Privacy Policy

Last updated: September 2026 • Effective immediately

1. Introduction & Overview

Demagify (“we”, “us”, or “our”) is an independent transparency tool that audits Spotify music playlists against verified public records of political engagement. We are built on a strict foundation of data minimization: we do not sell your data, do not build personal advertising profiles, do not track you across other websites, and do not store your Spotify listening history in permanent databases.

This Privacy Policy explains how our application accesses, processes, and protects your information when you use our website at demagify.com.

2. Information We Access via the Spotify Web API

Demagify operates as a third-party client utilizing Spotify’s official Web API via OAuth 2.0 Authorization Code Flow. When you explicitly choose to connect your Spotify account, we request access only to the following minimal scopes:

playlist-read-private / playlist-read-collaborative: Allows Demagify to read the titles, descriptions, and track listings of playlists you select to audit.
user-library-read: Allows Demagify to read your saved songs if you choose to audit your “Liked Songs” collection.
user-read-private: Allows Demagify to check your account country code to ensure accurate local track catalog resolution.
Optional playlist modification (playlist-modify-public / playlist-modify-private): Only requested if you explicitly choose to export or create a cleaned copy of a playlist with flagged artists removed.

What we never access: We never receive, view, or store your Spotify account password, email credentials, credit card details, payment methods, or billing address. All authentication occurs securely on Spotify’s official login servers.

3. How We Process and Use Information

We process information strictly to provide the core functionality of Demagify:

Deterministic In-Memory Audit: When you run an audit, the artist names from your selected playlist are checked in-memory against our database of verified public records. This process runs deterministically and does not retain your playlist items.
Zero Artificial Intelligence Model Training: Your playlists, liked songs, listening habits, and metadata are never fed into or used to train artificial intelligence or machine learning models.
Zero Data Brokerage or Sale: We do not sell, rent, monetize, or disclose your personal information, playlist contents, or listening habits to advertisers, data brokers, or commercial third parties.

4. Third-Party Services & Spotify Disclaimer

Demagify interacts directly with Spotify AB via the official Spotify Web API. Your use of Spotify remains subject to the Spotify Terms of Use and the Spotify Privacy Policy.

Demagify is an independent utility and is not endorsed, certified, sponsored, or affiliated with Spotify AB or Spotify USA Inc.

5. Data Retention & Access Revocation

Because Demagify operates on an ephemeral, session-based architecture, we do not maintain a permanent database of your personal listening history or track catalogs.

You have complete control over Demagify’s access to your Spotify account and can revoke authorization at any time with a single click:

Log in to your Spotify account and visit your Spotify Authorized Applications Dashboard.
Locate Demagify in your list of connected applications.
Click Remove Access.

Upon revoking access, your authorization token is immediately invalidated by Spotify, and Demagify will no longer have access to query your playlists or library.

6. Cookies & Session Storage

Demagify uses strictly necessary, HTTP-only, secure session cookies solely to preserve your encrypted Spotify OAuth session during an active audit run. We do not use advertising cookies, marketing tracking beacons, or cross-site fingerprinting scripts.

7. Data Security

All network data transmitted between your web browser, our servers, and Spotify’s API is encrypted in transit using industry-standard Transport Layer Security (TLS 1.3 / HTTPS). Session tokens are cryptographically signed and stored in HTTP-only cookies protected with strict security flags.

8. Children’s Privacy

Demagify is not directed to children under the age of 13 (or 16 where required by local law), and we do not knowingly collect or solicit personal information from minors.

9. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or your data, please contact the Demagify team at [email protected].