Privacy and local data

Spotify Enhanced stores account data inside:

com.buzs.spotify.ulanziPlugin/.data/index.json

The file contains the local server port, an internal inspector token and encrypted Spotify credentials. Access tokens, refresh tokens and Client Secrets use AES-256-GCM with a key derived from the local machine and plugin UUID.

The plugin communicates with the Spotify Web API and accounts.spotify.com, and starts a local HTTP server bound to 127.0.0.1 for OAuth and settings-panel communication.