Privacy policy

Publisher and contact

Controller: STARM, independent publisher of SpinLoot. Contact for privacy and data requests: starm.web.2022@gmail.com.

Data we process

Browsing the public catalogue does not require an account. The website may store viewed links, badges, and the wheel day locally in your browser to provide those features. The website does not send this local data to an advertising network.

In the mobile app, history, preferences, language, and notification settings stay on your device unless you enable sync. If you do, Firebase Authentication creates an identifier (anonymous at first) and Firebase Firestore stores a minimal profile, preferences, and link history. If you link an Apple or Google account, Firebase may also process the email address and profile name supplied by that provider.

If you enable notifications, Firebase Cloud Messaging processes a device token and your category/language preferences to deliver alerts.

Purposes and legal bases

STARM processes data to show the catalogue, remember your choices, sync history when you request it, send notifications you enable, secure and maintain the service, and respond to requests. Depending on the feature, processing is based on providing the requested service, your choice/permission, or the legitimate interest in operating and protecting the service.

The mobile apps may request and display Google AdMob ads after the required privacy choices. The SDK may process IP address (including to estimate general location), device or advertising identifiers, app/ad interactions, and diagnostic or performance data to deliver and measure ads and prevent fraud. You can change available choices in Settings > Advertising privacy options. Ads are not required to view or open links. The website does not load the AdMob SDK.

Recipients and external links

Firebase Authentication, Firestore, and Cloud Messaging are provided by Google. AdMob is also provided by Google and applies only to the mobile apps. These providers process data needed for their services under their own privacy terms and commitments. Google services may process data in multiple countries; see their privacy and data-processing documents for applicable details and safeguards.

When you choose to open a link, your browser or game contacts the issuer’s domain. That issuer applies its own privacy policy and may receive ordinary connection data. SpinLoot does not receive confirmation that a reward was credited in the game.

Retention and deletion

Website-local data remains in your browser until you clear it with the button below or your browser controls. App-local data remains on the device until you delete it in the app or uninstall the app.

Synced SpinLoot account data is retained until account deletion. In the app, open Settings and choose “Delete my data and account.” This deletes the synced profile and history and the Firebase account. Local copies on other devices must be cleared on each device. If you can no longer access the app, email the contact above from the address associated with the account and request deletion; do not send a password or sign-in code.

Technical source-collection logs and idempotency keys have automatic retention periods of 90 days and 30 days respectively; they support catalogue operations and do not contain a user’s personal history. Google applies its own retention periods to AdMob and Firebase data.

Security and your rights

Connections to Firebase and advertising services use HTTPS/TLS. Access to synced data is limited to the relevant account and services needed to operate the app.

You may request access, correction, deletion, or restriction by emailing starm.web.2022@gmail.com. You may also contact your local data-protection authority.

Children and changes

SpinLoot is not designed to target children under 13, and we do not seek to collect their data. If you believe a child has provided us with data, contact us so we can review the request.

This notice may change when features or providers change. The update date at the top will be revised.