Privacy policy
Last updated
Wheely is a wheel spinner. It does not need much about you, so it does not ask for much, and it does not quietly take more.
This page says exactly what is stored, why, who else ever sees it, and how to get it back or get rid of it. It is written to be read, not to be survived.
1. What Wheely stores
Only what the product needs to work. In full:
- Your account. Your email address, and a display name, handle and avatar if you set them. If you signed up with a password, it is stored only as a hash and never as text. If you signed in with Google, Wheely keeps your Google account identifier and the email address Google confirmed, and never sees your Google password.
- Your sessions. When you log in, Wheely records the session, when it expires, and the IP address and browser it was started from, so you can be told which sessions exist and so suspicious activity can be spotted.
- What you make. Your wheels, the slices in them, their titles and descriptions, any lists you import, and any pictures you upload.
- What gets spun. A record of each spin: the wheel, the winning slice, the time, and whether it came from the app, a share link, an embed or a stream overlay. Spins by someone who is not logged in are not linked to a person.
- Billing, only if you subscribe. Your Stripe customer and subscription identifiers, your plan, its status and its renewal date. Card numbers are handled entirely by Stripe and never reach Wheely.
- Messages you send us through the contact form, and your email address so we can reply.
- An administrative log. Staff actions, such as handling a report, are recorded with the time and the IP address they were taken from.
2. What Wheely does not do
- There are no advertising, analytics or tracking scripts on this site. Not Google Analytics, not a pixel, not a session recorder, none.
- Your personal data is never sold, rented or traded, and it is not shared for anyone else's advertising.
- You are not profiled, scored, or subjected to automated decisions that affect you.
- Wheely does not read your private wheels to build anything, and does not use them to train machine learning models.
3. Why it is stored
- To give you the product you asked for. Your account, your wheels and your spins exist because you cannot have an account without them.
- To keep the service safe. Session and log records exist so accounts can be protected and abuse can be dealt with.
- To take payment, if you choose to subscribe.
- To email you the things you need. Confirming your address, resetting your password, and team invitations. There is no marketing mailing list.
6. What you choose to make public
Wheels are private when you create them. A wheel becomes visible to other people only when you publish it or turn on a share link, and when you do, its title, description, slices, pictures and spin count are public, along with your handle and display name on your profile page. Published wheels can be found by search engines.
Whatever you type into a slice becomes part of that wheel, so if you publish a wheel, do not put other people's personal information in it. You can make a wheel private again at any time from the editor.
7. How long it is kept
Your account and what you have made are kept for as long as your account exists. Sessions expire on their own, and password reset and email confirmation links expire shortly after they are sent and are stored only as a hash, so the original link cannot be recovered from the database even by us.
Records we are required to keep, such as billing records, are kept for as long as the law requires even after an account goes.
8. Your rights, and how to use them
You can ask for a copy of what is held about you, ask for it to be corrected, ask for it to be deleted, or object to it being held at all. Depending on where you live these are rights under the GDPR, the UK GDPR or the CCPA, and Wheely applies them to everybody rather than checking where you are first.
Much of it you can do yourself: your name, handle and avatar are on your settings page, and any wheel can be edited, made private or deleted from the editor. There is no self-serve button to delete a whole account yet. Until there is, ask through contact@screentext.net and it will be done by hand.
If you are unhappy with how a request was handled, you can complain to your local data protection authority.
9. Children
Wheely is used in classrooms, and it is built for the teacher rather than the class: an account is for someone aged 13 or over, and pupils spin the wheel on their teacher's screen or through a share link without ever making one. Accounts are not knowingly created for children under 13, and if we learn that one has been, it is removed.
10. Keeping it safe
The site is served over HTTPS. Passwords are stored only as hashes, and so are password reset and email confirmation links. Session cookies cannot be read by scripts in your browser. Uploaded pictures are kept outside the public web root and are served only after checking that the person asking is allowed to see them. No system is perfectly secure, but these are the parts most often got wrong, and they are not.
11. Changes to this policy
When this policy changes, the date at the top changes with it. If a change materially affects what happens to your data, you will be told directly rather than left to notice.
12. Getting in touch
Wheely is operated by Burt Lao, who is the data controller for the information described here. For anything on this page, including a request about your own data, reach us through contact@screentext.net.