Legal & Privacy
Privacy Policy
1. Introduction & Scope
Welcome to SpinWheel.to ("we," "our," or "us"). We respect your privacy and are committed to transparent, privacy-first data practices across our website, applications, embed widgets, live synchronization rooms, and related services.
This Privacy Policy explains what information we collect, how we process it, your rights, and how we comply with global privacy standards, including the General Data Protection Regulation (GDPR), the UK GDPR, the California Consumer Privacy Act (CCPA/CPRA), the Children's Online Privacy Protection Act (COPPA), and Google AdSense publisher policies.
2. Guest Users (Zero-Account, Local-First Privacy)
SpinWheel is intentionally designed to work fully without requiring a user account. When you create or edit decision wheels as a guest, all custom wheel titles, slice entries, weights, colors, sound preferences, and visual settings are stored locally on your device via browser localStorage and IndexedDB.
Guest wheel data remains on your device and is not transmitted, stored, or processed on our backend servers unless you explicitly choose to create a public Share Link or broadcast a Live Stream Room.
3. Information Collected When You Choose to Provide It
A. User Accounts (Optional)
If you choose to create an account using Google OAuth, we receive basic authentication details including your email address, display name, and avatar image. We use this information solely to securely authenticate you and sync your saved wheels across devices.
B. Shared Wheels & Live Stream Rooms
When you generate a public Share Link or launch a Live Stream Room, your wheel title, slice entries, segment colors, and custom configuration are temporarily stored on our secure cloud database so viewers can view and synchronize real-time spins.
C. Contact Inquiries
When you contact us via our Contact Form or support email, we collect your name, email address, and message details solely to respond to your inquiry and provide technical assistance.
4. Automated Technical Logs & Security Data
When you access SpinWheel.to, our content delivery network (Cloudflare) automatically processes limited technical information, including truncated IP addresses, browser types, operating systems, referring URLs, timestamps, and diagnostic signals. This data is processed strictly for DDoS mitigation, rate-limiting, server stability, and abuse prevention.
5. Cookies & Advertising (Google AdSense)
SpinWheel uses essential cookies to remember your theme preferences (light/dark mode) and maintain active sessions. We do not use intrusive tracking cookies.
To keep our service free, SpinWheel displays advertising provided by Google AdSense and trusted advertising partners. Third-party vendors, including Google, use cookies and device identifiers to serve ads based on prior visits to our site and other websites on the internet.
Users in the European Economic Area (EEA), United Kingdom, and Switzerland are presented with a certified Consent Management Platform (CMP) allowing them to accept, reject, or customize non-essential advertising cookies.
6. Children's Privacy (COPPA & Classroom Safety)
SpinWheel is a general-audience decision-making utility commonly used in classrooms and educational settings. We do not knowingly collect personal identifiable information from children under the age of 13. Educators and students can safely use SpinWheel under Guest Mode without creating accounts or transmitting personal data.
7. European Privacy Rights (GDPR & UK GDPR)
If you reside in the EEA or UK, you have the right to access, rectify, erase, restrict processing, or request data portability for your personal data. You may delete your cloud account and all associated saved wheels at any time through Account Settings or by contacting us.
8. California & US State Privacy Rights (CCPA / CPRA)
We do not sell personal information in exchange for money. California residents have the right to know what personal information is collected, request deletion of their data, and opt out of the sharing of personal data for cross-context behavioral advertising.
9. Data Retention & Security
We implement industry-standard encryption (TLS/HTTPS) and security measures to safeguard data in transit and at rest. Ephemeral Live Stream rooms automatically expire after inactivity. Guest data remains exclusively under your control on your local browser.
10. Contact Us Regarding Privacy
If you have questions, privacy requests, or data inquiries regarding this Privacy Policy, please reach out to us through our Contact Page.