Privacy Policy

Last updated: April 12, 2026

1. Introduction

Your privacy matters to us. This Privacy Policy explains what information Stade collects, how we use it, and how we protect it. By using Stade, you agree to the practices described in this policy.

2. Information We Collect

2.1 Spotify Account Data

When you sign in with Spotify, we access your public profile information (display name, profile picture) and your playlists (including Liked Songs) through Spotify's OAuth 2.0 API. We do not store your Spotify password.

2.2 YouTube Account Data

When you connect your YouTube account, we access your channel information to create playlists and add videos on your behalf. We only use the permissions necessary for playlist transfer functionality.

2.3 Transfer & Download History

We store records of your playlist transfers and downloads, including playlist names, track counts, timestamps, and status. This data is used to display your transfer history within the app.

2.4 Linked Account Information

We store the association between your Spotify and YouTube accounts on our self-hosted server to enable seamless transfers between platforms.

3. How We Use Your Information

We use the collected information solely to:

  • Authenticate your Spotify and YouTube accounts.
  • Read your Spotify playlists and liked songs.
  • Search for matching tracks and download them as MP3 files.
  • Create and populate playlists on your YouTube account.
  • Display your transfer history and account status.
  • Improve the performance and reliability of the application.

4. Data Storage & Security

All account and transfer data is stored on a self-hosted private server (VDS) — we do not use Firebase, AWS, Google Cloud, or any third-party cloud database. Our server is protected with:

  • HTTPS encryption (Let's Encrypt) for all data in transit.
  • API key authentication for all backend requests.
  • Rate limiting and Helmet security headers.
  • PostgreSQL database with restricted access.

5. Third-Party Services

Stade connects to the following third-party services:

We do not sell, rent, or share your data with any other third parties.

6. Data Retention

Your account data and transfer history are retained as long as your account is active. You can request deletion of your data at any time by contacting us. Upon request, we will permanently delete all associated data from our servers within 30 days.

7. Your Rights

You have the right to:

  • Access the personal data we hold about you.
  • Request correction of inaccurate data.
  • Request deletion of your data.
  • Revoke Spotify or YouTube access at any time through their respective account settings.

8. Children's Privacy

Stade is not intended for use by children under the age of 13. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us so we can delete it.

9. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last updated" date. Continued use of Stade after changes constitutes acceptance of the revised policy.

10. Contact

If you have any questions or concerns about this Privacy Policy, please contact us at contact@stade.dev.