PlaylistXfer Privacy Policy

Last updated: July 22, 2026

What this app does

PlaylistXfer reads a public Spotify playlist or song link, previews the source, searches Apple Music for matches, and writes to Apple Music only after you authorize access.

Information we process

We process the Spotify playlist or song URL you submit, public metadata, track metadata, match results, review decisions, an anonymous browser or app session id, and Apple Music authorization needed to create the destination playlist.

The iOS app keeps up to 30 recent transfer snapshots locally on the device so you can reopen a report or refresh its matches. This local history is protected by iOS file protection, is not uploaded as history, can be deleted one item at a time or cleared entirely, and never retries an Apple Music write automatically.

We also log minimal operational events such as native app opens, input source (for example manual entry, the in-app clipboard button, or the Share Sheet), preview success or failure, match-analysis success or failure, Apple Music connection results, playlist-creation and update results, duplicate-prevention counts, manual-match corrections, local-history actions, and aggregate Apple MetricKit diagnostic counts. To improve matching, a correction may include Spotify and Apple Music catalog identifiers, the algorithm's confidence and reason, and which result was chosen. Duplicate checks compare Apple Music catalog identifiers and ISRCs on the device; we log only aggregate added/skipped counts, not the Apple Music playlist contents. We do not log the free-form Apple Music search text or the contents of saved transfer history. These events use a hashed anonymous session id and safe counts; they do not include MetricKit stack traces and are not intended to store Apple Music tokens, emails, or full Spotify URLs.

Analytics

The PlaylistXfer website may use Google Analytics to understand aggregate site traffic, referral sources, page views, and high-level product funnel events. The native iOS app does not include the Google Analytics advertising SDK; it sends limited first-party reliability events to the PlaylistXfer API. Product events are limited to safe aggregate fields such as counts, durations, match status, and error category. They are not intended to include Apple Music tokens, emails, full Spotify URLs, or raw authorization payloads.

Advertising

The PlaylistXfer website may use Google AdSense on substantive editorial guide pages. Advertising is not placed in the Spotify URL form, authorization, progress, match review, playlist creation, error, contact, or legal-policy screens. Google may process cookies, device information, IP address, and ad interaction data according to its own policies. Advertising is not included in the native iOS 1.0 app. Where required, visitors will be offered consent choices before personalized advertising is used.

Apple Music access

Apple Music access is requested only when you create a playlist or add a song. The web flow transmits the Music User Token only for the authorized write flow and does not store it in the transfer database. The native iOS app uses MusicKit authorization on the device and does not store the user's MusicKit token in the PlaylistXfer database.

Storage and retention

Transfer reports are stored temporarily so you can refresh and continue a review. Anonymous transfer records expire after about seven days, while in-progress jobs expire sooner. Expired records are removed during normal service maintenance.

Third-party services

The app depends on Spotify public link surfaces, Apple Music/MusicKit, Cloudflare hosting, Cloudflare D1 storage, and Google Analytics when analytics is enabled. Render hosting and Supabase storage may be used only as fallback infrastructure. Those services may process requests according to their own policies.

What we do not do

We do not sell personal data. We do not ask for Spotify login in the current MVP. We do not intentionally store your Apple Music user token long term.

Support requests

If you use the support form, we store the topic, message, submission time, and any optional reply email you provide so we can investigate and respond. Support requests are retained for up to 180 days. Do not include passwords, tokens, cookies, or private playlist links.

Contact

For privacy questions or support, use the PlaylistXfer contact page or email [email protected].