Privacy
What JellyBox knows about you.
Last updated 8 October 2026
JellyBox talks to your Jellyfin, Emby or Navidrome server. Your music, your library and your server login never travel to us. The app needs no account of its own; the one optional account, Jellybox Link, exists only for Continuity and is described below.
Two things leave the app by default: a one-line ping when it starts, and a crash report if it falls over. Both can be switched off in Settings, both are described below, and the whole app is open source if you would rather read the code than take our word for it.
Your server and your music
JellyBox is a client for a Jellyfin, Emby or Navidrome server that you run. When you sign in, your server address, username and password go from your device straight to that server. Everything you browse and play — albums, artists, playlists, artwork, audio — moves between your device and your server only.
None of it is routed through, copied to, or visible to the developer. Downloads you pin for offline listening stay on your device. If you want to know what happens to that data at rest, that is a question about your Jellyfin, Emby or Navidrome server, not about JellyBox.
Jellybox Link and Continuity
Continuity moves playback between your devices and lets them control each other. To do that they need a meeting point, which is a Jellybox Link account run by the developer. It is off until you create an account and sign in to it from Settings, and nothing in this section applies if you never do.
The account is an email address and a password, stored hashed. Each signed-in device registers a name, its platform and, on phones, a push token so that another device can wake it. While you use Continuity the service relays the current queue as a list of your server’s item IDs, the position in the track, and which device is playing. Each device turns those IDs back into songs against your own server.
Jellybox Link never receives audio, artwork, your library, or your Jellyfin, Emby or Navidrome credentials, and it cannot read your server. Nothing from it is shared with third parties. Signing out removes the device’s session and push token; to delete the account itself, use the contact details at the bottom of this page.
Scrobbling
If you connect a ListenBrainz account in Settings, JellyBox sends what you listen to - track, artist, album and when you played it - to ListenBrainz under your own token and their privacy policy. This is off until you connect an account, and disconnecting it stops the submissions and removes the token from the device.
Analytics
JellyBox sends one event, named app-launched, when the app starts. It carries a single property: the name of your operating system (macos, windows, linux, ios or android). That is the entire payload.
It goes to a self-hosted Plausible instance run by the developer at plausible.prodigytech.dev — not to a third-party analytics company. Plausible is cookieless and does not build profiles, follow you between apps and sites, or store your IP address alongside the event. The result is a count: how many times JellyBox was opened, on which platforms.
There is no tracking of what you listen to, search for, or click. No advertising identifiers, no device fingerprint, no session recording. The ping can be turned off under Privacy in Settings.
Crash reports
JellyBox uses Sentry to report crashes and errors, so bugs can be found and fixed. When something goes wrong, Sentry receives a technical report: the error and its stack trace, the app version, and details about the device and OS it happened on. Performance traces are collected alongside these reports.
Sentry’s personally-identifying data collection is not enabled, so reports are not tagged with a username or account. Reports are processed by Sentry as the developer’s data processor, under Sentry’s privacy policy. Crash reporting is on by default and can be turned off under Privacy in Settings.
App stores
If you install JellyBox from the App Store, Google Play or the Microsoft Store, that store handles the download and any purchase or subscription records under its own privacy policy. The developer sees only whatever aggregate figures the store chooses to report — install counts, ratings and the like. Installing the APK or Linux tarball from GitHub Releases instead means GitHub serves the file, under GitHub’s privacy policy.
Changes
If what the app collects changes, this page changes with it and the date at the top moves. Meaningful changes will be noted in the release notes for the version that introduces them.
Contact
Questions, corrections or a request to have something removed: open an issue on GitHub or reach the developer on X.