Privacy Policy

SpinKit ("we", "us") is a free randomiser studio for spin wheels, slot reels, Spin Sheets and team pickers, available at spinkit.org. This policy explains what we collect, why, and the choices you have. We keep it short and in plain language.

The short version

SpinKit is local-first. You can use every core feature without an account, and your wheels, slots, Spin Sheets, teams, results and settings are stored in your own browser. We only collect personal data when you choose to create an account or use online features.

Data stored on your device

By default your content lives in your browser's local storage and never leaves your device. Clearing your browser data removes it. This includes your wheels, slots, Spin Sheets, teams, spin history, and app preferences.

Some larger items — such as background images, sounds and cached pictures you use in the studio — are kept in your browser's IndexedDB storage instead. It works the same way: it stays on your device and is removed when you clear this site's data in your browser.

Anonymous usage counts

To power the public Stats page, SpinKit keeps simple aggregate tallies — such as the total number of wheel spins, slot spins and Spin Sheets generated across all users. When you are signed out these counts are completely anonymous and are not linked to you or your device; the entries and results you spin are never sent. When you are signed in, the same totals are also kept for your own account so you can see your personal stats. Spins you make offline are counted on your device and added to these totals the next time you are online.

Data we process when you sign up

If you create an optional account, we store:

• Account details — your email address and a securely hashed password (we never see your plain password), plus a username, display name, and optional bio and profile photo.
• Cloud saves — any wheels, slots or Spin Sheets you choose to sync, including their version history. Teams lists stay on your device.
• Social features — friend connections you create, and any presets you publish or share via short links or public views.

Live spin rooms are ephemeral: their chat and spin messages are relayed in real time and are not stored on our servers.

Service providers

We use a small number of trusted providers to run SpinKit:

• Supabase — authentication, database and file storage for accounts, cloud saves and real-time live rooms.
• Cloudflare — hosting, content delivery, security, and privacy-focused, aggregated traffic analytics (Browser Insights).
• Google AdSense — SpinKit’s website may show a small number of manual Google AdSense ads on written and content pages to keep the service free. SpinKit does not use Auto ads. Google and its partners may use cookies or similar identifiers to serve, cap and measure ads, and — where you consent — to personalise them. Presentation Mode hides ads and surrounding chrome while you present; leaving Presentation Mode returns normal chrome and ads where they apply. The Windows desktop app can remain ad-free. The website is not ad-free.

Optional features that contact other services

These only happen when you use the feature. Each provider handles the request under its own privacy policy and can see your IP address when your browser contacts it directly.

• Image and sound search — your search words are sent through SpinKit's server to the library you pick (such as Openverse, Unsplash, Pexels or Pixabay). The pictures and sounds you choose are then loaded from that provider.
• Google Sheets import — when you import a sheet by its link, SpinKit's server fetches that sheet's published CSV from Google for you. The rows are used to build your Spin Sheet in your browser; we do not keep a copy.
• SpinBot's on-device model — if you choose to download it, the model files come from Hugging Face (huggingface.co). After that, your SpinBot requests are processed entirely in your browser.
• Your own AI key — if you add your own key for OpenAI, Anthropic or Google Gemini, SpinBot sends your requests straight from your browser to that provider; they do not pass through SpinKit. The key is kept in your browser's local storage. If you turn on key sync, it is encrypted in your browser with a passphrase that never leaves your device before it is saved to your account, so we cannot read it.
• SpinBot cloud assistance — when this is available and you are signed in, advanced SpinBot requests are processed by Cloudflare Workers AI. A request contains what you typed plus details of the tool you have open — for example the wheel’s title and entries, or a Spin Sheet’s title and column headings. A daily usage count is kept against your account to enforce fair-use limits.

Cookies and advertising

We use your browser's local storage to save your content and to keep you signed in. Your language preference may be stored in a cookie named spinkit_locale and in local storage as spinkit:locale:v1. SpinKit’s website shows a small number of manual ads through Google AdSense on written and content pages. Third-party vendors, including Google, use cookies or similar identifiers to serve, cap and measure ads, and — where you consent — to personalise them. In the UK and EEA we ask for your consent before personalised ads are shown. How Google uses data when you use our partners’ sites or apps: How Google uses data when you use our partners’ sites or apps. Also Google Ad Settings (myadcenter.google.com), aboutads.info/choices, Google advertising policies. We do not sell your personal data.

Third parties, including Google, may place and read cookies on your device, or use similar identifiers. How Google uses data when you use our partners’ sites or apps.

In the UK, the European Economic Area and Switzerland, SpinKit asks for your choice through Google’s consent management platform, which is certified under the IAB Transparency & Consent Framework. No advertising cookies are used there until you agree, and until then only limited ads that do not use cookies for personalisation may be shown. The same message lets you object to advertising purposes that Google and its ad partners carry out on the basis of legitimate interests, such as measuring how ads perform. You can change your choices at any time:

Change cookie choices

Cookies and similar storage SpinKit sets

• Language — your language choice is stored as the cookie spinkit_locale and in local storage as spinkit:locale:v1.
• Presentation Mode — when it is on, SpinKit stores an end time in local storage as spinkit:presentation:until and hides ads and surrounding chrome only while the mode is active. Leaving Presentation Mode returns normal chrome and ads where they apply. It is a display mode, not a site-wide ad-free setting.
• Share-link passwords — Short share-link passwords only hide the wheel in SpinKit’s viewer. They are not a cryptographic vault; the link’s data may still be readable without the password. Use an expiry for anything sensitive.

Who is responsible for your data

SpinKit is run by Callum Oulds, an independent developer in the United Kingdom, who is the data controller for the personal data described here. You can reach him at [email protected].

We rely on these legal bases under UK and EU data protection law:

• Providing the service you ask for (contract) — your account, cloud saves, share links, live rooms and any optional feature you turn on.
• Legitimate interests — keeping SpinKit secure and working, preventing abuse, enforcing fair-use limits and counting anonymous totals for the Stats page.
• Consent — advertising cookies and personalised ads where consent is required. You can withdraw it at any time using the cookie choices control above.

Your rights

You can view and edit your profile, remove individual cloud items, revoke share links, and sign out at any time. Depending on where you live (including under UK and EU GDPR) you may have rights to access, correct, export or delete your personal data, and to object to or restrict processing. To exercise these rights or to request account deletion, contact us at [email protected].

If you are unhappy with how we handle your data, please contact us first. You also have the right to complain to the UK Information Commissioner’s Office at ico.org.uk, or to the data protection authority where you live.

Data retention

We keep account data for as long as your account is active. When you delete your account or specific items, the associated data is removed from our active systems.

Children

SpinKit is not directed at children under 13, and we do not knowingly collect their personal data.

International transfers

Our providers may process data in regions outside your own. Where required, appropriate safeguards are in place to protect your information.

Changes

We may update this policy from time to time. Material changes will be reflected here with a new "last updated" date.

Contact

Questions about privacy? Email [email protected].