To be clear, it looks like the oauth scope they're requesting only allows read-only access to your account. So it's not like they could actually post on your be

To be clear, it looks like the oauth scope they're requesting only allows read-only access to your account. So it's not like they could actually post on your behalf without additional express permissions, barring a Spotify API bug (as far as I understand). That said of course I agree they should have an explicit privacy policy regardless.