Your music, your data.

Playlist Converter is an experimental playlist converter and learning project. Real connections are limited by Spotify and Google application access. The local simulated mode uses fictional accounts and playlists. This page describes the service at playlist-converter.jfs-cloud.com, operated by Jordão Frazão.

What the application stores

When you connect a service, the application stores its account or channel identifier, display name, and OAuth access and refresh tokens. Tokens are encrypted on the server using a deployment-managed key. The application does not ask for your Spotify or Google password.

Conversions store playlist metadata, song identifiers, candidate matches, your review choices, progress, and the destination playlist link. It uses Spotify and YouTube APIs to read your owned source playlist, search for matches, and create a new private destination. It does not download or upload audio.

Your browser session

An HTTP-only session cookie identifies your saved connections and conversions. A conversion identifier is also stored in browser local storage to restore the selected job. There is no separate Playlist Converter login or cross-device recovery. Clearing cookies or letting the session expire removes your ability to access that session's saved work.

Retention and deletion

Sessions expire after seven days of inactivity. Conversion records are scheduled for cleanup after seven days. Expired session owners and their credentials are removed by periodic server cleanup. Stored provider data and backups may remain until cleanup or backup expiration completes.

Use “Clear my data” in the converter to cancel work and remove your local session records and stored credentials. Disconnecting a provider cancels active work and removes its stored connection. You can also revoke access in your Spotify or Google account settings. These actions do not delete destination playlists already created in your music accounts.

Service providers and hosting

Spotify and Google receive the authorized API requests needed for conversion and process them under their own policies. The service runs on a server operated by the maintainer.

Logs and traffic statistics

There are no advertisements, analytics scripts, or tracking cookies. The web server records each request: time, page path without its query string, response status, browser user agent, and your IP address shortened to its network prefix (/24 for IPv4, /48 for IPv6). Cookies, referrers, and authorization headers are not recorded. These records are kept for up to 14 days and are used for security and aggregate traffic statistics visible only to the operator.

The application logs conversion progress as status codes and counts, and failed account connections as the service name and an error code. It does not log playlist names, songs, links, or account identities.

Backups

The database is backed up daily on the same server and each copy is deleted after seven days. Data removed from the service can therefore remain in a backup for up to seven more days.

Contact

Questions and requests go through the project's GitHub issues. Issues are public, so do not include personal data, account details, or tokens. You do not need to contact anyone to delete your data: use “Clear my data” or revoke access in your Spotify or Google account. Report security vulnerabilities privately through GitHub security advisories.

Matching limitations

Not every recording exists on both services. Ambiguous matches require your review. Matching accuracy has not been independently measured; completed conversion does not guarantee recording identity.

Return to the converter to manage your connections and data.