Privacy policy · Azzurro 0.1.0 and later · effective 2026-09-28

Privacy.

Azzurro has no account and sends nothing to its developer. It talks to your BluOS players, downloads the cover art they point it at, and keeps a few small files on your computer. This page says exactly what, where and when.

no accountno telemetryno analyticsno crash reportsno update check

In short

The short version.

  • Nothing goes to the developer. Azzurro has no account, no telemetry, no analytics, no crash reporting and no update check.
  • On your computer it keeps a few plain-text files — the addresses of your players, your recent searches, radio stations you added by hand, how you arranged the home screen and, in versions after 0.1.0, a recent track on each player — and a cache of cover art. It never saves the passwords you type into a player's forms, and it writes no log file.
  • On your network it broadcasts a short, fixed query, then talks to your players over plain HTTP, which is not encrypted. What you type for a player — searches, names, and the Wi-Fi keys and music-service passwords in the player's own forms — goes to the player that way.
  • On the internet it does one thing itself: it downloads cover art from the addresses your players give it, usually a streaming service's or a radio station's image server. That server sees your IP address and which picture was asked for. The one exception is a player you add by an address outside your own network, which Azzurro reaches over the internet in the same plain HTTP.
  • Everything else — streaming, browsing and searching a service, signing in to one, firmware updates — is done by the player, under its maker's and the services' own policies.

This page covers Azzurro 0.1.0, the current release, and every version after it. Where later versions behave differently from 0.1.0, it says which does what. It is about the Azzurro app only: the developer tools in its source repository (bluosctl and a stand-in player for tests) are not part of any package.

On your computer

What it keeps.

Azzurro's own code keeps its settings in one directory and a cover-art cache in another, and writes nowhere else. They are ordinary files, not encrypted, with your system's default permissions, so on a computer you share, whether other accounts can read them depends on those defaults.

Settings

  • Linux ~/.config/azzurro/, or $XDG_CONFIG_HOME/azzurro/ if that is set
  • Flatpak ~/.var/app/blue.azzurro.Azzurro/config/azzurro/
  • macOS ~/Library/Application Support/azzurro/
  • Windows %APPDATA%\azzurro\

On Windows, %APPDATA% is the part of your profile that roams, so on a network with roaming profiles these settings can follow you to other computers. The Flatpak is given no access to your files, so there it cannot read or write any of them outside its own directories. On macOS and Windows Azzurro is not sandboxed; that it keeps to these directories is a property of its code, which is public.

The settings are plain text, one entry to a line, and each file is rewritten whole when it changes:

  • players — the address and port of each player Azzurro has found or you added by address, written once the player has answered. Addresses only: no names, models or hardware addresses. At most 256. You can add an address to it by hand.
  • searches — your last eight searches, exactly as typed, newest first; a search longer than 200 characters is not saved. A search is saved when you submit it or open one of its results, not while you type. Clearing your recent searches in the app empties the file. In 0.1.0, a search saved a moment before you clear can occasionally be written after the clear; clearing again empties the file.
  • stations — radio streams you added by hand: the stream's address and the name you gave it, up to 128 of them. The address is kept exactly as you entered it, including a user name and password if it contains them. The list stays here; a station's address goes to a player only when you play it or save it as a preset.
  • screen-order — your Customize Home arrangement, written as the player's own names for its screens and sections.
  • decoded — versions after 0.1.0 only. One line for each player, up to 256: its address, the playback quality it last reported (such as CD, hi-res, MQA or a station's bitrate), its queue and the position in it, the stream's address, the track's title, and the path of the file on the player's side. A player's line is replaced when the player reports a playback quality for another track, or another quality for the same one, so the file amounts to the last track on each player Azzurro has seen that reported one. For a station you added by hand, the stream's address can be the one you typed, including a user name and password if it contains them. 0.1.0 has no such file.

Versions after 0.1.0 save a file by writing a copy beside it (named like players.12345.new) and renaming it into place; if the app is stopped at the wrong moment, that copy can be left behind. 0.1.0 writes the files in place.

Player names, volume, queues, favorites, presets, playlists, alarms and groups are not stored: they live on the player, and Azzurro reads them from it. Azzurro does not store the window's size or position either, and the theme follows your system's. On macOS the system may keep the window's state for the app itself, in ~/Library/Saved Application State/blue.azzurro.Azzurro.savedState.

