Awhile ago there was some major app, I think Facebook, that updated its Android version, and everyone freaked out because the new version required a seemingly-outrageous level of access. Some kind soul went down the whole list and explained by everything it requested was critical to the functionality of the app, and I seem to recall one of those explanations involving access to local files.

Also, people need to take a step back and look at these privacy notices for what they really are: legal liability waivers. When Spotify says they are allowed to give your data to third parties, they are not saying "we are selling your data to third party marketers as we speak." They're saying, "if this data ends up in the hands of someone other than Spotify, you cannot sue us." That's it.