Build a public, mobile-friendly website about my listening history, inspired by Heath Has Heard Things. I want visitors to understand my music habits at a glance, ask questions about the records, and recommend music to me.

Before you start, ask me only for details you cannot recover: my preferred public name and pronouns, the local folder containing my Spotify exports, any photos I want to use, my timezone, which listening/playlist information I want public, my hosting choice and monthly spending ceiling. Do not ask for passwords, card details or API keys in chat. I will enter billing details directly with the provider and configure API keys as server-side secrets.

DATA
I will request both Extended streaming history and Account data from https://www.spotify.com/account/privacy/ and keep their Read Me First documents. Inspect the files locally. Preserve the originals. Extended history supplies playback events; Account data supplies playlist snapshots and a shorter history. Inventory file dates, timestamp precision, missing periods and overlap. Remove exact duplicate events. Reconcile overlapping packages conservatively; do not sum both histories or silently guess which ambiguous records are new. Keep an audit of exclusions and reconciliation decisions.

Prepare an allowlisted music dataset containing track/artist/album names, track identifiers, durations, stream-end times and playlist membership. Exclude usernames, emails, IP addresses, device details, location fields, payment data, local-file paths and unrelated podcast/account data from the published dataset. Keep credentials, raw exports and private notes out of the repository and browser assets. Store the searchable records server-side in a persistent database. Publish aggregate chart data only where appropriate. Strip location and other embedded metadata from public photos.

For the historical Spotify export, count a play at 30 seconds or more and retain shorter starts separately, and use my timezone with daylight-saving changes. Group exact normalised artist/title matches across track versions without merging distinct live recordings or remixes. Headline song and artist totals must count music actually played, not unheard songs in playlists. Show coverage dates and counting definitions. Keep optional exclusions such as family sleep tracks explicit and separate from full-history totals. Playlist membership is a dated snapshot; it does not identify the playlist used for a past listen.

LIVE UPDATES
If I use Last.fm, connect its scrobbles through a private server-to-server feed with a dedicated secret key. Keep the source database private and publish only approved music fields. Establish a precise handover after the final Spotify event so the two sources cannot double-count. Preserve source IDs and make repeated deliveries idempotent. Last.fm timestamps mark the start of a listen and do not establish its duration or completion. Treat Last.fm as the permanent ongoing source: every scrobble counts as a play with no extra duration test. Use plays and listening days for headline measures, comparisons and all three curated charts. Recompute and cache chart aggregates with each sync, including the current year and future years. Genre shares should use play counts and show tagging coverage; new artists may lack tags. Do not invent listening hours. Only show recorded duration for explicit historical Spotify questions, clearly dated to the cutoff; explain when newer duration data is unavailable. Do not depend on regular Spotify exports. Schedule updates every 15 minutes, display the most recent listen, show delays honestly, and verify both an initial backfill and a repeated sync.

SITE AND COPY
Make an inviting, colourful site with rounded cards and readable type. Use third person about me, and write for somebody arriving without knowing this conversation. The tone should be dry and funny, with specific jokes and straightforward descriptions. Credit the AI builder and say what I supplied. Use my own photos if supplied; do not reuse Heath's identity, photos, numbers or recommendations.

Put overall plays, listening days, different songs, different artists and a visible top-artists ranking near the top. Add three or so fixed charts chosen because the data tells an interesting story. Good choices include artist listening over time, separate days returning to an artist, and a weekday/time-of-day heatmap. Do not add a chart builder. Make numeric values available to keyboard, touch and screen-reader users. Use the same scales when charts invite comparison. Test narrow phones as well as desktop widths.

Genre and original-release-year analysis are optional enrichment. Spotify's history download does not provide complete genre tags or original release years. Only use separately supplied or properly sourced metadata, retain provenance, show coverage, distinguish reissue dates, and never invent missing classifications. Choose another chart when enrichment is absent.

QUESTIONS
Support counts and listening days, historical Spotify minutes when explicitly requested, first/last recorded listens, top tracks/artists/albums, comparisons, time and date filters, yearly/monthly patterns, playlist membership and contents, and songs played immediately before or after a named song. Ask for clarification when titles are ambiguous. Explain missing coverage and partial metadata where relevant.

Use an LLM only to translate visitor-authored questions into a small, strictly validated query plan. Give it a generic schema and, when needed, previous visitor questions. Do not send listening records, catalogue metadata, statistics, photos or previous database answers to the model. Resolve names and calculate answers in application code using parameterised queries, then render clear text and tables. The LLM must not generate SQL or invent the answer. Keep direct name searches and curated examples working when AI is unavailable. Make the question box's availability honest. Put the latest answer inside the question panel and keep earlier questions collapsed there, rather than stacking answers further down the page.

RECOMMENDATIONS AND SECURITY
Visitors can suggest a song, album or artist, with an optional music link, reason and name. Save submissions durably and show success only after the database confirms the write. Make repeat submissions idempotent. Give me an authenticated private inbox, enforcing ownership on the server; other visitors must not read recommendations. Validate lengths and allowed link schemes/domains, render input as text and do not fetch submitted URLs.

Keep all API keys and signing secrets on the server. Add signed HttpOnly Secure session cookies, same-origin and CSRF checks, bounded request sizes, parameterised database queries, sensible per-session/IP/global rate limits, bot resistance, a hard application-side AI spending cap, output limits and request timeouts. Budget controls must still hold under simultaneous requests. Avoid storing raw visitor IPs or full question logs. Include a short privacy explanation, secure response headers and no unnecessary tracking. Treat questions, exports and model output as untrusted input. Do not let the public endpoint run arbitrary code, SQL or network requests. Protect the import endpoint, verify imported totals and membership, and close it after loading.

TEST AND HAND OVER
Verify headline totals and at least eight representative answers independently against the source data, including a song count, artist comparison, time filter, top ranking, playlist membership and nearby listening. Test ambiguous titles, duplicate playlist names, missing data, failed API calls, malicious input, CSRF, authentication, recommendation persistence and rate limits. Review desktop and phone layouts, labels, focus order and overflow. Fix failures before publishing.

Publish the completed site to my chosen provider within my approved budget. Use secure provider billing and secret entry; never request card numbers in a file. Report any remaining activation step plainly. Include the data coverage date, update procedure, operating cost controls and a Make your own page with a copyable prompt and official Spotify download links. Keep the site separate from any existing blog. Check the current Spotify terms relevant to public data reuse and AI; do not assume an export creates an exemption. Do not promise a live Spotify sync unless one is actually implemented and authorised.