Privacy

Last updated: September 8, 2026.

Data stored

• Account email, username, display name, password hash, role, and invite metadata.
• A mapping between an Athion account and its Prime/Jellyfin account.
• Short-lived authentication, password-reset, security, and operational logs.

Athion Music app

Athion Music is a player for the media library on an Athion server. When you use it, the server stores:

• Your playback position and listening history for music and audiobooks, so you can resume across devices.
• If you connect Spotify: an access token for your Spotify account, used only to show your own playlists, saved albums, top artists, recently played, and followed artists inside the app. Spotify data is read on demand and cached briefly; it is never sold, shared, or used for advertising. Disconnect at any time from the app's Home screen, which deletes the token.
• If you connect ListenBrainz: your ListenBrainz user token, used to read the playlists and recommendations ListenBrainz generates for you. Disconnect at any time from Settings.
• Library requests you file (the title requested, when, and by whom), so the server operator can act on them.

Without Spotify or ListenBrainz connected, recommendations are computed from what you play in the app. The app collects no location, contacts, photos, or advertising identifiers, and contains no third-party analytics or advertising SDKs.

Use

Data is used to authenticate accounts, operate private services, recover accounts, and investigate abuse or outages.

Processors

Cloudflare carries public traffic, Resend delivers account email, Jellyfin and Audiobookshelf provide media sessions, and Spotify and ListenBrainz are contacted only when you connect them. Athion does not sell account data or use it for advertising.

Retention

Account records remain while an account is active. Reset tokens expire after one hour. Operational logs and backups are retained only as needed to run and recover the services.

Requests

For access, correction, or deletion requests, email privacy@athion.me. Account deletion removes the account record, its media-session mappings, listening history, and any connected-service tokens within 30 days.