Back to Live Map

Privacy Policy

Last Updated: October 15, 2026 • Effective Immediately

1. Overview & Commitment

Spotify Map ("we", "our", or "the Service") is an open, real-time spatial music discovery platform. We respect your privacy and believe you should always retain full transparency and control over your personal data and live location.

This policy explains what information is collected when you access Spotify Map, connect your Spotify account, or participate in spatial chat.

2. Data We Collect & Access

  • Spotify Profile & Playback: When you voluntarily connect Spotify via OAuth, we retrieve your Spotify User ID, display name, avatar URL, and currently playing track (title, artist, album art, 30-second preview URL, and Spotify open link).
  • Location Information: With your explicit browser consent, we access geographic coordinates (latitude and longitude) to position your listener icon on the global map. If GPS is unavailable, we use approximate IP geolocation or fall back to a city center. You may disable broadcasting at any time with the "Hidden" toggle.
  • Device Identifier: A randomly generated anonymous device key (stored locally on your device via localStorage) ensures you are represented as a single entity and prevents duplicate icons.
  • Spatial Chat Messages: Text and optional song cards you share in the global or direct chat feed.

3. Ghost Mode (Incognito & Anonymity)

Spotify Map includes a built-in Ghost Mode designed for maximum privacy:

  • Your display name is permanently masked as "Anonymous Listener" on the public map and in live presence feeds.
  • Your personal Spotify profile photo is replaced with a private purple ghost avatar.
  • Chat messages you post while in Ghost Mode are marked with the ghost badge and scrubbed of any identifiable personal data.
  • You can toggle Ghost Mode on or off at any moment in the header bar or chat composer.

4. Spotify Developer Policy Compliance & Data Retention

  • No Long-term Listening Logs: We do NOT create or sell persistent historical logs of your listening habits. Active presence on the map is held in ephemeral in-memory memory and automatically expires after 90 seconds of inactivity.
  • Authentication & Cookies: Spotify OAuth tokens are stored in secure, encrypted HTTP-only session cookies. We never store your Spotify passwords.
  • One-Click Disconnect: Clicking the disconnect icon in the header immediately invalidates session tokens, deletes presence from the map, and severs all API communication with Spotify.

5. Third-Party Integrations

Our service interacts with the following external providers:

  • Spotify AB: For track metadata, album artwork, and user verification.
  • Carto & MapLibre GL: For vector base tiles (Dark Matter and Positron).
  • OpenStreetMap Nominatim: For converting coordinates into human-readable city labels.

6. Your Rights & Data Inquiries

Under GDPR, CCPA, and applicable global privacy laws, you have the right to access, rectify, or request deletion of any data associated with your interaction.

To revoke Spotify Map access directly from your Spotify account, you can visit Spotify App Management at any time. For privacy inquiries or takedown requests, contact [EMAIL_ADDRESS].