What Spotinyl stores
Spotinyl writes five values, and only these five. They are listed here under the exact keys the extension uses, so you can inspect them yourself.
| Key | What it holds | Why |
|---|---|---|
| clientId | The Client ID of the Spotify app you created | Identifies your app when authorizing |
| tokens | Your Spotify access token, refresh token, expiry and granted scope | Keeps you signed in without re-authorizing on every use |
| lastDeviceId | The identifier Spotify gave the device you last played on | Lets Play wake that device after it drops off Spotify Connect |
| lastTrack | Title, artist, album, artwork URL and length of the last track seen | Keeps the record on the deck when a phone goes quiet |
| lastProgressMs | How far into that track playback had reached | Holds the tonearm where the track was paused |
Spotinyl does not store your Spotify email address, display name, profile, playlists, library or listening history.
Where it is stored
All five values live in chrome.storage.local, the extension's private
storage area inside your browser profile on the device you are using.
Spotinyl deliberately does not use chrome.storage.sync, so none of it is
copied to your other devices or uploaded to your Google account. It is never
transmitted to the developer, because there is nowhere to transmit it to.
What it sends, and where
Spotinyl can reach exactly two hosts, both of them Spotify's:
-
accounts.spotify.com— to authorize you and to exchange and refresh tokens. -
api.spotify.com— to read what is currently playing, and to send play, pause, skip, volume and device-transfer commands when you press a control.
These are the only two entries in the extension's host permissions, so the browser itself prevents Spotinyl from contacting anywhere else. Your use of Spotify remains subject to Spotify's own privacy policy.
Spotify permissions
Authorization requests two scopes:
-
user-read-playback-state— to see the current track, playback position, volume and active device. -
user-modify-playback-state— to act on the popup's controls.
Nothing else is requested. Spotinyl cannot read your email, your profile, your saved library, your playlists or your listening history, because it never asks Spotify for permission to.
What it never does
- No analytics, telemetry, crash reporting or usage tracking.
- No advertising, and no advertising identifiers.
- No third-party services, SDKs or CDNs — the fonts and code ship inside the extension.
- No selling or transferring your data; there is no recipient and no backend.
- No remotely hosted code. Everything that runs was reviewed as part of the package.
- No reading or altering the pages you browse. Spotinyl has no content scripts.
Your own Spotify app
Spotinyl asks you to create your own Spotify app and paste its Client ID. Your authorization is therefore between you and Spotify directly, and no credential of the developer's sits in the middle of it.
Sign-in uses the PKCE authorization flow, which needs no client secret. Spotinyl never asks for one, and never sees your Spotify password — you type that on Spotify's own page.
Keeping and deleting data
Nothing is kept on a schedule; the five values simply persist until you remove them. You are in control of all of them:
- Sign out, on the extension's options page, deletes your tokens. Your Client ID and the last track seen are left in place so you can sign back in without setting Spotinyl up again.
- Uninstalling the extension removes its entire storage area, all five values included.
- Revoking access at spotify.com/account/apps invalidates the tokens from Spotify's side, whatever this extension holds.
Children
Spotinyl is not directed at children and collects nothing from anyone. Spotify's own terms govern who may hold a Spotify account.
Changes to this policy
If a future version of Spotinyl handles data differently, this policy will be updated before that version is published, and the effective date above will change with it. The policy lives in the extension's own repository, so it is versioned alongside the code it describes.
Contact
Questions about this policy, or about what Spotinyl does with anything, can go to jbecker4536@gmail.com, or be raised as an issue at github.com/JBecker131/Spotinyl.