# Privacy

The short version: you can use every part of SpinTheList without an account, and when you do, your lists and brackets never leave your browser. Signing in is optional and only adds the few things it has to.

Effective 2 September 2026.


## What stays in your browser

Your lists, wheel settings (sounds, volume, theme, spin duration, font size), your spin results, your five most recent lists and the My brackets history are all kept in this browser using localStorage. They are not sent anywhere and they are not readable by us. Clearing your browser data removes them, and they do not follow you to another device unless you share a link yourself.

Share links built from the URL carry the list inside the link itself, so anyone with the link can rebuild the wheel or bracket. Treat a share link as public.


## Optional Google sign in

If you choose to sign in with Google, we store your name, email address, profile picture URL and the time you last signed in. That is all. We never see or store your Google password, and we do not read your Google account beyond those fields.

Signing in also sets one cookie, named `sl_session`. It holds your session only, lasts 30 days, and is HttpOnly, so scripts on the page cannot read it. Signing out clears it.

Signing in exists for one reason: permanent links to your wheels and brackets. Nothing else on the site is gated behind it.


## Saved links

Anyone can make a short link, signed in or not. When you save a wheel or a bracket to one, we store its title, its current state (your list or bracket as it stands), its visibility, any custom slug you chose and, if you were signed in, who created it. Saved links are public by default: anyone with the address can open them.

A link made while signed out is deleted 30 days after it was created, and it is always public. A link made while signed in stays until you delete it or delete your account, and you can switch it to private in My links, where a private link opens only for you. Deleting a link is immediate and permanent.

To stop one visitor flooding the link store we count how many links have been made from your connection today. That count is kept against a scrambled, one way version of your IP address, never the address itself, and it is deleted a few days later.


## Anonymous usage counters

We count how many times a wheel is spun, a bracket is built, a bracket is exported or printed, and a link is created or opened. Each count records the event name and the page it happened on. There is no cookie, no account id and no list content in a count. Your IP address is used for a moment to rate limit abuse and is not stored with the count. These totals are what the live counter in the footer shows, and they are not used for anything else.


## Analytics

The site loads Google Analytics 4 to see which pages people find useful. GA4 sets its own cookies and collects the usual page view data such as the page address, referrer, approximate location and device type. Your list contents are never sent to it. If you would rather not be counted, a tracker blocker or your browser Do Not Track setting will stop it, and the site works exactly the same either way.


## Export or delete your data

Go to [your account page](https://spinthelist.com/account) while signed in. Download my data gives you a JSON file with your profile and every saved link. Delete account removes your profile, your session and all of your links for good. Neither action needs to go through us, and neither can be undone once it finishes.


## Contact

Questions about any of this, or a request we have not covered here, can go to hello@spinthelist.com . The rules for using the site live on our [terms page](https://spinthelist.com/terms).