Is Spotify Friend Activity safe?
Spotify Friend Activity intercepts the Spotify web player's access token and reuses it to load friend activity.
Spotify Friend Activity injects a fetch hook into open.spotify.com to read the bearer token Spotify uses in request headers. It stores the token in Chrome sync storage and sends it to guc-spclient.spotify.com to retrieve the buddy list used for the friend-activity display.
Who publishes itJack Weatherford - no other listings under this identity
Jack Weatherford - no other listings under this identity
What this publisher told the store about itself, and the other listings that told it the same thing.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
What it can do
Permissions this extension asks for, as declared in version 2.2.0. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on open.spotify.com
https://open.spotify.com/*
Store data in your browser
storage
Where it sends data
Destinations our analysis observed Spotify Friend Activity contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- guc-spclient.spotify.com
Spotify Friend Activity sends data to guc-spclient.spotify.com. No other extension we have analysed sends data here.