Cover art

  • Linux ~/.cache/azzurro/artwork/, or $XDG_CACHE_HOME/azzurro/artwork/ if that is set
  • Flatpak ~/.var/app/blue.azzurro.Azzurro/cache/azzurro/artwork/
  • macOS ~/Library/Caches/azzurro/artwork/
  • Windows %LOCALAPPDATA%\azzurro\artwork\

The pictures Azzurro has fetched — covers in the player list, the queue and now playing, and the pictures on browse and search screens — are cached exactly as downloaded, from your players and from image servers on the internet. Each file is named by a hash of its address, so the address itself is not kept, but together the pictures show what has been played and browsed. Only JPEG, PNG and WebP images are kept, up to 8 MiB each. Nothing expires by age: the cache holds at most 512 files and 256 MiB, and the oldest are deleted to stay within that, at startup and after every hundred new covers.

Only in memory

What the players report — what is playing, the queues, the browse screens — and whatever you type into a player's forms (Wi-Fi, sign-in, network shares) is held in memory while Azzurro runs, and Azzurro does not write it to disk, apart from what the files and the cover-art cache above keep. What your operating system may do with the memory of a program that crashes is under Logs, below.

Logs

Azzurro writes no log file. It prints its log to standard output, where you see it if you start the app from a terminal on Linux or macOS. On Windows the app has no console, so its log is discarded unless its output is redirected to a file. Otherwise, a desktop may keep the output of the programs it starts in the system's log.

If Azzurro crashes, it stops and prints the reason to standard error. It sends no crash report. Your operating system's own crash handling may still record the crash — a macOS crash report, Windows Error Reporting, or on Linux a core dump, which can hold whatever was in Azzurro's memory, including what you had typed into a form — and may send a report to the system's maker if you have allowed that.

At the default level the log can include your players' addresses; the address of every page Azzurro opens in your browser; the address of a player's screen that could not be read or an action on it that failed, which for a search includes what you searched for; the names of playlists it could not add to; the start of a player's reply that could not be read or that reported an error; the path of a settings file it had trouble with, which includes your home directory and so usually your user name, and any line of the players file that is not an address; and on Linux the names Azzurro registers for media controls. Passwords are never logged. The RUST_LOG environment variable changes the level.

Removing it all

Deleting the directories above removes everything Azzurro has stored. Uninstalling may leave them in place. winget installs Azzurro as a portable app, and winget uninstall removes the program but not these directories. flatpak uninstall --delete-data blue.azzurro.Azzurro removes the Flatpak's. On macOS, brew uninstall --zap --cask azzurro removes them too, along with the window state macOS may keep. The operating system and the libraries Azzurro is built on, for fonts and graphics for example, may keep caches of their own.

On your network

Finding and talking to players.

Discovery

Azzurro finds players with LSDP, the Lenbrook Service Discovery Protocol that BluOS players answer, on UDP port 11430. It sends one fixed, 11-byte query that asks which players are there, and what it says carries nothing about you or your computer: no name, no hardware address, no identifier. Like any packet, it comes from your computer's address on each network, and every device on those networks can receive it. The query is broadcast on every IPv4 network your computer is connected to, VPN and virtual interfaces included, or to 255.255.255.255 if none qualifies. Discovery does not use IPv6.

It broadcasts only in short sweeps of seven queries over about ten seconds: when it starts, when you ask it to look for players again, and, in versions after 0.1.0, when it has had to reopen its discovery socket after repeated errors. Between sweeps it sends no discovery traffic at all and only listens. Versions after 0.1.0 look up your networks afresh for every sweep. 0.1.0 looks them up once, when it starts: a later sweep still goes to the networks you were on then, even after you have moved to another, and a computer with no network at startup broadcasts to 255.255.255.255 for the rest of the session.

While it runs, Azzurro listens on UDP port 11430, on all IPv4 interfaces, for players announcing themselves. An announcement carries the player's name, model, software version, IP address and a hardware identifier. Announcements for addresses outside your computer's own networks are ignored, and once 256 players are followed, no more are taken from announcements.

Azzurro itself uses no mDNS or Bonjour, SSDP or UPnP, joins no multicast group, and does not scan your network or try addresses it has not been given.

Besides the players that announce themselves, the only players Azzurro contacts are the remembered ones, at startup and only those on a network you are connected to at the time, and any address you type in. That is an IP address, with a port if you like, never a host name, so there is no DNS lookup for a player. An address you type is contacted wherever it is, even outside your local network. Its only other connections are for the cover art players point it at (see The internet). A player can name a picture's host by name as well as by address, and that host can be on your own network as well as on the internet.

Talking to a player

Everything Azzurro says to a player is plain HTTP to the player's own IP address, neither encrypted nor authenticated, because that is how BluOS works. It uses the player's control port (11000 unless the player announces another), port 80 for the player's web pages, and whatever other port on the same address the player sends it to: on the players seen so far, 11001 for settings and 11004 for its library and artwork. For its control, settings and web-page requests, Azzurro refuses to follow a player's redirect to any other host. A request for a picture is the exception: it can be redirected to another host, and Azzurro may follow it (see The internet).

Anyone who can watch the traffic on your network, or anywhere along the way to a player you added from outside it, can read all of it, including what you type for a player.

