Quilore Request your data

Privacy

Your listening data never leaves your device.

That is the narrow, testable claim. The zip Spotify sends you is read inside this browser tab, and nothing in that file is transmitted to any server. You can check it yourself.

Alpha 1.0, last updated 30 August 2026.

Verify it in under two minutes

Open DevTools, go to Network, drop your file in, and confirm no outbound request carries your data. The full walkthrough is further down this page.

F12, or ⌥⌘I

What the claim covers

What the claim covers

  • The Spotify zip you drop into the upload area
  • Every JSON play record parsed from that file
  • The statistics computed from those records
  • Any share card you export as an image

What it does not cover

What the claim does not cover

  • Album art lookups, which send an artist and album name to Deezer
  • The team status chips, which expose your IP to Lanyard, the Discord CDN and the GitHub avatar CDN
  • Google AdSense, which funds the site and is the only one here that is not needed to make it work
  • Browser storage that your own device controls

These five are the entire list, and each is named below. None receives anything about how much you listened.

Third parties

Named, not hidden

Every third party that receives a request when you use this site, named and explained. There are five.

  1. 01

    Deezer

    api.deezer.com

    What it receives

    An artist name and an album name, for the albums currently on your screen, so it can return a cover image. Never a play count, a timestamp or a total.

    How to verify

    Network tab, filter “deezer”. You can turn artwork off entirely in settings.

  2. 02

    Lanyard

    api.lanyard.rest

    What it receives

    Nothing about you. It is a public read endpoint that reports whether the two developers are online on Discord, for the contact chips. Like any request, it sees your IP.

    How to verify

    Network tab, filter “lanyard”. Blocking it only makes the chip show GitHub instead.

  3. 03

    Discord CDN

    cdn.discordapp.com

    What it receives

    Serves the avatar images for those same two chips. Static files only. Like any image host it sees your IP when the picture loads.

    How to verify

    Network tab, filter “discordapp”. No listening data is attached to the request.

  4. 04

    GitHub avatars

    avatars.githubusercontent.com

    What it receives

    Serves the developers’ profile pictures, which is what the chips show before Lanyard answers and what they keep showing if it never does. Static files only. Like any image host it sees your IP when the picture loads.

    How to verify

    Network tab, filter “githubusercontent”. It loads on every page, not only when Discord is unavailable.

  5. 05

    Google AdSense

    pagead2.googlesyndication.com, googleads.g.doubleclick.net, ep1 and ep2.adtrafficquality.google, www.google.com

    What it receives

    The advertising script loads on every page and, like any third party script, sees your IP and the address of the page you are on. It never receives your listening data, because that never leaves the tab for anyone. Personalised advertising in the UK and EEA is gated behind a consent choice you make before any ad is requested.

    How to verify

    Network tab, filter “google”. One entry is not enough here: the advertising script pulls from several Google hosts, and all of them are listed above because counting it as one line would have been the convenient answer rather than the true one. Filter “Streaming_History” at the same time and you will still get nothing.

Step by step verification

Step by step verification

1

Open DevTools

Press F12 on Windows or Linux, or ⌥⌘I on a Mac, then click the Network tab.

2

Clear and reload

Clear the request list and reload the page, so you see every request made on load.

3

Upload your file

Drop your Spotify zip onto the upload area and watch the list as parsing runs. No new domain should appear.

4

Filter and confirm

Type your name, or “Streaming_History”, into the filter. Zero results. The file stayed in the tab.

Everything that leaves this page

The whole trace

  1. Deezer artist and album name
  2. Lanyard nothing, it is a read
  3. Discord CDN two avatar images
  4. GitHub avatars two profile pictures
  5. Google AdSense your IP and the page address
  6. Your listening data never sent, to anyone

What stays on your device

What stays on your device

Your file is read into memory and turned into statistics. It is not copied to disk or stored, and closing or refreshing the tab discards everything, which is why you upload again each visit.

  • Your light or dark theme choice
  • The album-art cache, so a cover is not fetched twice
  • Whether you dismissed the ad-blocker notice this session

None of it identifies you, and none of it is sent to us. There is no server that could receive it.

Advertising

Advertising

This site is funded by advertising rather than by charging you or gating any statistic.

When ad slots are live, the ad network may set its own cookies and receive your IP address and the page you are on, in order to choose an ad. That is disclosed here rather than buried.

It never receives anything from your Spotify file. Passing it along would mean transmitting the file to a server, which this architecture makes impossible.

Questions?

Anything about privacy goes to Emberfig, who make Quilore.

Contact Emberfig