Privacy

This app connects to your Spotify account with your permission and processes your library to produce a score. Here's exactly what happens to your data.

Spotify data

Scoring runs in your browser. We read your liked songs, top tracks, recently played, and artist metadata only to compute scores and (if you ask) create playlists. We do not store your raw library on our servers.

Authentication

We use Spotify's Authorization Code + PKCE flow. Your Spotify access token stays in memory in your browser. Your refresh token is stored in a secure, HttpOnly cookie that JavaScript cannot read, used only to renew your session. Log out to clear it.

Telemetry

To operate and improve the app we send structured usage telemetry to our analytics backend (Splunk). This includes app events (logins, scans, errors), performance metrics, and the computed per-song scores and tiers. Telemetry events are enriched server-side with coarse geo (country/region from Cloudflare), a one-way hashed form of your IP address (never the raw IP), and your user agent. We never log your tokens.

Cookies

One functional cookie (the HttpOnly refresh-token cookie) is used for authentication. No advertising or third-party tracking cookies are used.

Your choices

Don't want telemetry tied to a session? Use the demo mode without logging in, or simply don't log in. Logging out clears your session cookie.

This page describes the reference deployment. If you self-host, your own configuration governs what is collected.