diskos/docs/PRIVACY.md

diskOS privacy and network disclosure

This lists everything the installer and the diskOS UI (mq_ui) send over the network. The UI ships as a binary-only component (source not yet published), so this is a good-faith disclosure based on the code and observed behaviour, not a guarantee; it will be tightened when the UI source is published.

The installer (this repo)

• ./install.sh uses pip to upgrade pip itself and download two packages - pyusb and pycryptodome - from PyPI into a local .venv. That pip/PyPI traffic is the only network activity in setup. Point pip at your own mirror if you prefer, or pre-install the packages offline.
• The installer app itself makes no network requests. Building the image, decrypting/extracting your firmware, saving the recovery image, and flashing over USB are all fully local. It does not phone home and sends no telemetry.

The diskOS UI (mq_ui) on the device

diskOS is a local music player. The online features below reach out only when you use them; each request unavoidably reveals your device's public IP to the service it contacts.

Feature	Endpoint	Protocol	What is sent
Weather	wttr.in	plain HTTP	A location string if you set one, else nothing - wttr.in then auto-geolocates you by IP (approximate). Over HTTP, so treat it as visible on your network.
Lyrics	lrclib.net	HTTPS	The current track's title and artist, to find matching lyrics.
Scrobbling (Last.fm)	ws.audioscrobbler.com	HTTPS	If enabled and connected: the tracks you play (artist/title/album/timestamp) are reported to your Last.fm account.
Last.fm sign-in	www.last.fm/api/auth/	HTTPS	Only a QR code containing the approval URL is shown; your phone, not the device, opens it. www.last.fm/api/account/create is shown as text so you know where to get an API key.

Last.fm credential setup happens over your LOCAL network in plaintext

To connect Last.fm, diskOS runs a temporary web server on the device at http://<device-wifi-ip>:8080/<random-token>/, shows a QR for it, and your phone posts your Last.fm API key and shared secret to it. Important properties:

• It is plain HTTP on your Wi-Fi LAN - your API key/secret cross your local network unencrypted. Do this on a network you trust.
• The server is transient (runs only during setup), bound to the Wi-Fi interface, and gated by a random URL token.
• Your Last.fm API key, secret, and session key are then stored on the device under /usr/data (device config); offline scrobbles are queued in /usr/data/lastfm.queue until they can be sent. Nothing Last.fm-related is sent anywhere except your device, your phone (during setup), and Last.fm.

Last.fm is BETA and unverified end-to-end - see the README's Known Issues. The transport and signing are tested, but a full connect-and-scrobble round-trip to a live account has not been.

The stock FiiO player still runs alongside diskOS

diskOS replaces only the UI; FiiO's original player process still runs underneath it. That stock component - not diskOS - is responsible for any Bluetooth, firmware-update checks, and LAN media endpoints (DLNA/AirPlay/Roon/QPlay-style discovery) the device may present on your local network. Those behaviours are inherited from the stock firmware and are outside diskOS's code.

What diskOS does NOT do

• No analytics, telemetry, or usage tracking.
• It does not upload your music library, your listening history (beyond Last.fm scrobbles if you turn them on), or any personal files.
• If you never enable weather, lyrics, or Last.fm, diskOS itself makes no outbound requests.

Reporting

Report anything that looks like unexpected data leaving the device via the process in SECURITY.md.