Requests carry no cookies and no User-Agent. Apart from what HTTP itself requires, a generic Accept header, a Content-Type header on the few requests that send a form or a setting, and a Referer header when the player redirects a request to another of its own ports, the only headers Azzurro adds are two BluOS version numbers and, if the player has sent one, the player's own context value, echoed back to it.

While Azzurro runs, it keeps a request waiting on every player it follows, not only the one you are looking at, so that it hears about changes as they happen; when nothing changes, it asks the player to answer after 100 seconds, and then asks again. If a player stops answering, it tries again, backing off to once every 30 seconds. The selected player's queue and home screen are read as soon as it is selected (at startup, the first player to appear is selected for you) and again when the player reports a change to them. Other screens are read when you open them.

What goes to a player:

  • what you type into the search box, sent as you type (each time you pause for about a quarter of a second, not only when you finish) to the search the player's current screen offers;
  • names you give playlists and presets, and a preset's address and picture;
  • the address of a radio station you added by hand, when you play it or save it as a preset. The player fetches the stream, not Azzurro;
  • alarms you set. Opening a player's alarms and saving one also send your computer's time-zone name (such as Europe/Rome);
  • settings you change;
  • to group players, the address and port of each player joining or leaving, sent to the group's leader;
  • the player's own forms, which Azzurro draws in its window rather than in a browser: joining a Wi-Fi network (the network and its key), signing in to a music service (a user name and password, for example) and adding or removing a network share (the server and its credentials). What you type is held in memory while the form is open, sent to the player's web page on port 80 over plain HTTP, and never saved by Azzurro; the player keeps the resulting login. If Azzurro cannot draw a page, it opens the player's page in your browser instead, and you sign in there.

Firmware checks

Once each time it runs, for each player, Azzurro asks the player — or, if asking the player fails, its group leader, naming the player's address — whether new firmware is available, without waiting to be asked. How the player finds out is up to the player: any connection it makes to its manufacturer for that is its own, and Azzurro takes no part in it. An update starts only once you confirm it. Help → Upgrade Check asks the same question on demand.

On the internet

Cover art.

Apart from a player you add by an address outside your own network, which Azzurro then reaches over the internet in the same plain, unencrypted HTTP, the only internet connections Azzurro makes itself are to download cover art. A player gives each picture as an address: either a path on the player, which Azzurro fetches from the player, or a full web address, usually on a streaming service's or a radio station's image server, which Azzurro fetches from that server directly. There is no fixed list of these servers; the services linked to your player decide them.

That happens for the cover now playing on every player Azzurro follows, since each has a picture in the player list, and for every picture in the queue and on each browse or search screen Azzurro loads, including rows you have not scrolled to. Pictures already in the cache are normally read from it instead. So while Azzurro runs, an image server can see requests that follow the track changes on any of your players, and what you browse and search for.

What an image server receives:

  • your public IP address, unless you use a VPN or a proxy;
  • the time;
  • the picture's address, which identifies the album, track or station it belongs to. The player and the service behind it write that address, not Azzurro;
  • a generic Accept header and nothing Azzurro adds of its own: no cookies, no User-Agent, no identifier;
  • if it is reached by a redirect, the full address that redirected to it, path and query included (with any user name, password or #fragment removed), in a Referer header. That earlier address can be one on your player, with its local IP address. Azzurro follows at most four redirects for a picture, and leaves the header off when going from an https address to an http one.

The server's name is looked up through your system's DNS resolver (which, for a name ending in .local, may ask your local network by mDNS) and is visible to anyone watching the connection. Pictures at an http:// address travel unencrypted.

HTTPS certificates are checked against your operating system's trusted certificates. On Windows and macOS the operating system makes the check, and it may go online to do so, for example to check whether the certificate has been revoked or to fetch a certificate missing from the chain. On Linux the check is made offline.

Azzurro honors the HTTP_PROXY, HTTPS_PROXY and ALL_PROXY environment variables, or their lower-case forms. HTTP_PROXY, or else ALL_PROXY, carries http:// requests, which include every request to a player; HTTPS_PROXY, or else ALL_PROXY, carries https:// ones. NO_PROXY exempts addresses from both. Proxy settings made only in macOS or Windows system settings, or in a Linux desktop's, are not used.

Apart from cover art and a player you add from outside your network, Azzurro makes no internet connection of its own. It never contacts streaming services, radio directories or the maker of your player directly, beyond downloading pictures at the addresses a player gives it.

On your desktop

Other programs on your computer.

Your browser

Azzurro opens a page in your browser only when you press something that asks for one: Help → Azzurro on the web, which is this site; a track's Info link, an address the player supplies, often on someone else's site; links on the player's own screens; and the player's own pages that Azzurro does not draw itself, such as its diagnostics or a sign-in page it cannot draw. From then on your browser, not Azzurro, connects to that site.

