Privacy Policy

Big Spinning Wheel lets people create, operate, and share wheels by public link or owner-enabled public embed. This Privacy Policy explains what information we collect, how we use and disclose it, how long we keep it, and what privacy rights may apply.

Privacy contact: legal@bigspinningwheel.com

1. Important: public means public

If you enable a public link for a wheel, public wheel surfaces may show the wheel, owner display, public-facing settings, and the current or latest spin result when one exists. If you also enable public embedding, those surfaces can appear on external websites, stream scenes, recordings, event pages, and other external pages. If you allow shared spins, people using the public link or embed may be able to spin the wheel and change landed segment availability when you enable that option. If you show the recent spin recap to visitors, recent spin history may also be visible.

Do not put sensitive information into wheel names, wheel segments, descriptions, public profile names, imports, or other public content.

2. Information we collect

Account and profile information

We collect your email address, account ID, public spinner-profile name, profile settings, account preferences, and WebMCP enabled or disabled preference.

Registration and challenge information

Before account creation, we collect an email address, an opaque pending-registration identifier, a secure session-binding hash, the selected first-party challenge provider, bounded challenge progress, verification or manual-review state, and confirmation-delivery state. We do not retain a motion trace, raw provider response, IP address, user agent, device classification, free-text review evidence, password material, or Terms evidence in the pending-registration record.

Security information

We process password-related data, passkey public-key credential data, MFA settings, recovery or verification events, and security events from you and the devices or browsers you use to authenticate.

Legal acceptance evidence

For each required agreement you accept, we keep a legal identifier separate from your account; your confirmed email in plain text as it existed at acceptance; the exact agreement version and acceptance statement; records of when and how acceptance was recorded; application and presentation-version evidence; a technical acceptance record and cryptographic digests; and timestamp and validation records.

A timestamp service receives a cryptographic digest representing the acceptance record and related request and validation information. The request does not send the full acceptance record, plaintext email, or your browser or device identifiers. A digest is not a plaintext copy of the record, but someone with a candidate record can calculate and compare its digest. Timestamp services also observe server connection information, such as the service's server address and request timing. Separate certificate-status services receive certificate identifiers or revocation-status requests and connection information. We retain request, response, provider and certificate/authority records needed to explain how the timestamp was validated.

User content and collaboration data

We collect wheel names, content you type, upload, or import into wheels, wheel settings, landed segment enabled or disabled state, collaborator settings and permissions, ownership-transfer request records, public-link and embed settings, favorites, and spin results or history tied to a wheel. Content may be submitted by you or another authorized user of the wheel.

Device, usage, and aggregate rate-limit data

The service processes technical request information to receive, secure, and respond to browser requests. Operational logs and diagnostics may include request timing, status, errors, and performance information. The fields retained depend on the deployed logging configuration. Rate-limit telemetry stores only finite-cardinality aggregate minute buckets, such as the policy and outcome totals needed to understand enforcement. It does not store limiter partitions, IP addresses, user or wheel identifiers, paths, share codes, hub tokens, registration-session bindings, or raw requests.

Support communications

We collect the name, email address, subject, message, and other information you submit when you ask for help or contact us about privacy, legal, security, copyright, or account issues. Support-form submissions are delivered through the configured email service to our support mailbox. Formal notices or other copyright submissions may also contain mailing addresses, telephone numbers, signatures, statements, and information identifying the disputed material.

3. How we use information

We use information to:

• provide and operate the service, including creating, importing, exporting, displaying, favoriting, sharing, collaborating on, and spinning wheels;
• support real-time updates, collaborator access, ownership-transfer workflows, public links, and owner-enabled public embeds;
• verify email addresses, assess registration requests, deliver confirmations, and prevent automated abuse;
• authenticate users, secure accounts, prevent abuse, investigate misuse, and protect service integrity;
• preserve evidence of which required Terms or other agreements a user accepted and support verification of those records;
• show users the current and historical legal agreements tied to their active account;
• debug, maintain, monitor, and improve performance and reliability;
• send account, verification, security, and support communications;
• comply with law, address disputes, and enforce our Terms.

4. How we disclose information

• Public sharing you control: if you enable a public link, wheel content, owner display, public-facing settings, current or latest spin result, and any recent spin recap you show to visitors may be public, including through embeds.
• Collaborators you invite: collaborators can access the wheel according to the permissions you grant. A collaborator who has joined can become the new owner if they accept a transfer while signed in.
• Browser or AI assistant you select: when WebMCP is enabled, an eligible page automatically exposes tool descriptions and page-specific capability or catalog values to a compatible browser or AI assistant you selected. Tool discovery can disclose this information without a separate tool invocation. Invocations may occur under your prior instructions or standing permissions, depending on the provider and your settings, without fresh human approval for every action. When a tool is invoked, the provider may receive and process action inputs and results, including wheel content involved in the action, under its own terms, privacy practices, settings, retention, and training practices.
• Service providers: vendors may process information on our behalf for hosting, storage, email delivery, content moderation, monitoring, diagnostics, security, and related operations.
• Timestamp and certificate-status services: the selected providers receive the digest, request, validation, and server connection information described above. Providers may change. We will provide any notice and obtain any consent required by applicable law for changes to these practices.
• Copyright complaints and reconsideration: information may be disclosed to an affected contributor or account holder, the person reporting the material, service providers, counsel, or authorities as reasonably needed to review the matter, respond, or comply with law. See the Copyright Complaints and Removal Policy.
• Legal, safety, and enforcement: we may disclose information where reasonably necessary to comply with law, respond to lawful requests, protect users, investigate abuse, or enforce our Terms.
• Business transfers: information may be transferred as part of a merger, acquisition, bankruptcy, reorganization, or similar transaction.

