Account
Security and privacy
Playlistation never sees your Spotify password. You sign in on Spotify's own site, Spotify shows you the permissions being asked for and hands Playlistation a token limited to those.
The privacy policy is the binding text
This page explains in plain words how Playlistation handles your data. The only binding text is the privacy policy, published in English and French. If this page and the policy ever disagree, the policy is what counts.
Signing in with Spotify
Spotify shows a consent screen listing what Playlistation will be able to do, the first time you sign in; later sign-ins usually go straight back without it. Accept, and Spotify sends you back to the app signed in. Refuse, and nothing is created. Free and Premium Spotify accounts both work.
The permissions asked for
Six permissions, and why each one is needed:
- user-library-read: read your Liked Songs. This is the whole product; every smart playlist is built from them.
- playlist-modify-public and playlist-modify-private: create playlists and add or remove their tracks, whether the playlist is public or private.
- playlist-read-private: see your private playlists, so Playlistation can read the playlists it created when they are private, notice when you have deleted one on Spotify, and back up the private playlists you own.
- user-read-private: your profile details. Playlistation keeps only the country from it, which decides whether you pay in euros or US dollars; your display name and avatar come with the profile without this permission.
- user-read-email: your email address, used for the emails about your Spotify connection and your subscription, for Stripe invoices if you subscribe, and as the address you write from to exercise your rights.
Playlistation does not ask to change your Liked Songs, control playback, read your listening history or upload images.
What is private playlist data, and why does Playlistation ask for it?
Private playlist data means the playlists on your Spotify account that are not public: the ones you set to private and the private ones you follow. The permission for it is playlist-read-private, which Spotify's consent screen words as access to your private playlists. Without it, an app sees only your public playlists.
Playlistation needs it because the playlists it creates are private, so without this permission it could not see its own playlists. It also uses it to notice when you delete one of them on Spotify (see When you delete a playlist in Spotify) and to back up the playlists you own. It only ever changes the playlists it created.
Can Playlistation unlike songs or change my Liked Songs?
No. It asks Spotify for read access to your Liked Songs (user-library-read) and not for the permission that changes them, so Spotify refuses any edit to them. The only things Playlistation writes are the playlists it created.
Does Playlistation see what I listen to?
No. It does not ask for your listening history, your top tracks or control of playback, so Spotify never sends it what you played. It cannot tell which songs you play most.
What is stored
On your account: your Spotify profile details (id, display name, email, avatar, country), your interface language, your plan, your subscription record (never card details), the billing currency and country, the terms version you accepted, your Spotify tokens, your sessions, and where your signup came from when you arrived from playlistation.com.
Belonging to your account: your smart playlists, with their filters, match results and history, the playlists suggested to you, any language reports you filed, and your library backups (track ids and playlist details, no audio). We erase them with your account.
Shared with every user: a catalogue of the tracks Playlistation has seen, copied from Spotify. It is not a record of who liked what and is not tied to your account.
Never stored: your Spotify password, your card number, your IP address, or the audio itself.
The website uses your IP address to show your country's prices and to count visitors, without a cookie, without storing it and without sending it to anyone. We keep only totals. See Plans and billing.
Sessions
Signing in creates a session, one per device. It expires after 30 days without use, and in any case 75 days after it was created. You can end it yourself at any time from Devices in Settings: either that one device, or every device but the one you are on. Deleting your account ends them all. Disconnecting the app from Spotify does not, so Playlistation can tell you what happened.
Where it is hosted
The API, its database, the website and the app run on a server rented from OVH in Roubaix, France. We back up the database on that server and on the administrator's encrypted computer, and we delete backups after six months.
Third parties
- Spotify is where your library and playlists live. Covers, avatars and previews load from its servers; its player on the filter pages loads only after you accept cookies.
- Stripe handles payment. Stripe keeps invoices, as accounting law requires. See Plans and billing.
- Resend delivers the service emails (Spotify connection, subscription, withdrawal) and the optional emails (new features, recaps), which you get only if you ask for them. See Staying connected to Spotify.
- Featurebase provides the feedback portal, the roadmap, the changelog and the in-app chat. The chat loads only after you accept cookies. Product-update emails are opt-in, from the changelog page.
- PostHog (EU servers) provides usage statistics: in your browser only after you accept cookies, and from our servers without a cookie, never with your email.
- Sentry provides error reports. After you accept cookies, an error in the app also comes with a replay of the moments before it, with text, images and input hidden.
- Cloudflare (United States) hosts our AI language detection and OpenAI (Ireland) backs it up. They receive music details, nothing about you.
Nothing is sold to anyone, and Playlistation itself uses no advertising tracker.
Revoking access from Spotify
You can cut Playlistation off from Spotify's side at any time on Spotify's Manage apps page. Playlistation can no longer update your playlists, so they show Error, and the app asks you to reconnect Spotify. The playlists stay on Spotify and your account stays until you delete it. Reconnecting restores everything.
Your rights
To access, correct or erase your data, write to dpo@playlistation.com from the email address of your Spotify account. Erasing does not need an email: Deleting your account does it from the app.