Provider Data Handling Policy

Provider OAuth tokens are used server-side to create private playlists, refresh access where supported, resume queues, and sync limited playback metadata only when requested by the app flow.

Provider tokens are not intentionally exposed in rendered HTML or normal session responses. Spotify Web Playback may receive a short-lived token only when explicit playback resume requests require it.

Disconnecting a provider from Apps removes that provider account record, token material, saved provider queues, and synced provider play history from your Shuffle Resume user account.

Provider APIs may require paid provider subscriptions, exact callback URLs, app review, test-user registration, or provider-specific permissions.

If a provider cannot complete a playlist or playback action, the app should fall back to the safest available link or status instead of exposing provider secrets.