Your data, handled with care.

We collect the least we can, we never sell your data, and how you voted stays hidden until a round’s results. This page explains what we hold, why, and how to get it back or deleted.

Spinballot is run by Craig Hicks, working alone from Canada. There’s no company behind it: one person decides what happens to your data, and the same person answers when you ask about it. That’s [email protected] — a human, not a queue.

Account basics: name, email, and login provider. Game data: leagues, submissions, votes, and scores. We keep each session’s IP address and user-agent so settings can identify your devices and sign them out. Push notifications add a token per device.

Page views record an approximate location — country, region, and city, worked out from the connection, not a location sensor — plus your browser and device type. None of it is tied to your account.

If you connect a streaming provider (Spotify or Apple Music), we receive only what’s needed to match and link tracks — not your full listening history.

To run the game: store ballots, tally points, build leaderboards, and show you the right rooms. To keep things safe: detect abuse, sock-puppets, and vote manipulation. To talk to you: round reminders, plus product news if you switch it on.

We do not use your data to train third-party advertising profiles, and we don’t sell it. Full stop.

If you’re in the UK or EU, the legal grounds are these: the game, billing, and round notifications, because you asked us to run the service (contract); abuse checks, error monitoring, and page-view counts, because a game that works and stays honest is worth protecting (legitimate interests); product news and push, only if you switch them on (consent); billing records, because tax law requires it (legal obligation).

Submissions stay hidden from members and organizers until voting. Then your name appears unless you or your league enabled anonymous submissions, which is off by default.

Votes stay hidden until the results; ballot notes then appear with the author’s name.

Spinballot is run from Canada, and these providers handle your data in the United States and wherever else they operate: Vercel (hosting, file storage, page-view telemetry), Neon (database), Sentry (error reports), Stripe (payments), Brevo (email), Expo (push), OpenAI and Google (theme and artwork prompts), and Spotify or Apple Music if you link them. We may also disclose data if legally required, and will tell you unless prohibited.

Theme and artwork prompts go to OpenAI or Google; artwork refinements also send earlier turns. Expo receives your push token and, for mentions, the message’s first 140 characters.

You can view and edit your profile, export your data, and delete your account from settings.

Deleting your account scrubs it rather than erasing it. We replace your name, email, handle, and profile so leaderboards and past rounds remain, then delete linked logins, sessions, and saved collections. A permanent deletion record retains your user id, email, and name.

Wherever you live, those controls are your right to a copy, a correction, and erasure — and anything they don’t reach, you can ask us for. We answer within a month, usually sooner.

If you think we’ve mishandled something, tell us first — that’s normally the required first step anyway. From there, in Canada you can take it to the Office of the Privacy Commissioner of Canada; in the UK or EU, to your national data protection authority.

Spinballot is not for children under 13, and we don’t knowingly collect anything from them. If you believe a child under 13 has an account, write to us and we’ll remove it.

We use a small set of cookies to keep you signed in. Page-view telemetry is cookieless — visitors are counted by a hash of the request, which resets each day. No third-party ad trackers. You can clear or block cookies in your browser, though some features may stop working.

Account deletion has a 30-day undo window; exports remain downloadable for 7 days. A push-delivery ticket identifier remains until processed, for at most 24 hours. Cover-art cleanup removes abandoned uploads after 24 hours and replaced or removed art after 7 days; failed file deletions retry for up to 30 days.

Other data remains while your account exists. Permanent records — account and league deletions, moderation actions, round history, released handles — are kept indefinitely, with no sweep today.

When this page changes, the date at the top changes with it, and we’ll flag anything material in the app first. Questions go to [email protected] or the contact page.