Privacy Policy
Last updated: 2026-09-04
What stays on your device
All of your wheels, entries, custom colors, settings, and spin history are saved exclusively in your browser's local storage. We do not transmit your entries, winners, or wheel configurations to any server. Clearing your browser data permanently deletes this information from your device.
What we collect
To understand how SpinOfLuck is used and to keep it running, we record a minimal, anonymous usage record per browser. That record contains only:
- A random anonymous ID generated and stored in your browser (no name, email, or IP)
- Your country, derived from request headers your browser already sends (country-level only)
- A counter of how many times the wheel has been spun from your browser
- A timestamp of your most recent visit
This data is stored on Google Cloud Firestore. We also collect anonymous, cookieless page-performance metrics through Vercel Analytics and Vercel Speed Insights, and use Microsoft Clarity to see how the interface is used (heatmaps and session replays). The wheel app is masked in those replays, so they never show your entries or winners.
What we do NOT collect
We never collect any of the following:
- Your wheel entries, names, or items
- Your winners or spin results
- Your name or email address, unless you choose to create an optional account
- Your precise IP address or GPS location
- Your browsing history across other sites
- Device fingerprints
- Third-party advertising IDs
We do not sell your data, and we do not share it with advertisers.
Optional accounts
You never need an account to use SpinOfLuck. If you choose to create one (with an email address and password, or by signing in with Google), it exists so you can back up wheels, see your spin history from another device, and join invite-only groups with the people you spin with. For an account we store:
- Your email address and, if you signed in with Google, the name and picture on that profile
- A display name you choose and can change at any time
- Your country (country-level only, the same signal as the anonymous record)
- The date you created the account and a count of spins made while signed in
- Wheels you explicitly choose to back up, saved entry lists, and spin results recorded while signed in
- Multiplayer rooms and verifiable draws you host, so you can manage them from another device
- Groups you create or join: the group's name, its members' display names, the wheels shared with it and the picks recorded on them. This is the one kind of account data other people (the group's members) can see. Your email is never shown to them
Account data is private to you, stored on Google Cloud Firestore, and protected by Firebase Authentication. Google Sign-In shares only your basic profile (name, email, and picture) with us. We never post to your Google account or read anything else from it. Groups are invite-only: there is no user search, and only people given a group's link can join it or see what is shared there. You can leave any group, delete backed-up wheels from the dashboard at any time, and you can ask us to delete the whole account through the contact form or email hello@spinofluck.com.
Multiplayer rooms
Multiplayer is entirely opt-in. When you host or join a room, the wheel name, entries, per-name colors, wheel settings, each member's chosen display name and anonymous browser ID, and each spin event are uploaded to Google Cloud Firestore so everyone can see and interact with the same wheel. Rooms are automatically deleted 24 hours after the host's last activity. Anyone with the 6-character room code can read a room's contents, so don't put sensitive information in a hosted wheel.
AI features
When you use an AI feature (such as generating wheel entries or a celebration message), only the short prompt you type is sent to a third-party language model. We don't attach your identity to the request, and AI output should be reviewed before use.
Children and classroom use
SpinOfLuck does not knowingly collect personal information from children, and no account or sign-in is required. Accounts are intended for adults such as teachers and hosts, not for students. If you are a teacher or parent, we recommend using first names or anonymised labels (e.g. “Group 1”, “Student 7”) and not entering sensitive student data. See our Safe for Schools page for details.
Your choices & contact
You can clear your local browser data at any time to delete your wheels and reset your anonymous ID. For questions about this policy, or to request deletion of any server-side record, use our contact form or email hello@spinofluck.com. For the full legal terms, see our Terms & Conditions.
Frequently asked questions
- Does SpinOfLuck sell my data?
- No. We never sell your data, and we don't share it with advertisers. The only data we keep is a minimal anonymous usage record.
- Where are my wheel entries stored?
- In your browser's local storage. Your entries, wheel names, colors, settings, and spin history never leave your device unless you explicitly share a wheel link or join a multiplayer room. One exception: the number picker also saves its setup (the range and the optional title you give a pick) and each number it draws under your anonymous ID (kept apart from account data), so they are there when you come back.
- Do I need an account?
- No. Every tool works without signing up. An optional account exists only for people who want to back up wheels and see their spin history from another device. If you create one, we store your email address, your country, a display name you choose, the date you joined, how many spins you made while signed in, and whatever you choose to back up or share with a group.
- What anonymous data do you collect?
- A random per-browser ID, your country (country-level, from request headers), a spin counter, and a last-visit timestamp. Nothing that identifies you personally.
- Do you store my IP address?
- No. We derive only a country-level signal from the request headers your browser already sends; we do not store your precise IP address.
- How do I delete my data?
- Clearing your browser's site data for SpinOfLuck removes your wheels, history, and resets your anonymous ID. If you have an account, you can delete individual backed-up wheels from the dashboard. To delete the whole account or anything else stored server-side, use the contact form and we'll remove it.
- Is SpinOfLuck safe for children and classrooms?
- Yes. It requires no account and collects no personal information from students. Teachers should use first names or anonymised labels and avoid entering sensitive data. See our Safe for Schools page.
- What happens to data in multiplayer rooms?
- Multiplayer is opt-in. When you host or join a room, the wheel name, entries, colors, settings, your display name, and spin events are uploaded to Google Cloud Firestore so others can see the same wheel. Rooms auto-delete 24 hours after the host's last activity.
- Do you use cookies?
- We don't use advertising cookies. Microsoft Clarity, which shows us how the interface is used through heatmaps and anonymised session replays, sets its own first-party cookies to tell one visit from the next. The text inside the wheel app is masked before anything is recorded, so a replay never contains your entries or winners. Everything else uses your browser's local storage to save your wheels and a small amount of anonymous analytics, and the performance metrics via Vercel are cookieless.
- What about the AI features?
- When you use an AI feature, only the prompt you type is sent to a third-party language model to generate entries or a message. We don't attach your identity to it.
- Which third parties are involved?
- Google Cloud Firestore (anonymous analytics, issue reports, optional multiplayer, and optional accounts), Firebase Authentication and Google Sign-In (only if you create an account), Vercel (hosting plus cookieless performance analytics), and Microsoft Clarity (usage heatmaps and masked session replays). We don't share your wheel content with advertisers.
- How can I contact you about privacy?
- Use the contact form. We treat privacy questions and deletion requests as a priority.