Privacy Policy

Last updated: August 14, 2026

Private Press is built on a simple principle: your music data is yours. Scanning, artwork analysis, and file modification primarily occur locally on your Mac. Selected network features transmit the data described below.

Data Processed by Keynell

Private Press does not use advertising or third-party in-app tracking SDKs. Keynell processes data when you use network features such as audio identification or license activation. The specific data for each feature is described below. Raw audio files, listening history, and local file paths are not sent through the Identify service.

What Stays on Your Device

The following data is stored and processed locally, except when you choose a network feature that uses specified metadata, and except when you turn on iCloud Sync, which copies much of it to your own iCloud account as described below:

• Your music collection metadata (album names, artist names, file paths, audio quality) — from Apple Music and local folders/NAS volumes
• Accepted artwork matches and press history
• Provenance records (append-only audit trail of every press)
• App preferences, settings, and Smart Rules
• Discogs API credentials (provided automatically via CloudKit)
• Folder access bookmarks for local music directories (security-scoped)
• Local app settings and reliability state

Network Connections

Artwork search. When you search for artwork, album and artist names are sent to the search providers you select:

• iTunes Search API (Apple)
• MusicBrainz / Cover Art Archive (open source)
• Discogs API

These queries contain only album and artist names — no device identifiers, location data, or personal information. Each provider's own privacy policy applies to those queries. You control which providers are enabled.

Data accuracy. Artwork search results — including images, album titles, and edition metadata — are provided by third-party services. Keynell does not control or verify the accuracy of this data. Confidence scores reflect text similarity between your album metadata and the provider’s catalog entry; they are not a guarantee of correctness. We recommend reviewing matches before pressing, particularly during large batch operations.

Local folder sources. Private Press accesses selected folders through macOS security-scoped bookmarks. File reads, file writes, raw audio, and folder paths remain local. Album and track metadata derived from a folder source may be included when you use artwork search or audio identification.

Update checks. The app fetches a release feed from releases.keynell.com. The request carries no body, no license key, no device identifier, and nothing about your collection; the version comparison happens on your Mac. As with any web request, the server sees the connecting IP address.

Audio identification

When you use Identify, the app may send the following data to Keynell’s identification service:

• Album title and artist
• Album track count
• Year and country hint, when available
• Track title, position, and disc number
• Track duration
• ISRC, when present
• An opaque client track ID used to match results to the request
• A Chromaprint acoustic fingerprint

A Chromaprint is a derived acoustic fingerprint, not an audio file. It can nevertheless reveal the identity of a recording. Keynell processes the Identify request and may send fingerprints and durations to AcoustID for matching. Raw audio and local file paths are not sent through Identify.

Identify can also contact AcoustID directly. If Keynell’s identification service is unreachable, rate-limited, or cannot authorize the request, the app falls back to matching the album against AcoustID itself, with no Keynell server in the path. It happens automatically as part of the same Identify action, in both single-album and batch identification, and there is no separate setting for it. That request goes to api.acoustid.org and contains:

• A Chromaprint acoustic fingerprint
• The track duration in seconds
• Our AcoustID application key, which identifies the app rather than you
• A flag asking for recording and release details in the reply

It does not contain your album title, artist, track titles, ISRC, license key, or any device identifier. AcoustID’s own privacy policy applies to it.

Keynell may cache fingerprint lookup results for 24 hours. Cache keys are derived by applying SHA-256 to the Chromaprint; the raw Chromaprint is not part of the cache key. Keynell also records pseudonymized result-side service analytics for reliability, scoring evaluation, and capacity planning. These analytics use operational dimensions, counts, timings, scores, and keyed pseudonymous identifiers rather than raw album, artist, track, ISRC, or Chromaprint values.

Licensing and Press Credits

When you activate a license key, the app contacts our licensing server (api.keynell.com) with:

• Your license key
• A device public key generated on your Mac, held in the Secure Enclave where available. The matching private key never leaves your Mac. Keynell stores the public key.
• A device fingerprint hash — a one-way SHA-256 of your Mac’s hardware UUID, not a raw serial number or MAC address. It is sent at activation and not on later requests.
• In a second step, the challenge the server issued and a signature over it proving your Mac holds the matching private key

Activation is used to enforce device activation limits. We cannot reverse the fingerprint hash to recover hardware details.

The server then issues a device identifier and returns it. That identifier is a random value the server generates; it is not derived from your hardware and reveals nothing about your Mac. It, and not the fingerprint hash, is what every later licensing request carries.

