Privacy Policy

Last updated: June 18, 2026

Kwalify (“we”, “us”) helps you build Spotify playlists from songs you have already liked. This policy explains what we collect and why when you use kwalify.net.

What we collect

• Spotify account info — display name, email, country, and Spotify user ID when you sign in with Spotify.
• Your liked songs — track metadata from your Spotify Liked Songs library (titles, artists, albums, audio features, and related data Spotify provides).
• Playlists you create — prompts you enter, generated track lists, and optional Spotify playlist links we create on your behalf.
• Session data — a signed cookie so you stay logged in, plus OAuth tokens stored server-side to call Spotify on your behalf.
• Feedback — if you submit our feedback form or in-app feedback, we receive what you choose to send.
• Technical logs — standard server logs (IP address, request path, errors) for security and reliability.

What we do not collect

• We do not read your full Spotify listening history beyond what is needed to sync your Liked Songs.
• We do not sell your personal data.
• We do not use third-party advertising trackers on the site.

How we use your data

• Authenticate you with Spotify and keep your session active.
• Sync and score your liked songs to generate playlists from your prompts.
• Save playlists in your Kwalify gallery and create private playlists in Spotify when you request it.
• Improve reliability, prevent abuse, and fix bugs.

Sharing and third parties

• Spotify — we call Spotify’s API using your authorization. Spotify’s use of your data is governed by Spotify’s Privacy Policy.
• Hosting — the app and database run on Render. Data is stored in PostgreSQL in the region configured for your deployment.
• Feedback forms — optional feedback may be collected via Google Forms; Google’s terms apply to that submission.
• Share links — if you open or share a playlist link (e.g. /p/abc123…), anyone with that link can view that playlist’s name, prompt, and track list. Links use unguessable tokens and are not listed publicly.

Retention

We keep your liked-song cache, saved playlists, and session data while your account is active. You may disconnect Spotify at any time; contact us if you want account data deleted.

Security

Sessions use HTTP-only cookies. In production, cookies are marked Secure and traffic is served over HTTPS. OAuth tokens are stored server-side, not in the browser.

Your choices

• Revoke Kwalify’s access anytime in your Spotify account apps settings.
• Log out of Kwalify from the app.
• Delete your data in-app: Account menu → Delete my data (while signed in).
• Request deletion by emailing us via the feedback form (see Contact).

Children

Kwalify is not directed at children under 13. We do not knowingly collect data from children.

Changes

We may update this policy. The “Last updated” date at the top will change when we do.

Contact

Questions or deletion requests: use the feedback form or open an issue on our GitHub repository.