Privacy Policy

Spotier is an independent project operated by Amr Sabbagh. It is not affiliated with, endorsed by, or sponsored by Spotify AB. For privacy questions, email support@spotier.online.

We collect only what the product needs to work:

• Spotify account basics. When you sign in with Spotify we receive your Spotify user ID, display name, email address, profile image, and profile URL.
• Spotify access tokens. Stored so we can fetch your saved albums, playlists, top artists and search results while you build a list. Tokens are never shown to other users and are never included in your data export.
• Content you create. Tier lists, tier names and colours, the albums you place in them, list titles and descriptions, likes, and comments.
• Settings. Your privacy toggles and whether your account is on the free or Pro plan.
• Billing identifiers. If you upgrade, we store the Lemon Squeezy customer and subscription IDs so we can open your billing portal. We never receive or store your card details.
• Basic request data. Server logs and in-memory rate-limit counters use your IP address to stop abuse. These are transient and are not linked to your profile.

• Payment card numbers, bank details, or billing addresses — those go directly to Lemon Squeezy.
• Your Spotify password. Sign-in happens on Spotify's own domain via OAuth.
• Advertising identifiers, cross-site trackers, or third-party analytics profiles.
• Your listening history beyond what you explicitly load into a tier list.

Where the UK GDPR and EU GDPR apply, we rely on: contract — we cannot give you an account or save your lists without this data; and legitimate interests — keeping the service secure, preventing abuse, and fixing faults. We do not rely on consent for tracking, because we do not track you.

We use a small number of processors, each doing one job:

• Spotify — authentication and album/artist data.
• Vercel — application hosting and edge delivery.
• Our database host — stores the PostgreSQL database behind the app.
• Lemon Squeezy — payments, invoices and subscription management for Pro.

We do not sell personal data, and we do not share it for advertising. We may disclose data if legally required to do so.

A tier list marked public is visible to anyone with the link, appears in Explore, and may be indexed by search engines along with your display name and profile image. Lists marked private are visible only to you. You can change a list's visibility at any time, and you can hide your whole profile from your account settings. Search engines may keep a cached copy for some time after you make something private.

Spotier sets a single essential cookie: your sign-in session token. It is required to keep you logged in and is removed when you sign out or delete your account. There are no advertising or analytics cookies, which is why you are not asked to accept a cookie banner.

Your account data is kept while your account exists. When you delete your account, the account record and everything attached to it — tier lists, tiers, albums, likes, comments, Spotify tokens and sessions — are deleted from the live database immediately. Encrypted infrastructure backups may retain copies for up to 30 days before rotating out. Payment records held by Lemon Squeezy are kept as long as their own tax and accounting obligations require.

You can exercise most of these yourself, right now:

• Access and portability. Download your data as a JSON file covering your profile, lists, likes and comments.
• Erasure. Delete your account from your account settings. This is immediate and cannot be undone.
• Rectification. Your name and photo come from Spotify — change them there and they update here. List content is editable in the builder.
• Restriction and objection. Email support@spotier.online and we will respond within 30 days.
• Withdraw Spotify access. Revoke Spotier at any time from your Spotify apps page.

If you are in the UK or EEA and think we have handled your data badly, you can complain to your national data protection authority.

Spotier is not directed at children under 13, and Spotify's own terms set a minimum age for its service. If you believe a child has created an account, email support@spotier.online and we will remove it.

Our providers operate globally, so your data may be processed outside your country, including in the United States. Where required, transfers rely on the processors' Standard Contractual Clauses or equivalent safeguards.

If we make a material change we will update the date at the top of this page and, for significant changes, show a notice in the app before it takes effect.