Privacy Policy

1. Who is responsible

SpotiBooks is an independent hobby project operated by Jan-Luca Barthel. For privacy questions or requests, email spotibooks@jlbarthel.de.

2. Data SpotiBooks processes

• Spotify account data: your immutable Spotify account identifier, username, display name, and an encrypted Spotify refresh token. SpotiBooks does not request your email or Spotify password.
• Library data: albums you identify as audiobooks, associated Spotify metadata and cover URLs, ratings, bookmarks, notes, chapter mappings, descriptions, and display settings.
• Listening data: recently played audiobook tracks, timestamps, listening duration, current position, completion status, and reset history used to calculate progress and private statistics.
• Technical data: a signed session cookie, a temporary OAuth security cookie, theme and sidebar preferences stored in your browser, and ordinary hosting/security logs such as request time, route, IP address, user agent, and error information.

3. Why the data is used

Account, library, and listening data are processed to provide the service you request: sign-in, audiobook progress tracking, resume controls, bookmarks, recommendations, and statistics. Security cookies and limited technical logs are used to protect accounts, diagnose failures, and operate the service reliably.

For users in the EEA, the principal legal basis is performance of the service requested by you (Article 6(1)(b) GDPR). Security and operational logging is based on the legitimate interest in maintaining a secure and reliable service (Article 6(1)(f) GDPR).

4. Services that receive data

• Spotify receives API requests needed for authentication, catalog search, playback control, device discovery, and listening-history synchronization.
• Vercel hosts the web application and may process request and operational logs.
• Neon hosts the PostgreSQL database containing account and application data.
• Open Library, Wikimedia/Wikipedia, Internet Archive, and Audible may receive audiobook title or author search terms when SpotiBooks looks up optional book descriptions or chapters. They do not receive your Spotify account identifier from SpotiBooks.

These providers may process data in countries outside your country of residence under their own privacy terms and applicable transfer safeguards. SpotiBooks does not sell personal data and does not use it for advertising or AI-model training.

5. Cookies and local storage

SpotiBooks uses strictly necessary cookies to keep you signed in and secure Spotify OAuth. Browser storage remembers your theme, sidebar width, install-banner state, and offline app assets. There are no advertising or cross-site analytics cookies.

6. Retention and deletion

Account and listening data is retained while your SpotiBooks account exists. You can permanently delete the account from the account menu. This deletes the user record and associated library, progress, listening events, bookmarks, chapters, settings, and the encrypted refresh token. Short-lived operational logs and provider backups may remain for a limited period according to the hosting providers' retention schedules.

Logging out only removes the local session; it does not delete the account. You can also revoke SpotiBooks in your Spotify account settings. To ensure stored data is deleted as well, use Delete account or contact the address above.

7. Your choices and rights

Depending on applicable law, you may request access, correction, deletion, restriction, objection, or a portable copy of your personal data. You may also complain to your local data-protection authority. Contact the address above to exercise these rights. You may disconnect Spotify at any time through Spotify's connected-app settings.

8. Security and changes

Refresh tokens are encrypted at rest, browser sessions are signed, and production cookies are HTTP-only and secure. No internet service can guarantee absolute security. Material policy changes will be reflected on this page with a revised effective date.