1. Scope & Purpose

MateriaQ Telemetry provides anonymous, real-time usage metrics and live presence statistics for open-source applications and Spicetify extensions. We collect minimal pseudonymous data strictly to measure active usage volume, maintain service reliability, and protect our infrastructure against automated abuse.

2. Supported Applications & Separate Privacy Policies

MateriaQ Telemetry ingests telemetry pings from the following applications:

• MateriaQ Lyrics (lyrics): Customizable lyrics viewer for Spotify via Spicetify • Website • Source Code
• Telemetry Dashboard (web): Public dashboard displaying real-time metrics • View Dashboard

First-Party Ecosystem: All listed applications (MateriaQ Lyrics) are built and operated directly by MateriaQ. All pings transmitted to this server strictly follow the data minimization rules detailed below.

3. Spotify & Spicetify Privacy Boundaries

We maintain strict operational and data boundaries regarding third-party platforms:

• Spotify AB: Spotify is a registered trademark of Spotify AB. MateriaQ Telemetry is an independent open-source project and is not affiliated with Spotify AB. MateriaQ Telemetry never collects, receives, logs, or stores Spotify account passwords, credentials, email addresses, personal profiles, listening histories, currently playing tracks, saved playlists, or audio streams. Your use of Spotify is governed exclusively by Spotify’s Privacy Policy.
• Spicetify: Spicetify is a local client modification framework that runs entirely on your local device and does not operate or collect telemetry. MateriaQ Telemetry’s privacy guarantees apply specifically to the MateriaQ Telemetry backend server and web dashboard.

4. Legal Basis (GDPR Art. 6(1)(f))

We process technical telemetry under Legitimate Interests solely to monitor service health, count concurrent active users, and prevent denial-of-service abuse without profiling, identifying, or tracking users across the web.

5. Data Processed

• Pseudonymous Client IDs: Client IDs are normalized and converted into deterministic UUID v5 values, then hashed with SHA-256 before storage. Raw account IDs are never stored or logged.
• Dashboard Visitors: Browsers receive a random session token via an HttpOnly cookie to prevent double-counting active visits.
• Cryptographic Verification: Telemetry pings require an HMAC-SHA256 signature to reject forged or automated spam.
• IP Addresses: Used only in memory for rate limiting and DDoS protection. IP addresses are never stored in Redis or linked to user counts.

6. Data Minimization (What We Never Collect)

We strictly enforce zero collection for personal and sensitive data. We never collect:

• Listening history, song playback, playlists, lyrics, or library data.
• Real names, email addresses, passwords, or Spotify account credentials.
• Hardware device fingerprints, MAC addresses, or canvas fingerprints.
• Advertising trackers, marketing cookies, or tracking beacons.

7. Ephemeral Retention

• Live Presence: Active client timestamps expire automatically after 4 minutes of inactivity.
• Daily Metrics: Aggregated daily counters expire automatically after 9 days.
• Rate Limits: Token buckets expire after 1 hour of inactivity, and identity caps reset after 24 hours.

8. Your Rights & Opt-Out

You can opt out at any time by disabling telemetry in your extension settings. Under GDPR Article 11, because we do not store personal data or link counts to identities, stored metrics cannot be linked to any individual person.

9. Data Sharing & Infrastructure

We do not sell, rent, monetize, or share telemetry data. Cloudflare is used strictly for edge caching, DNS, and DDoS mitigation.

10. Open Source & Inquiries

All server source code, rate limits, and hashing logic are open source under the AGPLv3 license and verifiable on GitHub. Questions or security reports can be opened directly on our GitHub repository issue tracker at https://github.com/MateriaQ/telemetry.