Privacy Policy

1. Who we are

WheelWhirl (“WheelWhirl”, “we”, “us”) runs wheelwhirl.com, a free wheel spinner and random picker. There are no user accounts. Contact: support@wheelwhirl.com.

2. Information collected automatically

Like any website, our hosting provider receives your IP address, browser and device type, the pages you request and the time of the request. This is held in server logs for security and reliability. If you consent (or where the law does not require consent and you have not opted out), Google Analytics 4 adds aggregated usage data such as pages viewed, approximate location derived from IP, device and browser details, and which features were used (for example “spin” or “share”). We do not send your wheel entries, names, images or chat text to analytics.

3. Data stored only on your device

These items are kept in your browser’s storage. We never receive them:

• wheels you save (“My Wheels”), their entries, colors and settings;
• your spin results history for the current visit;
• preferences such as sound volume and style, mute, whether results are read aloud, your light or dark theme, whether the entries panel is open, and your cookie and privacy choices;
• your YouTube API key for the Streamer Studio, only if you tick the box to remember it;

You can delete all of it at any time from your browser’s site data settings. Clearing it also removes your saved wheels, so export them first if you need them.

4. Your wheel entries, names and images

Everything you type into a wheel is processed in your browser. Pictures you add to entries or the wheel center are resized in your browser and are not uploaded to our servers. When you create a share link or embed code, the wheel is compressed into the part of the address after the #. Browsers do not send that part to any server, so we cannot see it. Anyone you give the link to can open the wheel, and anything you paste the link into (a chat app, a document) can see it, so avoid sharing links that contain sensitive names publicly. Share links are never shortened or stored by us. The QR code for a share link is generated on your device.

When a spin finishes, your browser tells our server which wheel was spun (for example “nfl-team-wheel”) so we can count spins per wheel per day. Only the wheel and the date are stored. Your entries and the result are never sent, and your IP address is used only briefly, in memory, to ignore rapid repeated counts; it is not stored.

If you switch on “Read the result aloud”, your browser’s speech feature reads the result. We prefer voices installed on your device, but if your browser only offers online voices, the browser maker (for example Google or Microsoft) may process the text being read. We never receive it.

5. Twitch and other integrations

The Streamer Studio can read a public Twitch chat. Your browser (or your OBS browser source) connects directly to Twitch’s public chat service without logging in. It reads usernames, display names, subscriber or moderator badges and the chat command text so it can add viewers to the wheel. This information is used in your browser and is not sent to or stored on our servers. Twitch processes the connection under its own privacy notice. Viewers who type a command in your chat are shown on your stream by you; tell your community how the wheel works.

The Streamer Studio can also read a YouTube Live chat. Your browser contacts YouTube directly with a YouTube Data API key that you supply. The key can be saved in your browser if you choose, and it is added to the overlay link only if you use the standalone overlay. Chat messages are read in your browser to add viewers and are not sent to or stored on our servers. YouTube handles the connection under the Google Privacy Policy and the YouTube Terms of Service.

The Verified draw feature contacts drand, a public randomness service run by independent organisations, from your browser. Your device asks drand for the value of one numbered round, so drand and its relay operators (such as Cloudflare) see your IP address and that round number, as with any website request. Your entries and the winner are never sent to them, and a draw receipt lives in the link itself after the #, which is not sent to any server.

The YouTube Comment Picker works differently. When you paste a video link and press the button, the link is sent to our server, which asks YouTube (through the YouTube Data API) for the video’s public comments and returns the commenters’ display names, profile picture links and comment text to your browser. We do not store this data or write it to logs on purpose; it is kept in your browser only while the page is open. We use YouTube API Services, so the YouTube Terms of Service and the Google Privacy Policy apply to that part of the service. Winner profile pictures are loaded directly from YouTube’s image servers when a winner is shown.

