Skip to main content

Notice at Collection

This California notice describes the categories of personal information Big Spinning Wheel collects, why we collect them, how long we keep them, and where to find more detail.

What we collect

  • Identifiers and account data: email address, account ID, public spinner-profile name, profile settings, WebMCP preference, and login or security data used for passwords, passkeys, recovery, and MFA.
  • Pending registration and challenge state: email, opaque pending identifier, secure session-binding hash, challenge provider and bounded progress, verification or manual-review state, and confirmation-delivery state.
  • Legal acceptance evidence: a separate legal identifier; plaintext confirmed email at acceptance; the exact agreement and acceptance statement; records of when and how acceptance was recorded; application and presentation-version evidence; a technical acceptance record and cryptographic digests; and timestamp and validation records.
  • Internet or network activity: technical information processed to receive and secure browser requests, operational timing and diagnostic information, and aggregate finite-cardinality rate-limit totals. Retained log fields depend on the deployed configuration.
  • User content and collaboration data: wheel names; content typed, uploaded, or imported; wheel and landed-segment settings; collaborator and ownership-transfer data; public-link and embed settings; favorites; and spin results or history.
  • Support, legal, and copyright communications: the name, email, subject, message, and other information you submit. Formal notices or other copyright submissions may include addresses, telephone numbers, signatures, statements, and information about disputed content.

Why we collect it

  • Provide and operate the service, including registration, legal acceptance, authentication, real-time wheels, favorites, collaboration, ownership transfer, public links and embeds, and wheel create/import/export.
  • Secure accounts, apply interaction checks, prevent abuse, investigate issues, and enforce rate limits.
  • Preserve evidence of the required Terms or other agreement accepted and support verification of those records.
  • Debug, maintain, monitor, and improve reliability.
  • Communicate about accounts, security, verification, and support.
  • Comply with law, resolve disputes, and enforce our Terms.

How information may be disclosed

Public links and embeds are public according to the owner's settings. Collaborators receive access according to granted permissions. Service providers process information for hosting, storage, email, content moderation, monitoring, diagnostics, and security. Moderation submissions may be sent to Microsoft Azure AI Content Safety. Timestamp services receive a cryptographic digest representing the acceptance record, related request and validation information, and server connection information. The timestamp request does not send the full acceptance record, plaintext email, or your browser or device identifiers. A digest can be compared with a matching candidate record. Separate certificate-status services receive certificate identifiers or revocation-status requests and connection information. If WebMCP is enabled, eligible pages expose tool descriptions, capabilities, and catalog values to a compatible browser or AI assistant you select. This discovery can disclose information before any separate tool invocation. Depending on your instructions, permissions, and provider settings, invocations may occur under previously granted authority without fresh human approval for each action. Invocations can disclose action inputs and results, including wheel content involved in the action, under that provider's own terms and privacy practices. See Section 6 of the Terms of Service for responsibility for the authority you grant and actions taken within it. Copyright complaint and reconsideration information may be disclosed to an affected contributor or account holder, the person reporting the material, service providers, counsel, or authorities as reasonably needed to review the matter, respond, or comply with law.

We do not sell personal information or share personal information for cross-context behavioral advertising.

Typical retention

A pending registration attempt expires within 29 days; its record is deleted on successful activation or through periodic cleanup after expiry or denial. Expiry does not itself delete stored information. Aggregate rate-limit telemetry has a 90-day retention policy. Moderation telemetry defaults to 30 days for detail records and 90 days for aggregate records; periodic cleanup applies. Other logs, diagnostics, backups, temporary sharing records, and pending ownership-transfer data follow the applicable cleanup schedules and operator/provider settings. Account/profile data remains as needed to maintain the account and complete account closure, subject to applicable security and legal retention needs. Wheel and collaboration data remains according to ownership, deletion, sharing, safety, dispute, and backup needs, subject to removal by us or service discontinuation. Removal or loss of access does not necessarily mean that every retained copy has been deleted.

Legal subjects and legal-acceptance evidence—including plaintext confirmed email at acceptance, exact document/package evidence, timestamp receipts, and authority snapshots—are generally retained indefinitely. Account deletion removes the normal account link but ordinarily does not delete that evidence. After account deletion, we use retained legal evidence only for legal claims, security investigations and required compliance. Retention remains subject to applicable rights and legal exceptions. Applicable requirements to delete, correct, or otherwise limit retention or use of this information take precedence over this retention policy.

If you turn on a public link, public wheel surfaces may show the wheel, owner display, current or latest spin result, recent spin recap when enabled, and public-facing settings. Embeds can appear on external sites, streams, recordings, and event pages. Public live spinners may also change landed segment availability when enabled. Do not put sensitive information into wheel names, segments, descriptions, imports, or public profile names.

For details, read the Privacy Policy. For privacy requests, email legal@bigspinningwheel.com with the subject "California Privacy Request."