A selected browser or assistant provider is not a Big Spinning Wheel service provider merely because WebMCP definitions register or a tool is invoked.

5. Data retention

Retention depends on the category and purpose described below. Periodic cleanup can occur after a record expires, and residual backup copies follow separate retention settings.

Email changes do not alter older acceptance evidence. A later acceptance records the then-confirmed email. If an email is reused for a new account after deletion, that account receives a new legal identifier.

Indefinite retention is not required by electronic-signature law. Applicable access, deletion, correction, and objection requests may be limited where retaining particular evidence is necessary to establish, exercise, or defend legal claims or meet another legal obligation. Applicable law can instead require deletion, including after actual knowledge of covered personal-information collection from a child under 13. Our ordinary retention policy does not override that requirement.

Residual copies may remain in backups or logs after other information is deleted. Their retention depends on the applicable schedules and settings described above.

6. Your choices and controls

• You can control whether a wheel has a public link and whether it can be embedded.
• You can choose whether a public page allows shared spins, practice spins only, or view-only use.
• You can choose whether visitors see recent spin recap. This does not hide the current or latest result when one exists.
• You can manage collaborator edit and spin permissions, revoke access, and transfer ownership only through the supported signed-in workflow.
• You can favorite or unfavorite wheels as private account preferences.
• You can export a selected wheel definition. The download is not a full privacy data export and is under your control after download.
• You can update profile information and manage passkeys, MFA, recovery options, and the default-off WebMCP preference.
• Signed-in users can view the agreements accepted for their current account, open the accepted documents, and see their recorded acceptance dates. The account display is not a complete privacy-access response; use the contact information below to exercise applicable access rights.

7. California privacy rights

If you are a California resident, you may have rights to request access to personal information, deletion, and correction, and to opt out of sale or sharing. We do not sell personal information and do not share personal information for cross-context behavioral advertising.

Email legal@bigspinningwheel.com with the subject "California Privacy Request." We may need to verify your identity. For an authorized agent, we may require proof of authorization and may still verify your identity directly where permitted by law. We will not discriminate against you for exercising applicable privacy rights.

We use sensitive personal information only as reasonably necessary to provide the service, secure accounts, prevent fraud, and preserve the legal evidence described above.

8. Cookies, Do Not Track, and opt-out preference signals

We use cookies and similar technologies needed to run, secure, monitor, and troubleshoot the service, including keeping users signed in.

Service providers may process technical request and diagnostic information on our behalf to deliver, secure, monitor, and troubleshoot the service. Network processing and the information retained in logs are distinct; retained fields and periods depend on the deployed configuration.

We do not respond to browser Do Not Track signals as a standalone standard. A compatible browser or AI assistant you select may collect and process information about your activity over time and across different websites when WebMCP is enabled or when that provider otherwise operates in your browser. Its collection is governed by its own terms, settings, and privacy practices. Apart from providers a user selects or activates in their own browser, Big Spinning Wheel does not knowingly permit other parties to collect personal information through the service about activities over time across unrelated websites for their independent purposes.

We do not sell personal information or share it for cross-context behavioral advertising. If that changes, we will update this policy and honor valid opt-out preference signals as required by law.

9. AI and data use

We use automated systems to help operate, secure, and moderate the service. Content submitted for moderation, including public spinner-profile names when checked, may be sent to Microsoft Azure AI Content Safety to help apply our content-safety rules.

Separately, default-off WebMCP lets a compatible browser or AI assistant selected by you discover tools on eligible signed-in pages. Tool descriptions and page-specific capabilities or catalog values may be exposed on discovery, and tool invocations may disclose action inputs and results. Depending on your instructions, permissions, and provider settings, these invocations may occur without a separate prompt or human approval for each action. See Section 6 of the Terms of Service for responsibility for the authority you grant and actions taken within it.

Big Spinning Wheel does not select or contract with a model provider for this browser feature. The WebMCP feature does not add provider or invocation telemetry; general technical request, log, and security processing is described in Section 2. The provider may independently retain tool descriptions, page capabilities, action inputs, and results; use them for training or improvement; or combine them with other information under its own terms, privacy practices, and settings. Disabling WebMCP or revoking permissions does not, by itself, undo completed actions or delete information already received by a provider. Applicable privacy rights remain available.

We do not describe these systems as making legal, employment, medical, financial, educational-placement, or other high-stakes decisions about you. We do not use them for cross-context behavioral advertising.

10. Children

The service is not intended for children under 13. If you believe a child under 13 has provided personal information, contact legal@bigspinningwheel.com. If we obtain actual knowledge that we collected personal information from a child under 13, we will stop the affected processing, close any account, and delete linkable information as required by law. This applies to covered information associated with pending registrations, active accounts, and retained records after account closure, including backups or information held by recipients to the extent required by law.

11. Shine the Light

We do not disclose customers' personal information to third parties for their direct marketing purposes.

12. Security

We use administrative, technical, and organizational measures designed to protect information. No service can guarantee absolute security. Contact security@bigspinningwheel.com for security reports.

13. Changes to this policy

We may update this Privacy Policy. The effective date identifies the current version. We will post an updated policy with a new effective date. For a material change, including if we begin selling or sharing personal information in a way that requires notice or controls, we will also provide a prominent service notice and, when appropriate or required, an account email before or when the change takes effect.

14. Contact

For privacy or legal questions, email legal@bigspinningwheel.com. To contact support for product or account help, use our contact form.