Legal & Privacy
Privacy Policy
Your Decisions Belong to You
At SpinTheWheel.to, we believe an online tool should simply work without surveilling its users. Our core wheel studio is engineered to be local-first: your entries, names, numbers, and settings remain on your device in your browser's local storage. We do not sell your personal data, we do not require accounts to spin, and we do not track your activity across other websites.
1. Scope & Operating Entity
This Privacy Policy applies to your use of SpinTheWheel.to, including all subdomains, embeddable widgets, real-time live synchronization rooms, and associated services (collectively, the 'Service').
We are committed to full compliance with global privacy regulations, including the European Union and United Kingdom General Data Protection Regulation (GDPR / UK GDPR), the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA / CPRA), the Children's Online Privacy Protection Act (COPPA), and the Google Certified Publishing Partner policies.
2. Guest Users: Local-First Zero-Knowledge Architecture
When you use SpinTheWheel.to without signing into an account (Guest Mode), 100% of your wheel content—including custom slice labels, colors, weights, sound themes, elimination preferences, and spin history—is stored exclusively within your browser's IndexedDB and localStorage.
This data is processed client-side on your device. It is never transmitted to, inspected by, or stored on our backend servers. If you clear your browser cookies and site storage, your guest wheel data is permanently deleted from your device.
3. Information Collected When You Choose Cloud Features
A. Optional User Accounts (Google OAuth)
If you voluntarily choose to sign in to sync wheels across your devices, authentication is handled via Google OAuth (facilitated through Google Firebase Authentication). We receive only your basic public authentication token, including your email address, display name, and avatar URL. We never receive or store your Google account password. Cloud-synced wheels are stored in our secure database linked strictly to your user identifier.
B. Public Share Links & Ephemeral Live Stream Rooms
When you choose to generate a public Share Link or host a real-time Live Stream Room, your wheel configuration (title, slices, colors) is uploaded to our encrypted cloud object storage (Cloudflare R2) and broadcast through edge WebSockets (Cloudflare Durable Objects). Live rooms operate ephemerally in edge memory and automatically expire and purge after host disconnection.
C. Direct Support & Communication
When you contact us via email (hello@spinthewheel.to, privacy@spinthewheel.to), we retain your email address and message contents solely to resolve your issue and communicate with you.
4. Edge Network Diagnostics & Security Telemetry
To protect SpinTheWheel.to against distributed denial-of-service (DDoS) attacks, brute-force exploitation, and malicious bots, our edge delivery network (Cloudflare) automatically processes standard HTTP request headers, truncated IP addresses, user agent strings, and request timestamps. This technical telemetry is processed strictly on the basis of legitimate interest for security and uptime, and is never used to profile or track individual users.
5. Advertising & Cookie Disclosures (Google AdSense)
SpinTheWheel.to is made freely accessible to users worldwide through third-party advertising partners, primarily Google AdSense. Third-party vendors, including Google, use cookies and device identifiers to serve advertisements based on prior visits to our site and other destinations across the web.
Users located in the European Economic Area (EEA), the United Kingdom, and Switzerland are served an IAB Europe TCF 2.2-certified Consent Management Platform (CMP) on their first visit, allowing granular control to accept, reject, or customize advertising cookies.
You can opt out of personalized advertising at any time by visiting Google Ad Settings (https://adssettings.google.com) or through the Network Advertising Initiative opt-out portal (https://optout.networkadvertising.org).
6. Student & Children's Privacy (COPPA & K-12 Safeguards)
SpinTheWheel.to is a general-audience decision tool that is widely celebrated and safely deployed in educational settings, from kindergarten classrooms to university lecture halls. In strict compliance with the Children's Online Privacy Protection Act (COPPA), we do not knowingly collect, request, or store personal identifiable information from children under the age of 13. Teachers, educators, and young students are able to use all core wheel features in Guest Mode with zero registration, zero accounts, and zero transmission of student names.
7. Your European Privacy Rights (GDPR & UK GDPR)
If you reside within the EEA or UK, you are entitled to statutory rights under the GDPR: (a) Right of Access to your personal data; (b) Right to Rectification of inaccurate data; (c) Right to Erasure ('Right to be Forgotten'); (d) Right to Restrict Processing; (e) Right to Data Portability; and (f) Right to Object to processing. You may exercise these rights or delete your entire account directly via Account Settings or by emailing privacy@spinthewheel.to.
8. California & US State Privacy Rights (CCPA / CPRA)
Under the California Consumer Privacy Act as amended by the CPRA, California residents possess specific privacy rights: We do NOT sell your personal information for monetary compensation, nor do we sell the personal information of minors. You have the right to request disclosure of categories of personal information collected, request deletion of your data, opt out of cross-context behavioral advertising, and be free from discriminatory treatment for exercising your rights.
9. Data Retention & One-Click Deletion
Guest wheel data persists only as long as you maintain it on your device; clearing your browser cache removes it immediately. For authenticated users, cloud-saved wheels are retained until you choose to delete them. You can delete individual wheels or execute a complete account deletion from your Account Settings, which permanently purges your records from our cloud database within 24 hours.
10. Contacting Our Data Protection Team
If you have questions, feedback, or formal data subject requests regarding this Privacy Policy, our dedicated privacy team is available at privacy@spinthewheel.to or via our Contact Page.