Skip to content
SWSTATWRAPPED
Open navigation

DATA & PERMISSIONS

What each source supplies — and what it does not.

Every artifact is bounded by a provider contract. This page explains the access method, processed fields, truthful metric, and retention rule for each source.

Last updated:

Source contracts

Spotify

ACCESS
OAuth with the read-only user-top-read permission; calls run on the StatWrapped server.
PROCESSED DATA
Top tracks, top artists, track lengths, and Spotify's order for the selected approximate window.
METRIC LIMIT
Affinity rank only. No per-track streams, play count, accumulated listening time, or lifetime history.
RETENTION
Tokens stay in Secure, HttpOnly browser cookies. Spotify payloads are not shared across users or kept in the public-source cache.

Last.fm

ACCESS
A public username; no Last.fm authorization grant.
PROCESSED DATA
Top tracks and artists plus the playcount Last.fm returns for the selected provider period.
METRIC LIMIT
Plays are the primary metric. StatWrapped does not sum each unique track length and call that listening time.
RETENTION
Normalized results may be cached for up to 15 minutes; no persistent StatWrapped profile is created.

Trakt

ACCESS
A public Trakt username; no Trakt authorization grant.
PROCESSED DATA
Watched films or shows, per-item plays, and watched film or episode counts where Trakt returns them.
METRIC LIMIT
Watches and watched-item counts only. StatWrapped does not infer total runtime from incomplete duration data.
RETENTION
Normalized results may be cached for up to 15 minutes; private profiles are not accessible.

Steam

ACCESS
A SteamID64 or vanity name; profile and game details must be public.
PROCESSED DATA
Profile display name, public owned games, and Steam's recent or time-on-record playtime minutes.
METRIC LIMIT
Hours are converted directly from provider-supplied minutes. They are not session counts or active-day estimates.
RETENTION
Normalized results may be cached for up to 15 minutes; no persistent StatWrapped profile is created.

CONNECTION CONTROL

Disconnect Spotify completely

  1. STEP 01 · THIS BROWSER

    Clear StatWrapped's cookies

    Use Disconnect Spotify in the studio. It sends a POST request that expires the access, refresh, expiry, PKCE, and state cookies, then updates the studio to its disconnected state.

    Open the studio

  2. STEP 02 · SPOTIFY

    Revoke the authorization grant

    Removing cookies stops this browser from using them. To revoke the grant itself, open Spotify's Manage apps page and remove StatWrapped. Spotify controls that account-level setting.

    Manage apps at Spotify

Local export and opt-in sharing

Previewing and downloading an artifact does not publish it. PNG and text exports are produced locally in your browser.

If you explicitly create a reconstructable link, the preview shows the allowlisted display fields first. The server validates and encrypts those fields into ciphertext stored in the URL fragment after #. The fragment is not sent in the initial page request; the result viewer later sends the ciphertext to a private, no-store endpoint for server-side decryption and validation. No provider token, raw response, email, or hidden profile field is allowed, and no result record is stored. Links expire after 1 to 30 days. There is no manual revocation switch for a stateless link already copied by someone else.

Report a data or security concern

Email security@statwrapped.com. Do not include access tokens, refresh tokens, provider response bodies, or another person's private data. The machine-readable contact is available at /.well-known/security.txt.