Versions after 0.1.0 open only http and https addresses, and a player's settings pages only if they are on the player itself. 0.1.0 passes whatever address a player names to your system to open, of any kind.

Media controls, on Linux

On Linux, each player Azzurro follows appears to your desktop as a media player (MPRIS), so media keys and the desktop's media controls work. That publishes on your desktop session's message bus the player's name, what it is playing (title, artist, album, length and a cover), whether it is playing, and its position, volume, shuffle and repeat. Any program in your desktop session can read these, and can play, pause, stop, skip, seek, or change the volume, shuffle or repeat, as with any media player on Linux. Azzurro itself sends none of this off your computer, but a program that reads it may: the desktop may download the cover itself, and a tool that links your phone to your computer may show what is playing on the phone.

Versions after 0.1.0 give the desktop the copy in Azzurro's cache when there is one, as a file path that includes your home directory, and otherwise only an address Azzurro would download from itself. 0.1.0 gives it the cover's original address, on the player or on an image server.

On macOS and Windows Azzurro publishes nothing to the system's Now Playing or media controls.

Clipboard and accessibility

Azzurro never reads or writes the clipboard on its own. Text fields support copy, cut and paste, and that includes a password field: copying or cutting from one puts the real password on your clipboard, where a clipboard manager may keep it. On Linux, selecting text in a field with the mouse also puts it in the primary selection, as in most Linux programs, password fields included.

Like any accessible application, Azzurro makes the contents of its window, text included, available to assistive technology such as screen readers, through your system's accessibility interface. A password field is marked as one, but what is typed in it is handed to that interface unmasked, so software that reads the window through it can read the password while the field holds it.

Permissions

What it asks the system for.

  • Flatpak: network access, which discovery needs and which covers your local network and the internet alike; the display and graphics; and its own names for media controls. No access to your files, and none to sound.
  • macOS: Local Network access, with the reason “Azzurro looks for BluOS players on your network.” Discovery and connections to players on your local network need it.
  • Windows: the firewall may ask whether to allow Azzurro, because it listens for players on UDP port 11430.

It asks for no microphone, camera, location or contacts, and it plays no sound itself.

Not at all

What it does not do.

  • No Azzurro account, and no sign-in of its own to anything. The only sign-ins are the player's own forms, described above.
  • No telemetry, analytics or usage statistics, and no crash reports of its own. Nothing is sent to the developer.
  • No update check for itself. To update, use your package manager or download a new release.
  • No saved sign-ins: Azzurro writes nothing typed into a player's form to disk or to a keychain.
  • No direct contact with streaming services, radio directories or the maker of your player, beyond downloading pictures at the addresses a player gives it.
  • No mDNS, SSDP or UPnP of its own, no network scanning, and nothing listening on the network except the discovery socket on UDP port 11430.
  • No fonts, icons or other parts of the interface fetched from anywhere: they ship inside the app.
  • No other program started by Azzurro's own code, except your system's opener for the pages described above (in 0.1.0, whatever program your system uses for the kind of address a player names). On Linux under Wayland, when the desktop leaves window borders to the app (GNOME, for example), the windowing library Azzurro uses runs dbus-send, gsettings and fc-match to read your light or dark setting, button layout and title-bar font.

The player

Your player is its own computer.

A BluOS player runs its maker's software and makes its own connections. When you stream, browse or search a service, play a radio station, sign in to a music service or check for firmware, Azzurro asks the player, and the player contacts those services itself, under its own settings. What it sends them and what they keep is governed by the player maker's and the services' own privacy policies, not by this one. Azzurro cannot see those connections.

This site

azzurro.blue.

This site is a set of static pages hosted on GitHub Pages. GitHub, as the host, receives every visitor's request, including their IP address, and its own privacy statement covers that. The site loads nothing from anyone else — its fonts, styles, script and images all come from azzurro.blue — and it has no analytics, no embeds and no cookies.

If you use the light and dark switch, your choice is kept in your browser's local storage, under azzurro-theme, and stays there. The copy buttons on the front page put a command on your clipboard when you press one. Links to GitHub and to jz.bz are ordinary links.

The downloads are hosted on GitHub, and winget and Homebrew download from there; installing the Flatpak bundle may have Flatpak download the runtime it needs from Flathub. GitHub, the package managers and Flathub have their own privacy policies.

Contact

Questions, and changes.

Open an issue at github.com/jzbz/azzurro/issues. Issues are public, so leave out anything you would rather keep to yourself. If this page is wrong about what Azzurro does, that is a bug; please report it.

Effective 2026-09-28, for Azzurro 0.1.0 and later. When a release changes anything described here, this page changes with it, and so does the date.