Privacy Policy
Effective 7 October 2026
- We never read or receive your prompts, code, file names or any other work content.
- You can listen without an account; what the player learns about you then stays on your device.
- No advertising, no selling of data, no cross-site tracking. Usage statistics are anonymous and can be turned off.
- Signed in, your listening history is synced to your account by default. You can turn it off, export it or delete it.
- You can export all your data, or delete your account, at any time.
1. Who we are
escape.fm (the website and its web player, the coding-agent plugins, the iPhone app with its Apple Watch app and widgets, the Mac app, the Apple TV app and the Apple Vision Pro app) is run by ILLUSION Tech Limited, a company registered in Hong Kong ("we"). For anything about privacy, write to hello@escape.fm.
2. What we collect and why
On your device
The player keeps on your device, in the browser's local storage or the app's storage, what it needs to choose music for you: your taste, recent listening history, tracks you have heard, moments you kept, the plugin's pairing key, and a debug log if you turn one on. None of it is uploaded unless you sign in with listening history on. Clearing this site's data, or deleting the app, removes it.
When your device reaches our servers, your IP address passes through Cloudflare. We keep no access logs and use IP addresses only to limit abuse, keeping them for that at most a day.
Each track plays from an address our server signs, which stops working after a few hours. To stop the library being downloaded in bulk, we count which tracks were asked for each day: by your account, or signed out by a random id the player makes for itself and by your network address (sealed so it cannot be read back, and deleted after its day). The counts by account or id are deleted after 7 days.
Your account
If you sign in, we keep:
- Email address, to sign you in and send sign-in codes.
- Apple, Google or GitHub sign-in, if you use it: the account id, email address (which may be Apple's private relay address), and name and avatar where given. We ask only for basic profile information, keep none of the provider's tokens and read nothing else there. We act on Apple's notices, such as when you stop using Sign in with Apple for escape.fm.
- Sign-in sessions: when each began and expires, and the IP address and browser at sign-in, to keep you signed in safely.
- Signing in on a TV: while a TV's sign-in code waits for you to confirm it, the name the TV gives itself (such as "Living Room"), so we can ask whether to sign in on that TV. It is kept with the code and goes with it. The same goes for roughly where the TV asked from (the city and country Cloudflare gives for its network address, never the address itself), which we show you so you can tell whether it is a TV in front of you.
- Account details: your plan, the name you choose to show, the mark you picked or drew, and the last day you were active.
- Linked devices: each computer you link, with its name (the name your computer goes by, or the browser and system it was linked from), when it was linked and last reported, and which coding agents (such as Claude Code, Codex or Cursor) have reported from it and when. Nothing else from those reports is kept with it. The Mac app adds its Mac's name and whether someone is using it, has stepped away or put it to sleep, and since when, so we notify you only when you are away and the music can end the day with you; it never says what you do on it.
- Notifications, if you allow them in the iPhone app: the push token Apple gives your phone and the phone's language, used only to tell you an agent is waiting or that we have replied to your letter. A notification names only the agent and the computer, or says a reply has come; never anything of your work.
- Letters to escape.fm, if you write to us from your page: what you write and our replies, and, unless you turn it off before sending, the app's version, the system, the device model and the language, shown to you as they will be sent. Only our team reads them.
- App Store purchases, if you buy Plus in the app: for each subscription, the identifiers Apple gives it, which plan it is, until when it is paid, whether it was refunded, and whether it is yours or shared with you by your family, as Apple signs it; and a random token that ties your purchases to your escape.fm account. Apple's App Store Server Notifications tell us of renewals and refunds. We never see how you paid; Apple does.
The coding-agent plugins
The plugins for Claude Code, Codex, Cursor, Gemini CLI, Copilot CLI, Qwen Code, Droid, CodeBuddy, WorkBuddy, Muse Code and OpenClaw run on your computer. When a task's state changes they send us only: an anonymous tag that tells your open tasks apart, the kind of work (such as "debugging"), the agent's state (you are typing, it is running, it is waiting for you, or idle), the time, and which plugin and version sent it. They also report whether each of the agent's actions succeeded or failed, and how many actions of each kind it took (edits, commands, test runs, searches, commits), never what the action was.
