What providers receive
Music authorization—not your club account.
The site uses public song details such as title, artist, duration, and recording identifiers to identify the board member’s pick. Apple mode may use those details for strict Apple catalog matching. Spotify mode sends only the exact Spotify ID of a pick originally submitted from Spotify; it does not search Spotify to convert Apple Music, YouTube, or Audius picks. The active provider receives normal catalog and playback requests, including network and device information, and may recognize an existing provider session. Its official window handles sign-in; Spanish@UIC never sees your music-provider password.
In Apple mode, Music User Tokens stay inside MusicKit in your browser and are not sent to our server. In the separately deployed Spotify mode, PKCE authorization, token refresh, exact-track retrieval, queue commands, and playback happen directly between your browser and Spotify. The access token stays in memory; PKCE state and the refresh token are tab-scoped in session storage, never Railway cookies or the Spanish@UIC database. No Spotify profile or personal Spotify data is persisted by Railway or the club database.
Spotify must redirect your browser back to this site once. The one-time code is present in that page request and may appear in normal hosting access infrastructure, but Spanish@UIC has no server callback logic to parse, exchange, persist, or deliberately log it. Browser code immediately removes it from the address before completing PKCE directly with Spotify.
Spanish@UIC does not send the provider your Spanish@UIC account ID, name, email, phone number, membership answers, or private profile data, and the radio does not call APIs to modify your music library.
What stays provider-controlled
Playback remains inside the official player.
The active provider controls audio delivery, account authorization, regional availability, subscription requirements, and service interruptions. Spanish@UIC arranges the board’s queue but never downloads, proxies, converts, caches, or separates audio from the official SDK.