TuneSummary is a free, open source website run by Engin Gedik (gedik.tech) that shows listening statistics from the data export Spotify gives you. This page says what we store, why, and how to get rid of it. It's written to be read.

What we store

• Your email address, to sign you in, to send reminder emails if you ask for them, and, if you link Last.fm, a few emails about that connection (see below).
• Your plays from the streaming history files you upload: time, how long you played, track, artist and album name (or podcast episode and show), Spotify track ID, whether it was skipped or on shuffle, the device type Spotify recorded (for example "android" or "Windows 10"), and the country code.
• If you link Last.fm (optional): your Last.fm username and the plays we import from your public Last.fm listening history (time, track, artist, album). We don't get your Last.fm password; if you sign in through Last.fm we keep only the confirmed username, not a session key.
• Account basics: when you signed up and last signed in, when you uploaded, your reminder setting, and your plan (free or supporter).
• A sign-in cookie (ts_session) that keeps you signed in for up to 90 days. We store only a hash of it. During a Google or Last.fm sign-in we also set a short-lived (15 minute) security cookie. That's all.

What we don't store

Your zip file is opened in your browser. Only the streaming history is sent; the other files in Spotify's export (account details, IP addresses Spotify logged, search queries, inferences, payment information) never leave your device. We never see your Spotify password and never connect to your Spotify account. If you link Last.fm, we read your listening history from Last.fm's public API using your username, until you unlink it. We don't record IP addresses with your account; our web server keeps standard access logs (IP, time, page) for up to 14 days for security, and short-lived rate-limit counters.

How we use it

Only to show you your statistics and to run the service. To label genres, artist names (not your plays, not your email) are looked up on MusicBrainz, and the result is cached for everyone. For the song previews in your recap, song and artist names are looked up on Deezer (or Apple's iTunes search) by our server, which also fetches the audio, so those services never see your IP address. We count page views and sign-ups on our own server, without cookies or identifiers. There are no third-party analytics or tracking scripts.

We don't sell, rent or share your data. Email is sent through Resend, so Resend handles the messages we send you.

Ads

TuneSummary may show one ad slot to keep it free. If ads are switched on, the ad provider (Google AdSense) may set its own cookies and use them as described in Google's ad policy; ads never get your listening data or email address. Supporters see no ads.

Emails

We send sign-in links when you ask for them, and reminder emails only if you tick the reminder box (at most two per request). If you link Last.fm, we also email you when Last.fm stops receiving your Spotify plays (at most twice per stop) and shortly before Spotify's roughly 180-day connection to Last.fm is due to expire; turn these off under "Last.fm reminders" on your account page. Every reminder has a one-click stop link. No newsletters, no marketing.

Your control

• Download everything we store about you as JSON from your account page.
• Delete your plays, or your whole account and everything in it, from the same page. Deletion is immediate. Copies in our encrypted nightly server backups expire within 7 months.
• Questions or requests: engin@gedik.tech.

Where it's kept

On a server in Oregon, USA (OVH), with encrypted backups. Data is kept until you delete it. Accounts with no sign-in for 2 years may be deleted.

Children

TuneSummary isn't meant for children under 13.

Changes

If this policy changes in a way that matters, we'll say so on this page and, for big changes, by email.

TuneSummary is not affiliated with, endorsed by or sponsored by Spotify. Spotify is a trademark of Spotify AB.