6. The contact form

If you write to us through the contact form, your name, email address and message are kept in our private message inbox so we can reply, and they may also be sent to our email delivery provider (Resend) so that they reach our email. We do not store your IP address or browser details with the message. We keep correspondence only as long as needed to handle your request and for normal record keeping, then delete it. You can also email us directly instead of using the form.

7. Cookies and similar technologies

We use browser storage for the items in section 3, and, depending on your choices, cookies from Google for analytics and advertising. The full list, with purpose, provider and duration, is in the Cookie Policy. You can change your choices at any time with the Cookie Settings link in the footer.

8. Analytics

We use Google Analytics 4 to understand which pages and tools are useful. In the EEA, UK and Switzerland it only runs after you opt in. Elsewhere it runs unless you opt out or your browser sends a Global Privacy Control signal. You can also install Google’s browser opt-out add-on.

9. Advertising

We plan to show ads from Google AdSense and similar networks. Until ads are switched on, none are served and no advertising cookies are set. Once they are, these disclosures apply:

• Third-party vendors, including Google, use cookies to serve ads based on a user’s prior visits to this and other websites.
• Google’s use of advertising cookies enables it and its partners to serve ads to you based on your visit to this site and/or other sites on the internet.
• You can opt out of personalized advertising by visiting Google Ads Settings. You can opt out of some third-party vendors’ use of cookies for personalized advertising at www.aboutads.info/choices (US) or www.youronlinechoices.com (EU).
• Learn more in How Google uses information from sites or apps that use our services.

Ads are never shown in fullscreen mode, in the winner window, in embeds or in streaming overlays. Where the law requires it, personalized ads only run after you opt in.

10. Legal bases (EEA, UK and Switzerland)

• Consent for analytics and advertising cookies. You can withdraw it at any time in Cookie Settings.
• Legitimate interests for server logs, security, preventing abuse of the contact form, and keeping the service running.
• Steps you ask us to take when you contact us and we reply.

11. Your rights

EEA, UK and Switzerland: you can ask for access to your data, correction, deletion, restriction, a portable copy, and you can object to processing and withdraw consent. You can complain to your local data protection authority.

California and other US states: you can ask what personal information we collect and use, ask us to delete or correct it, opt out of the sale or sharing of personal information, and you will not be treated differently for using these rights.

To make a request, email support@wheelwhirl.com. We reply within 30 days (45 days where US state law allows, with notice if we need longer). We may need to confirm it is you. Because we hold no account profiles, we often will have nothing to return beyond logs and any messages you sent us.

12. Do Not Sell or Share, and Global Privacy Control

We do not sell personal information for money. Advertising and analytics cookies can count as “sharing” under some state laws, so we provide a one-click opt-out on the Do Not Sell or Share My Personal Information page and in Cookie Settings. We also treat a Global Privacy Control signal from your browser as that opt-out.

13. Children

WheelWhirl is a general-audience tool and is not directed to children under 13. We do not knowingly collect personal information from children under 13. Teachers can use the wheels in class because entries stay in the browser, but we ask that children use the site under adult supervision. If you believe a child has sent us personal information through the contact form, email us and we will delete it.

14. How long we keep data

• Browser storage: until you clear it.
• Hosting server logs: typically up to 30 days, according to our host’s settings.
• Google Analytics data: 14 months.
• Contact messages: only as long as needed to respond, then deleted.

15. International transfers

Our hosting, analytics and email providers may process data in the United States and other countries. Where required, transfers rely on approved safeguards such as the EU–US Data Privacy Framework or Standard Contractual Clauses offered by those providers.

16. Security

The site is served over HTTPS, we collect very little, and the random numbers behind every spin come from your browser’s cryptographic generator. No system is perfectly secure, so please do not put sensitive personal information on a wheel you share.

17. Changes to this policy

We update this page when our practices change and show the date above. For significant changes we will say so on the homepage for at least 30 days. Jurisdiction: the United States.

18. Contact

WheelWhirl
Email: support@wheelwhirl.com