How Lilify handles your data

Last updated: 23 October 2026

Lilify is an independent Android client for Spotify, made by an individual developer ("Lilify", "we"). This policy explains what the app accesses, where it goes, and what you can do about it. The short version: Lilify has no account system of its own, no advertising and no analytics; the data it touches is what Spotify and Google already hold for you, plus the files you choose to download.

1. Who we are

Lilify is operated by an individual developer. For any privacy question or request, write to nshllagi99@gmail.com.

2. Your Spotify account

You sign in on Spotify's own sign-in page, hosted inside the app. Spotify sets session cookies, which are stored in the app's private storage so the player stays signed in. Lilify does not receive or store your Spotify password. Catalogue data, playback and account details come from Spotify's services under Spotify's own privacy policy.

3. Downloads

When you download a song, the audio file is kept in the app's private storage, encrypted, or — if you turn on Google Drive — uploaded to your Drive as described below. Download metadata (track, size, location) is kept in the app so the Downloads screen can show it. Removing a download deletes the local file and, if it was in Drive, the Drive file.

4. Google Drive

Google Drive storage is optional and off until you connect it in Settings. When you connect, Lilify asks Google for the https://www.googleapis.com/auth/drive.file scope. That scope lets the app create, read, and delete only the files Lilify itself creates; it cannot see or change the rest of your Drive.

What is accessed: the Lilify folder and the files in it that the app created, plus your Drive quota.
How it is used: to upload a finished download, check it (MD5), stream it back with HTTP range requests, and delete it when you remove the download.
Storage of the token: the short-lived access token is held in memory only. Lilify keeps the connected account's email address in its settings so Settings can show which account is connected. Disconnecting forgets both.
Sharing: Drive files are not shared with us or anyone else by Lilify. They stay in your Google account, under your Google terms.
Advertising and sale: Google user data is never used for advertising, sold, or transferred to third parties.
Human access: no one reads your Google Drive files. The app accesses them only on your device, on your instruction.
Deletion: remove the download in Lilify, or delete the Lilify folder in Drive. Disconnecting removes the stored token and account email; the files stay in your Drive until you delete them.

Lilify's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

5. Diagnostics and crash reports

If the app crashes, it shows a report on the device. The report stays on the device; it is only shared if you choose to copy or send it. Lilify contains no analytics, advertising or crash-reporting SDK.

6. Other requests the app makes

To do its job, the app contacts these categories of services:

Spotify — sign-in, playback, catalogue, recommendations.
Google Drive — only when you connect it, as described above.
Lyrics and music-metadata providers — the track and artist you are viewing are sent to services such as LRCLIB, lrc.red, Genius, song.link, Deezer, Tidal, Qobuz, YouTube Music and NetEase to find lyrics, credits, videos or links.
SpotiFLAC — lossless download requests go to SpotiFLAC's servers when you use that feature.
GitHub — update checks, if the build is configured with a release repository.
SponsorBlock — segment lookups for video playback, when enabled.

These requests include the usual technical data (IP address, user agent) and the track or artist being looked up. They are governed by each service's own privacy policy.

7. What Lilify does not do

No account, profile, contact list, location or advertising identifier is collected by us.
No analytics or tracking SDKs are included.
No passwords are stored by Lilify.
No Google user data is used for advertising or sold.

8. Retention

Settings, session cookies and download metadata stay on your device until you clear the app's data or uninstall it. Drive files stay in your Drive until you delete them. We hold no server that stores your data.

9. Children

Lilify is not directed at children under 13. Spotify's own age requirements apply to the account you use.

10. Changes

If this policy changes, the new version will be published on this page with a new date.

11. Contact

Questions or requests: nshllagi99@gmail.com.