Now Playing connects Spotify to your Slack custom status. To do that we need a couple of permissions, and nothing more. This page explains exactly what those are, in language a person can read.
We request the user-read-currently-playing scope. That's it. We poll the now-playing endpoint every few seconds while your account is active and read back the track name, artist, album, and play state.
We request the scopes needed to set your users.profile custom status — specifically users.profile:write. We do not request access to messages, files, or channels.
When you authorize Now Playing we store your Spotify and Slack user IDs, workspace ID, and OAuth tokens. Tokens are encrypted at rest. We also keep timestamps for connection events for debugging and abuse prevention.
We record product-usage events — such as connecting an account, starting or stopping sync, and setting a schedule — using PostHog. These events are tied to your Slack user ID so the operator can understand how the product is used in aggregate. No listening history, track data, or message content is included.
Your Spotify data is used solely to keep your Slack status in sync with what's playing. The most recent track is held in memory long enough to update your status; we don't keep a listening history, and we don't use your activity to train models or build profiles.
Usage events (connect, sync start/stop, schedule changes) are recorded so the operator can understand how the product is being used. This data is never sold or shared with advertisers, data brokers, or any third party beyond the analytics processor described below.
We use a small number of infrastructure providers bound by data-processing agreements: cloud hosting, error monitoring, transactional email, and PostHog for usage analytics. PostHog receives your Slack user ID and the usage events described above — nothing more. We never sell or rent your data. We will only disclose information to third parties when required by valid legal process and will notify you where legally permitted.
OAuth tokens and account metadata are kept for as long as your account is active. When you revoke access — from Spotify, from Slack, or by emailing us — your tokens are deleted immediately and any remaining records are purged within 30 days.
Now Playing isn't directed at children under 13, and we don't knowingly collect data from them.
If we make material changes we'll update the date at the top and, where reasonable, notify active users by email. Continued use after a change means you accept the updated policy.
Questions, requests, or complaints: support@nowplaying.dev.