Privacy and local data

Spotify Enhanced stores account data inside:

com.buzs.spotify.ulanziPlugin/.data/index.json

The file contains the local server port, an internal inspector token and encrypted Spotify credentials. Access tokens, refresh tokens and Client Secrets use AES-256-GCM with a key derived from the local machine and plugin UUID. This protects the file at rest from casual inspection, not from malware or another process running as the same user.

The plugin communicates with the Spotify Web API and accounts.spotify.com, and starts a local HTTP server bound to 127.0.0.1 for OAuth and settings-panel communication.