Privacy policy

Last updated 15 October 2026. The data controller is Eternal AS, Norway, reachable at hello@spinthepeach.com.

What we store

• Your account: email address, a salted hash of your password (never the password), the name you choose to show, whether your email is confirmed, whether you confirmed being 18 or older, your email preference, and the times you signed up and last used the service.
• Wheels you join: the username you give the creator, your token balance and every token change, every spin and its result, and every prize won with its status.
• Wheels you run: the wheel's name, description, colours, prizes and settings, and your fans' records on it.
• Creator plans: trial dates, plan status, and the identifiers Stripe gives us for your customer and subscription. We never see your card.
• Plumbing: session tokens (hashed), email and password-reset tokens (hashed), rate-limit counters per IP address for a short time, a log of the emails we sent and the delivery reports we received for them, and a record of which Stripe events we processed.
• Usage: simple event counts (signed up, joined a wheel, spun) tied to your account so we can see how the service is used. No advertising pixels, no third-party analytics.

What creators see about fans

A creator sees the username you gave when you joined their wheel, your token balance, your spins and the prizes you won on that wheel. A creator does not see your email address.

Who else handles data

Cloudflare (hosting, database, email routing; served from the EU where possible), MailChannels (sending our emails), and Stripe with Link (payments for creator plans). Each is bound by its own privacy terms and a data processing agreement.

Emails

Account emails (confirmation, password reset, plan notices) are part of the service. Emails about spins you receive and prizes delivered are optional: switch them off under Account or with the link at the bottom of any of them. No newsletters.

Cookies

One cookie keeps you signed in. It is set by our server, is not readable by scripts and carries no tracking. There are no advertising or analytics cookies.

Your rights

You can see and change your data in the app, and delete your account under Account, which removes it along with your memberships, prizes and any wheels you own. For access, correction, export or anything else under the GDPR, email us. You can complain to Datatilsynet, the Norwegian data protection authority.

Retention

Data is kept while your account exists. Sessions expire after 30 days of inactivity; reset and confirmation tokens expire within a day; rate-limit rows expire within hours. Email delivery logs and Stripe event records are trimmed after a year.

Age

The service is for people aged 13 and over. 18+ wheels are for adults only and are gated by a confirmation. We do not knowingly keep accounts of children under 13; tell us if you think one exists.