Privacy policy

Playlist Sorter is a tool for reordering Spotify playlists you own. This page describes exactly what it stores, why it needs to, and how to get rid of it.

What we store

When you connect with Spotify, we keep a record containing:

• Your Spotify user ID
• Your display name, email address, and profile image URL
• The permissions you granted, and when you last signed in
• An encrypted Spotify credential (a refresh token) that lets Playlist Sorter reorder your playlists on your behalf

That credential is what makes the service work without asking you to sign in again every hour, and it is what will allow a playlist to be kept in order on a schedule. It is encrypted before it is written down, using a key held separately from the database, so a copy of the database alone is not enough to use it.

What we do not store

• Your playlists, or any track in them
• Your listening history or top tracks
• Your Spotify password, which this app never sees

What we ask Spotify for

• playlist-read-private and playlist-read-collaborative — to show you the playlists you own
• playlist-modify-public and playlist-modify-private — to change the order of a playlist
• user-read-email — provides your account email address

We are straight with you about the last one: nothing in the service uses your email address today. It is requested so that features which would need it — such as telling you when a scheduled sort fails — do not require everyone to go through consent a second time. We will not send you marketing email off the back of it. If that ever changes, it will be something you separately and explicitly opt into, never a condition of signing in.

What we never do

• Change which tracks are in your playlist — only their order
• Alter the Date Added on any track
• Touch a playlist you do not own
• Reorder anything you did not ask us to
• Sell, share, or transfer your information to anyone
• Add you to a mailing list because you signed in

How long we keep it

Your record is kept until you delete it. Deleting your account removes it immediately — not after a retention window. All that remains afterwards is a dated marker containing a one-way hash, which records that a deletion happened without saying anything about who you were.

Getting your data

Your account page has a Download a copy of your data link, which returns everything we hold about you as a file. The encrypted Spotify credential is excluded — it is a live key to your account, and putting it in your Downloads folder would make you less safe rather than better informed.

Deleting your data

Two steps, and the second is the one people miss:

• Delete your account from your account page. This erases our record, including the stored credential, straight away.
• Revoke access at Spotify. Remove Playlist Sorter from your Spotify apps page. Deleting your account here does not withdraw the permission you gave Spotify — only this does.

Others involved

• Spotify — every playlist operation goes to Spotify’s API, under their privacy policy.
• MongoDB Atlas — stores the account record described above.
• Vercel — hosts the site and keeps standard server logs (IP address, timestamp, requested page) for operational purposes.

There are no advertising or tracking scripts on this site.

Your rights

Depending on where you live, you may have the right to access, correct, export, or delete your information, and to object to how it is used. Export and deletion are both available directly from your account page without needing to ask. Anything else can go to the address on the about page.

Changes

If what we store meaningfully changes, this page is updated before the change goes live, and the date at the top will tell you when.