The kind of work is worked out on your computer, and what you type never leaves it; of a tool's result the plugins look only at whether it succeeded. To tell a test run or a commit, they look at a shell command on your computer; it never leaves it. They do not read file names or paths. We keep only each task's latest state, deleted when the task ends or goes quiet for 30 minutes, and when your work last stopped, so the music can follow your work.
Cloud agents
If you link a cloud agent such as Muse, ChatGPT or Grok, it tells us only whether it is working for you, waiting for you or done, and which agent it is; never anything about the task. You can unlink it on your page at any time.
Listening history and moments
Once you sign in, listening history is on by default and synced to your account. Recorded only while music plays, it holds what played, when and for how long, how it ended, where you were (such as "evening"), how often you pressed the heart and on which kind of player (web, phone, Mac or TV), whether it was raining or snowing (in the apps, with the weather on), and the kind of work and the agent's state at the time; daily summaries made from it; the tracks you have heard, so none is played to you twice; and the moments you kept with the heart (the track, the time and the scene, such as "evening", never your mood). With it on, our server also keeps the kind of work and the agent's state through the day from your plugins' reports, even with no player open: the state names and times only, never any content. From the same reports it keeps when each agent worked, when you wrote to one (never what), and how many actions of each kind it took, and from cloud agents when they worked, for your time with AI and what your agents did. It keeps your time-zone offset, to place records on the right day, never your location.
It holds no prompts, code, file names or other device information. It is used for the daily poster, a future annual report and choosing music for you. Turned off, uploads stop at once, nothing recorded meanwhile is uploaded later, and the heart keeps nothing.
The daily poster and its link are made on your device and hold only the date, times and counts, nothing that identifies you. Sharing them is up to you; once shared, the platform you shared them on handles them.
Lines of code, tokens and cost, only if you turn them on
Two counts are off until you turn them on, on your page. Lines of code: the plugins count, with git on your computer, the lines added and removed and the commits made in the agent's folder, and send only those numbers. Tokens and cost: where an agent shows them on your computer, the plugins send only those numbers. Never file names, commit messages, code or anything said. Turn either off and nothing more is sent or kept; what was kept stays with your listening history until you delete it.
On your phone
The iPhone app keeps the same kinds of data as the player, and records listening behind the lock screen too. To fit the music to what you are doing, it reads these signals on the phone only, never sending them to us (those that need permission, only once allowed):
- Motion & Fitness: whether you are still, walking or running, and your pace.
- Health, if you turn on "Mood, from Health": the mood you logged recently and last night's sleep. Your mood is never shown, stored by us or sent anywhere.
- Focus, if you add escape.fm to one: which Focus is on, such as Sleep.
- The phone's state (no permission needed): where the sound plays (headphones, AirPlay or a car, read from the audio device's name), and whether the phone is locked, charging or lying still.
What leaves the phone is described elsewhere here: listening history, usage statistics, the push token, and whether the app is on screen or you are asleep, working out or running, so we do not notify you then.
Approximate location: sun, moon and weather
To show the sun and moon where you are, our server uses the approximate, city-level location Cloudflare derives from your IP address. It is used only for that answer and is not stored, logged or passed on; the player never asks your browser for your location.
In the iPhone and Mac apps, if you allow location while using the app, the device's approximate location (to about 10 km) is sent to Apple's WeatherKit, and nowhere else, to show the weather. Our servers never receive it, and the app does not store it. Turn it off with "The weather outside" on "your page", or in Settings.
Usage statistics
The player and the apps send anonymous counts of which features are used and of errors, with the browser and system family and the country Cloudflare reports. They carry no account, email, IP address, pairing key or work content; the only identifier is a random one replaced every day, so days cannot be linked. At the end of each track we add to anonymous counts of how that track was received (how it ended, roughly how much was heard, the scene, kind of work, time of day and kind of player), kept by day for about 13 months and never tied to a person. Plugins send nothing extra; we count, without an identifier, which ones were used each day. Nothing is sent with Global Privacy Control on, and "Turn off usage statistics" in the account panel or on "your page" stops it.
