Privacy
Your listening data never leaves your device.
That is the narrow, testable claim. The zip Spotify sends you is read inside this browser tab, and nothing in that file is transmitted to any server. You can check it yourself.
Alpha 1.0, last updated 17 September 2026.
Verify it in under two minutes
Open DevTools, go to Network, drop your file in, and confirm no outbound request carries your data. The full walkthrough is further down this page.
F12, or ⌥⌘I
What the claim covers
What the claim covers
- The Spotify zip you drop into the upload area
- Every JSON play record parsed from that file
- The statistics computed from those records
- Any share card you export as an image
What it does not cover
What the claim does not cover
- Album art lookups, which send an artist and album name to Deezer
- The team status chips, which expose your IP to Lanyard, the Discord CDN and the GitHub avatar CDN
- Google AdSense, which funds the site and is not needed to make it work
- A visit count from Cloudflare Web Analytics, with no cookie, which you can turn off below
- Browser storage that your own device controls
Six third parties are the entire list, and each is named below. None receives anything about how much you listened.
Third parties
Named, not hidden
Every third party that receives a request when you use this site, named and explained. There are six.
-
01
Deezer
api.deezer.com
What it receives
An artist name and an album name, for the albums currently on your screen, so it can return a cover image, or an artist name alone for an artist picture. Never a play count, a timestamp or a total. Deezer may set its own cookie (
dzr_uniq_id) on those requests.How to verify
Network tab, filter “deezer”. You can turn artwork off entirely in settings.
-
02
Lanyard
api.lanyard.rest
What it receives
Nothing about you. It is a public read endpoint that reports whether the two developers are online on Discord, for the contact chips. Like any request, it sees your IP.
How to verify
Network tab, filter “lanyard”. Blocking it only makes the chip show GitHub instead.
-
03
Discord CDN
cdn.discordapp.com
What it receives
Serves the avatar images for those same two chips. Static files only. Like any image host it sees your IP when the picture loads.
How to verify
Network tab, filter “discordapp”. No listening data is attached to the request.
-
04
GitHub avatars
avatars.githubusercontent.com
What it receives
Serves the developers’ profile pictures, which is what the chips show before Lanyard answers and what they keep showing if it never does. Static files only. Like any image host it sees your IP when the picture loads.
How to verify
Network tab, filter “githubusercontent”. It loads on every page, not only when Discord is unavailable.
-
05
Google AdSense
pagead2.googlesyndication.com, googleads.g.doubleclick.net, ep1 and ep2.adtrafficquality.google, www.google.com
What it receives
The advertising script loads on every page and, like any third party script, sees your IP and the address of the page you are on. It never receives your listening data, because that never leaves the tab for anyone. Personalised advertising in the UK and EEA is gated behind a consent choice you make before any ad is requested.
How to verify
Network tab, filter “google”. One entry is not enough here: the advertising script pulls from several Google hosts, and all of them are listed above because counting it as one line would have been the convenient answer rather than the true one. Filter “Streaming_History” at the same time and you will still get nothing.
-
06
Cloudflare Web Analytics
static.cloudflareinsights.com, and quilore.com/cdn-cgi/rum, which Cloudflare answers
What it receives
A count of the visit: the page address with anything after a
?or#removed, where you came from, your browser and device type, and how fast the page loaded. It sets no cookie, and like any request it sees your IP. We use it only to know how many people visit and which pages they read.How to verify, or turn it off
Network tab, filter “cloudflareinsights” for the script and “cdn-cgi/rum” for the count.
Step by step verification
Step by step verification
1
Open DevTools
Press F12 on Windows or Linux, or ⌥⌘I on a Mac, then click the Network tab.
2
Clear and reload
Clear the request list and reload the page, so you see every request made on load.
3
Upload your file
Drop your Spotify zip onto the upload area and watch the list as parsing runs. No new domain should appear.
4
Filter and confirm
Type your name, or “Streaming_History”, into the filter. Zero results. The file stayed in the tab.
Everything that leaves this page
The whole trace
- Deezer artist and album name
- Lanyard nothing, it is a read
- Discord CDN two avatar images
- GitHub avatars two profile pictures
- Google AdSense your IP and the page address
- Cloudflare Web Analytics a visit count, unless you turn it off
- Your listening data never sent, to anyone
What stays on your device
What stays on your device
Your file is read into memory and turned into statistics. It is not copied to disk or stored, and closing or refreshing the tab discards everything, which is why you upload again each visit.
- Your light or dark theme choice
- The album-art cache, so a cover is not fetched twice
- Whether you dismissed the ad-blocker notice this session
None of it identifies you, and none of it is sent to us. There is no server that could receive it.
Advertising
Advertising
This site is funded by advertising rather than by charging you or gating any statistic.
The ad script is fetched from Google on every page, today, before any ad is shown, so Google sees your IP address and the page you are on. Requests for an ad are paused until you have made a consent choice. Once ads are live, the ad network may also set its own cookies.
It is sent nothing from your Spotify file. The ad script runs inside the page, so that is not something the design rules out on its own: it is something we check, by reading a file and searching every request Google receives for the names in it.
Questions?
Anything about privacy goes to Emberfig, who make Quilore.