Your data.
Wavpals is an invited, personal pilot. Connecting shares your Spotify name, profile photo and tops with one other participant for up to 24 hours.
What we read
Your Spotify account ID, display name, profile photo, and up to 200 tracks and 50 artists in each of three approximate periods: four weeks, six months and one year. Availability depends on Spotify. We request only user-top-read, not your email, location, library or playback controls.
Who can see it
Your pal sees your name, profile photo and tops after both accounts connect. An unused invite shows the host’s name. Invite links are private and can be accepted by one person. Share them only with the person you choose.
Storage and expiry
The app runs on ChatGPT Sites with Cloudflare D1. Sessions become inaccessible 24 hours after creation. Expired records are removed during subsequent service requests. You can delete a session or your participation earlier in Options.
A Secure, HttpOnly, SameSite cookie identifies each participant’s browser. Spotify access and refresh tokens are never stored. Temporary PKCE authorization data expires after ten minutes and is cleaned up on later requests. The host’s invite link is remembered in browser session storage.
Artwork and deep cuts
We send track titles and artist names to Deezer to check catalog reach and retrieve artwork. We do not send participant names, emails, Spotify account IDs, personal ranks or your relationship. Public catalog evidence may be cached for seven days. Missing data never counts as rarity.
Spotify tops represent affinity, not exact play counts. We do not infer nationality, health, personality or worldwide rarity probabilities. Your music data is not sent to AI models, sold or used for advertising analytics. Google Fonts receives ordinary connection information when fonts load, not your tops.
Delete or disconnect
The host can delete the session for both people. A guest can delete their own participation. This removes the corresponding data and invalidates the invite. To revoke Spotify access, visit Spotify apps and remove Wavpals. Revoking there does not notify Wavpals automatically; delete your participation here too.
About the pilot
Wavpals is not affiliated with Spotify. Track and artist metadata links to the original content. Contact the person who invited you for pilot support. An open launch still requires provider-terms review and a public support channel.