On the Test Pressing and Press Run tiers, the licensing server also meters presses. The app reserves a credit for an album when you accept artwork for it or when you start a batch press, and reports the press to the server after the file is written. Each of those requests sends:

• Your license key, the device identifier, and the product identifier
• A per-album identifier, one per album, described below
• For a reported press: the reservation token, a timestamp, the event type, and an authentication code — computed over the per-album identifier, the timestamp and the event type, together with the version of the key that signed it. The reservation token itself is sent alongside and is not covered by that code.

The server replies with the credits remaining on your license, and the app can request that balance on its own. Free-tier presses are counted on your Mac and are not reported. Album titles, artist names, track lists, and file paths are not included in these requests.

The per-album identifier

The per-album identifier is how the server charges one credit per album and recognizes a second press of the same album as a duplicate rather than a new charge. Your Mac computes it as an HMAC-SHA256 over the album’s artist and title, lowercased and whitespace-collapsed into the single string artist|title, keyed with the SHA-256 of your license key. The result is 64 hexadecimal characters. The artist and title themselves are not sent.

That identifier is a pseudonym, and as the app ships today it is not anonymous. The licensing server stores the SHA-256 of your license key, which is the key the identifier is computed with, so it holds both inputs to the derivation. Given a list of candidate artist and title strings, it can compute the same identifiers and match them against the ones it has received. Nothing in the current design prevents that. Please do not read this value as one we are unable to resolve back to an album.

Across reservations and reported presses, the server can also observe how many albums you press, when you press them, how often the same album comes back, and which of your activated devices was involved.

Planned, not shipped. Three separate things have to be true before the server stops being able to do this, and none of them has shipped: the app has to derive the identifier with a per-license secret generated on your Mac and never sent to us; the server has to refuse the old form outright, because a server that still accepts it can still be handed one; and the identifiers already stored have to be re-keyed or expired, because otherwise every one written before the change stays matchable. Two out of three would not be enough. Until all three are done, the paragraphs above describe what is true, and we will update this policy and the date at the top when that changes.

Audio identification is a separate Keynell service and transmits the data listed under Audio identification, and only when you use it.

iCloud Sync

iCloud Sync is a Pro feature and is off until you turn it on in Settings. When it is on, the app writes to the private database of its iCloud container, under your own Apple Account. This data does not pass through Keynell’s servers and we cannot read it. Turning the setting off stops syncing.

What syncs:

• Per-album state — the album’s own title and artist, the source identifier it came from, the accepted album name and artist name, artwork and preview URLs, match confidence, which provider the match came from, MusicBrainz and collection identifiers, track count, and whether the album has been pressed
• Provenance for each press — source, source URL, artwork dimensions, confidence, the SHA-256 of the pressed image, the outcome, and timestamps
• Review queue state, including the name of the Smart Rule that queued an album
• Your Smart Rules — each rule’s name, whether it is enabled, its conditions, action, priority, and any annotation template you set
• App settings, including your backup folder path, the identifier of every source you have scanned, backup retention period, artwork resolution, auto-accept threshold, and the most recent Autopilot report
• Album lineage records, which keep an album’s identity stable across rescans. These carry the album title, artist, and source identifier too.

So album names, artist names, and local folder paths do leave your Mac when iCloud Sync is on. Paths appear in more than one place. Your backup folder is one. The others come from the source identifier: for a folder source that identifier is literally the folder’s path, and it is attached to every album record, every lineage record, and the list of sources you have scanned. If you scan a folder, expect its path to be in your iCloud data.

All of it goes to Apple, not to Keynell. Apple’s iCloud terms govern that data, including how it is encrypted; whether it is end to end encrypted depends on your Advanced Data Protection setting, which is yours to control and not something the app sets. Your audio files are never uploaded.

Purchases

Purchases are processed through our payment provider. License keys are delivered via email and activated in the app. No payment information is stored in the app or transmitted to Keynell — all payment processing is handled by the merchant of record.

File Access

Private Press reads audio files to inspect embedded artwork and modifies metadata when you press. Raw audio content is not sent through Identify. Retained pre-write backups are enabled by default and can be configured or disabled in Settings. File changes are staged before replacement; if a write or replacement fails, the app reports the failure and uses its available recovery or backup state.

No Advertising or Third-Party In-App Tracking

This Website

The Private Press marketing website (privatepress.app) separately uses Vercel Web Analytics to measure page views and related website traffic. This website analytics is distinct from the app and from Keynell’s result-side Identify service analytics.

Children's Privacy

Private Press is not directed to children under 13, and Keynell does not knowingly collect personal information from children under 13.

Changes to This Policy

If this policy changes, we'll update the date above. The core commitment won't change: your data stays yours.

Contact

Questions about this policy? Reach us at support@keynell.com.