB
Synced lyrics.
MusicBrainz
Song, album and artist information.
ListenBrainz
Recommendations for your home feed, and finding a song's album for its cover. If you connect your ListenBrainz account in Settings (scrobbling, off until you do): each song you play (its title, artists and album, its track number and length, and its ISRC and Spotify link when known), with when you started it and how long you listened, and the song playing now. Each is marked as played with FXM and its version, and sent with the user token you entered. Your ListenBrainz profile and listens are public.
Last.fm
In the apps and the web app with FXM Connect, Last.fm's stations, as recommendations for your home feed. If you connect your Last.fm account in Settings (scrobbling, off until you do): each song you play (its title, main artist and album, its track number and length) with when you started it, and the song playing now. Songs that FXM's radio picked are marked as not chosen by you. They are sent with your API key and session key, and signed with your shared secret, which FXM never sends. Your Last.fm profile and the songs you scrobble are public by default.
Cover Art Archive
Album covers for songs whose source has none. Covers load from the Internet Archive's servers.
Apple's iTunes Search
Album covers for songs that neither their source nor the Cover Art Archive has one for (coming soon).
Internet Archive
Free music, including lossless FLAC.
Jamendo
Free music, including lossless FLAC (coming soon). FXM contacts Jamendo only once it is turned on, and this version doesn't have it on.
SponsorBlock
Only if you turn it on (it's off by default), in Music + Video mode: which parts of a music video aren't music, such as an intro or a skit, so FXM can skip them. FXM sends only the first four characters of a hash of the video's ID, which a great many videos share, so SponsorBlock can't tell which video you play.
GitHub
If you turn on sync in the app's settings: your library, your settings and the plays of the last 90 days, kept in a secret gist on your own GitHub account with a token you create. GitHub keeps every earlier version of the gist, so together they hold every play synced since you turned sync on, and what you removed since. GitHub doesn't list or search secret gists, but anyone who has the link can open one and its earlier versions. Whenever the Spotify integration is on, also the Spotify key files above, which GitHub hosts (raw.githubusercontent.com).

Your Spotify login

Connecting your Spotify account is optional and coming soon. If you do, FXM uses your Spotify login to get an access token from Spotify. FXM never sees your password.

  • In the browser, FXM Connect's Use my Spotify login from this browser option, which is off by default, lets your browser send your Spotify cookies with that one token request. FXM Connect never reads or stores them.
  • In the desktop and Android apps, you sign in on Spotify's own login page, in a window of the app. Your login stays on your device, in protected storage.

Spotify then knows that these requests come from your account. Disconnecting in Settings removes the token from FXM.

FXM Connect

FXM Connect is the small browser extension that lets the web app reach YouTube, Spotify and Last.fm. You install it from a zip file, so your browser doesn't ask you to approve its permissions. Here is what it does:

  • It works only with FXM's own pages. Its rules apply only to requests those pages make to the services above, and it can't read or change what you do on other sites.
  • It adjusts a few headers on those requests so the services answer, and removes your cookies from them.
  • When the web app asks, it fetches Spotify's public server time, without your cookies.
  • It runs only the code it was installed with and never downloads code from the internet.
  • It sends nothing to FXM: no analytics and no telemetry.
  • Its Spotify login option is off by default; Your Spotify login explains what it does when you turn it on.

Its source code, with the full list of its permissions, is in the FXM repository on GitHub.

This website and app downloads

This website and the web app are static files hosted on Cloudflare Pages, and FXM Connect and the apps are published on GitHub Releases. Like any host, Cloudflare and GitHub handle the network requests needed to deliver those files, under their own privacy policies. FXM doesn't add analytics or tracking to either.

The web app keeps a copy of its own files on your device, so it opens without a connection: never your music, or anything the music services send. While it is open, it checks this website about once an hour for a new version of itself, and when it first uses YouTube Music, it fetches FXM's signed YouTube settings file from this website too.

The desktop and Android apps (coming soon) also check GitHub for updates. When they start, they fetch FXM's YouTube settings file from this website, and download FXM's signed YouTube code from it too, so YouTube keeps working between app releases. That code is checked against FXM's signature before it runs.

FXM players on other websites

Other websites can show an FXM player for a song, an album or a playlist (coming soon). The player runs in your browser, like the web app. As soon as the page shows it, even before you press play, your browser loads what it shows from its source: the details and cover art, and for YouTube a check that it can reach YouTube Music. So that source, such as YouTube, receives your IP address and which song, album or playlist the player shows, even if you have never used FXM. FXM doesn't see it. The website that shows the player can start or pause it and learns what it plays, as with any embedded player.

Changes

If the way FXM handles data ever changes, this page will be updated and the date at the top will change.

Questions

Ask on the FXM issue tracker on GitHub.