The website also uses Cloudflare Web Analytics, which counts visits and page speed without cookies, without identifying you and without tracking you across sites.
Cookies
One cookie keeps you signed in; Google or GitHub sign-in briefly uses another, against forgery. Both are necessary; there are none for statistics or advertising.
What we do not collect
Prompts, conversations, code, files or other work content; precise location; contacts; advertising identifiers.
3. Legal bases
- Contract: to provide the service you use, from sign-in and the plugins to listening history and notifications.
- Consent: the phone's Motion, Health, Focus, location and notification permissions, which you can withdraw in Settings at any time.
- Legitimate interests: anonymous statistics to improve escape.fm, and keeping it secure and free of abuse. You can object, and turn statistics off.
- Legal obligations, where the law requires us to keep or disclose something.
We do not sell your information, use it for advertising, or use it to train models.
4. Who processes it for us
- Cloudflare: hosting, the database and storage, audio delivery, sign-in emails and website analytics.
- Apple: Sign in with Apple, push notifications, App Store purchases and their notifications and, in the apps, WeatherKit.
- Google and GitHub: sign-in, if you choose them.
Sign-in providers handle your sign-in under their own privacy policies. Beyond these, we give your information to no one unless the law requires it.
5. International transfers
Our providers run global networks, so your data may be processed outside your country or region, under the contractual safeguards they offer.
6. How long we keep it
| What | How long |
|---|---|
| Task states and action outcomes from the plugins | Until the task ends, or 30 minutes without a report |
| Sign-in codes (a TV's with its name and roughly where it is) and sign-in hand-overs to the app | 10 minutes at most |
| Sign-in sessions | Until you sign out, or 7 days unused |
| What your devices are playing | Until shortly after your last device disconnects |
| Account, linked devices, when your work last stopped | Until you delete them, or your account |
| Push token | Until you sign out on that phone, turn its notifications off or delete your account |
| Letters to escape.fm and our replies | Until you delete your account |
| App Store purchases | Until you delete your account (Apple keeps its own record; a subscription is cancelled in the App Store) |
| Which tracks were asked for (by account, or by the player's random id) | 7 days; by network address, sealed, only for its day |
| Listening history and moments in your account, and your agents' work, actions and the counts you turned on | 13 months (a very large history is trimmed sooner, oldest first) |
| Daily summaries and tracks heard | Until you delete your listening history, or your account |
| Usage statistics | 3 months |
| Data on your device | Recent listening history for up to 13 months; the rest until you clear this site's data, delete your history or delete the app. Moments move to your account when you sign in with history on. |
7. Your rights
You may access, export, correct or delete your information, withdraw consent, or object to how we use it. Most of this is in the app:
- Export: "Export" in the account panel gives you a file with everything we keep about your account.
- Delete listening history: deletes it from our servers and this device at once and for good. Copies on other devices stay until cleared there, but are never uploaded again.
- Delete your account: deletes everything on our servers related to it, at once and for good, and ends Sign in with Apple for escape.fm.
- Unlink a device: in the account panel.
- Turn things off: listening history and usage statistics with their switches; the plugin by uninstalling it or setting
ESCAPE_FM_DISABLE=1; phone permissions in Settings.
For anything else, including correction, write to hello@escape.fm. You can also complain to a data protection regulator, such as the Privacy Commissioner for Personal Data in Hong Kong, or the one where you live.
8. Security
Everything is encrypted in transit. Accounts have no passwords, and plugin keys and sign-in codes are stored in a form that cannot be read back. No method is perfectly secure; if a security incident affects you, we will tell you promptly.
9. Children
escape.fm is for people aged 16 and over. If you believe a child has given us personal information, contact us and we will delete it.
10. Changes to this policy
When this policy changes we update this page and its effective date. If a change widens what we collect, we will announce it prominently on the website before it takes effect.
11. Contact
ILLUSION Tech Limited, Hong Kong, hello@escape.fm.
This policy is written in English and translated into other languages. If a translation differs from the English, the English version prevails.