Duet and your data

Last updated 22 October 2026

In short: Duet has no accounts and no servers of its own. Music goes directly between the phones in a session, encrypted, and is deleted when it ends.

What Duet collects

Nothing. There are no accounts, analytics, advertising or crash reporting.

Finding each other

To connect over the internet, phones exchange connection details through a free public relay (HiveMQ’s MQTT broker, over TLS). Everything sent there is sealed with a key made from your six words, so the relay only ever sees unreadable data under a random name. Music never passes through it. On the same Wi-Fi no relay is used.

Your music

The host sends songs directly to the other phones over an encrypted WebRTC connection. They’re checked when they arrive, kept only for the session, and deleted when it ends.

YouTube

YouTube videos play in YouTube’s own embedded player and stream from YouTube, so YouTube’s privacy policy applies to that playback.

Playing along with other apps

If you turn it on, Duet reads which song another music app is playing, through Android’s notification access, so everyone can be lined up. It reads nothing else.

Permissions

What Duet asks Android for, and why:

Permission	Why
Internet & network state	To connect the phones in a session.
Wi-Fi multicast	To find sessions on the same Wi-Fi without the internet.
Music & audio	To list the songs on your phone so you can add them.
Camera	Only to scan a session’s QR code.
Microphone	Only if you use “Sync by ear”, which listens for a few ticks to line up a speaker. Nothing is recorded or sent.
Notifications & media playback	To keep playing with the screen off, with lock-screen controls.

Children

Duet isn't aimed at children and collects nothing from anyone.

Changes

If this policy changes, the new version is published here and in the app's source repository, where every change can be seen.

Contact

Questions or concerns: open an issue at github.com/PremPoddar/Duet/issues, or email prem.poddar77@gmail.com.