What the catalog knows, and what it never will

Last updated October 3, 2026. Applies to the catalog server at melorynt.com used by the Melorynt desktop app.

What the catalog server stores

• File identifiers. The stable unique_id Telegram assigns to an audio file, together with its size, MIME type and duration. These identify a file, not a person.
• Metadata. Title, artist, album, year and genre as contributed by apps that have sharing turned on, plus the vote each contributing device cast for each field.
• Music bot searches. For a track found through a Telegram music bot, the bot’s username and the search text that returns it — the artist and title of a public chart row. The server never contacts bots itself.
• Public links. The public channel username and post number where a file was seen. Only public channels are ever referenced; private chats and groups are never sent.
• Device record. A random device identifier created when the app first connects, the app version string, when it was last seen, and a hashed access key. The identifier is not linked to your Telegram account, phone number or name.
• Request receipts. A short-lived hash of write requests so that a retried request is not applied twice. Deleted after 7 days.

What it never receives

• Audio files or any part of them.
• Your Telegram user id, phone number, contacts, or session.
• Names or identifiers of private chats, groups, or channels.
• Telegram file_id values, which are bound to an account.
• Listening history. The current version of the catalog does not collect listening statistics at all.

IP addresses are used only for short-lived rate-limiting counters that expire within an hour, and are not written to logs.

Sharing is optional

Reading the catalog (looking up metadata and fallback links) and contributing to it are separate settings in the app. Nothing is contributed unless you turn sharing on, and contributions only ever describe files from public channels.

Your device identifier

The app registers an anonymous device on first connection. You can reset it at any time from the app settings: the app forgets its key, registers a fresh device, and the old identifier stops being used. Votes cast by the old identifier remain in the catalog as anonymous votes.

Several devices of one person

If you turn on library sync between your devices, they share a random anonymous owner key and send it along with contributions. The server stores only a hash of that key, so that your laptop and your PC count as one person: one vote per file and one shared daily contribution limit. The key is not derived from and not linked to your Telegram account, phone number or name, it is never returned by the API, and turning sync off stops sending it.

Public charts

Charts are built on the server from public sources — the Apple Music and Deezer chart feeds, YouTube’s popular music videos and Spotify’s daily charts as published on kworb.net. The app asks the server for a chart without sending anything about you or your library.

Retention

• Metadata, votes and public links are kept while the file remains in the catalog.
• Reports that a link no longer works: 90 days.
• Records of accepted contributions (a hash of each, for auditing): 180 days.
• Request receipts: 7 days.

Removal requests

If you own a channel or hold the rights to a recording and want it out of the catalog, email admin@melorynt.com with the post link (https://t.me/<channel>/<post>) or the file identifier. Removed entries are deleted, and future contributions for that file or channel are rejected.

Changes

This page will be updated if the catalog starts storing anything new, such as opt-in listening statistics. The app will ask before any new kind of data is shared.