SPOTISTATS
Last updated 22 October 2026

Privacy Policy

The short version

Spotistats reads your Spotify account and music so it can show your stats and back up your playlists. Listening history is only stored if you opt in, and you can delete everything from your account page at any time. Spotistats never sees your Spotify password.

What we collect

  • Your Spotify profile. When you sign in with Spotify, we read your user id, display name, email, follower count and avatar so the app can show who is signed in.
  • Your listening history (opt-in). If you turn on listening stats, the server stores the recently played tracks Spotify returns — track, artists, album, timestamp and the context it played from — so your stats can build a history Spotify does not keep.
  • Your library, read on demand. Top tracks, saved albums and playlists are fetched directly from Spotify in your browser to render the page and to export. They are not stored on the server.
  • Product analytics. We record anonymous usage events (such as which buttons are pressed) and error reports with PostHog. Playlist names and track names are not sent.

Where it is stored

Your Spotify access token lives in your browser's localStorage and is sent with your Spotify requests. Listening history that you opt into is stored server-side in Cloudflare D1, alongside the refresh token needed to sync it.

Cookies

Spotistats sets no tracking cookies. The listening-stats sign-in flow sets a single short-lived, HTTP-only spotify_stats_state cookie to protect the OAuth callback against cross-site requests.

How long we keep it

Listening stats are kept while you have them enabled. Sync pauses automatically after six months without opening the dashboard. You can turn sync off or delete every stored listen from your account page; deletion is immediate and permanent.

Third parties

  • Spotify provides the account and music data through its Web API.
  • Cloudflare hosts the site and stores opted-in listening history in D1, with queues and cron for the sync.
  • PostHog receives the product events and error reports described above, through a first-party proxy.

Your controls

You can export everything Spotistats stores for your account as JSON or CSV, stop syncing, or delete all stored data. All three are on the account page and none of them require contacting us.

Contact

Questions about this policy, or a data request? Open an issue on GitHub.