PRIVACY
Your data is for your artifact, not a profile business.
StatWrapped has no user accounts. Provider data is processed only to build the result you request, with different handling for Spotify and public-profile sources.
Last updated:
Data processed by source
Spotify.When you choose Connect Spotify, your browser goes through Spotify's OAuth flow. StatWrapped's server exchanges the returned code, stores tokens only in Secure, HttpOnly cookies in your browser, and calls Spotify's API from the server only for affinity-ranked top tracks and artists. Spotify responses are not cached across users.
Last.fm, Trakt, and Steam. You provide a public username, SteamID64, or vanity name. The server uses it to request public provider data and normalize the result. These identifiers are user-provided data even when the underlying profile is public. Normalized responses may be cached for up to 15 minutes to protect provider quotas; StatWrapped does not create a persistent profile from them.
Apple Music. StatWrapped does not currently connect directly to Apple Music. Listening already scrobbled into a public Last.fm profile can appear only through the Last.fm source.
Spotify cookies and retention
The one-time PKCE verifier and OAuth state cookies expire after about 10 minutes. The access-token and expiry cookies last only for Spotify's token lifetime, normally about one hour. If Spotify supplies a refresh token, its cookie can remain for up to 30 days so you do not have to reconnect on every visit.
Authentication cookies are Secure, HttpOnly, SameSite=Lax, and scoped to this site. HttpOnly prevents page scripts from reading token values. Choosing Disconnect Spotify clears the access, expiry, refresh, PKCE, and state cookies. Disconnecting here does not itself revoke Spotify's authorization grant; the separate Spotify revocation link is explained on the data and permissions page.
Exports and reconstructable links
PNG rendering and text-summary download happen in your browser. StatWrapped does not upload an export merely because you preview or download it.
A reconstructable link is created only after an explicit share action and preview. The server validates and encrypts the allowlisted display fields, then returns ciphertext after the URL's # fragment. Browsers do not send that fragment in the initial page request. To open the result, the viewer sends the ciphertext to a private, no-store decode endpoint; the server decrypts and validates it, then returns only the approved display fields. No result record is saved. Links expire after the chosen period, never more than 30 days, but a stateless link cannot be manually revoked after copies have been distributed.
Analytics, logs, and data we exclude
StatWrapped uses Vercel-hosted aggregate web analytics and ordinary hosting security logs to understand page performance and reliability. Product events use a fixed allowlist. We do not deliberately send Spotify tokens, raw provider payloads, full public-source usernames, profile images, email addresses, or artifact freeform text to analytics.
Safe error categories and provider timing may be recorded without response bodies or credentials. Hosting infrastructure can process technical request information such as IP address, user agent, requested path, and timestamps for delivery, abuse prevention, and security.
Your choices
- Use the demo without connecting a provider or entering a public identifier.
- Export locally without creating a reconstructable link.
- Disconnect Spotify from the studio and separately revoke access in Spotify.
- Do not submit a public profile identifier you are not entitled to use.
- Ask a privacy question at privacy@statwrapped.com.
Providers and changes
Provider API calls are also governed by Spotify, Last.fm, Trakt, Steam, and their infrastructure providers. StatWrapped is independent from those services. This notice may change when the product's data handling changes; the date above identifies the current version.