Wheel of Misfortune
Privacy Policy
Last updated 11 September 2026
This policy explains what personal data Wheel of Misfortune (“we”, “us”) collects when you visit the website or use the game, where that data comes from, why we use it, who receives it, how long we keep it, and the rights you have. Wheel of Misfortune is the data controller for the purposes of the UK GDPR and the Data Protection Act 2018.
Data we collect
| Data | What it includes and why we use it | Lawful basis |
|---|---|---|
| Account and sign-in data | Your email address, account identifier, password credentials handled by our authentication provider, authentication method, confirmation and sign-in times, session information, and age-confirmation record. We use these to create, authenticate, recover, and secure your account and to enforce the adults-only service rule. | Contract; legitimate interests in account security |
| Profile and preferences | Your display name, optional avatar, automatic-price setting, email preferences, and the dates these records are created or changed. We use them to personalise the service and help other players recognise you. | Contract |
| Teams and invitations | Team name and image, membership, role, join date, invite code, invitee email address, inviter, invitation status, game settings, virtual stake, currency, and competition settings. We use these to create teams, control access, deliver requested invitations, and run the game. | Contract for players; legitimate interests in delivering a requested invitation for invitees who do not yet have an account |
| Game and competition activity | Games, rounds, spins, cards, tickets, slot outcomes, stock tickers, simulated holdings and prices, virtual gains or losses, competition entries and results, trophies, notifications, and action timestamps. This is the shared state and history needed to play, resolve disputes, and show results. | Contract; legitimate interests in maintaining the integrity of the shared game |
| Content you or another player supplies | Profile, team and trophy names and images; stock-request and review notes; membership-removal reasons; actions taken by a team owner or runner for another player; and other text submitted through game features. We use this content to provide the feature in which it was entered and to show relevant information to the affected players. | Contract; legitimate interests in operating and moderating the shared service |
| Support, bug and security reports | Your message and, where available or supplied, your name, email address, account identifier, page, browser user-agent and submission time. A public security report may also include your IP address. We use this to investigate, reply, protect the service, and keep an appropriate incident record. | Legitimate interests in support, service improvement, fraud prevention and security; legal obligation where we must investigate or record an incident |
| Email and delivery records | Email addresses, sender and recipient details, subject and message content, verification tokens, delivery status, bounces, complaints, unsubscribe or suppression status, and sent or verified times. We use these to deliver service and game messages, process replies, confirm addresses, and honour requests not to send further email. | Contract; legitimate interests in reliable service communications; legal obligation for suppression and objection records |
| Stock requests | The requested ticker, optional note, requesting account, market-data snapshot, review status and any reviewer note. We use this to assess requested additions to the game. | Contract; legitimate interests in maintaining the stock catalogue |
| Technical, request and security data | IP address, user-agent, request path and query parameters, request or session identifiers, response status, timing, approximate hosting region, authentication events, rate-limit identifier and counter, and Cloudflare anti-bot signals such as browser or TLS characteristics. We use this to deliver the site, diagnose faults, prevent abuse, rate-limit sensitive actions, and protect accounts. For unauthenticated security-sensitive actions, a rate-limit database key can contain the raw IP address and may remain after its active rate-limit window; IP addresses and related metadata may also appear in short-term provider logs and submitted reports. | Legitimate interests in delivering, monitoring and securing the service |
The stock tickers and amounts you record are information you enter into a game. We do not hold any money for you, we do not connect to your bank or broker, and we cannot buy, sell, or move any real assets. See our Terms for more.
Where the data comes from
Most personal data comes directly from you when you register, edit your profile, play, contact us, or submit a request. Some data comes from other players: for example, a team owner may provide your email address to invite you, provide a reason when removing a member, or take a permitted game action for another team member. We record who sent an invitation or performed an action where that is needed for the shared game record.
We also receive technical and delivery information automatically from your browser and from service providers such as Supabase, Vercel, Cloudflare and Resend. Market-data providers return information about a requested stock ticker, not information about the player requesting it.
If someone entered your email address to invite you and you do not want us to hold it, contact us using the address below. You do not have to create an account. Account email, sign-in credentials and a display name are necessary to create and operate an account; information described as optional can be omitted, although the related feature may then be unavailable.
Who can see your information
- Other team members can see information needed for the shared game, including names, avatars, roles, ball colours, game actions, simulated holdings, prices, virtual gains or losses, cards, trophies and game state. A team owner or runner may be allowed to act for another player where the game rules permit it.
- Signed-in players can see public-team information such as the team name and image, owner display name, member count and published game settings. Official leaderboards can show a player’s display name, avatar and trophy result.
- Service operators can access information when reasonably necessary to provide support, investigate abuse or security reports, operate the service, or comply with law.
Choose names, images and free-text content with these audiences in mind. Please do not submit special-category personal data or confidential real-world financial information.
External recipients and service providers
We disclose only the information needed for the relevant service. Depending on the processing, a provider may act as our processor, a subprocessor, or an independent controller for a limited purpose:
- Supabase provides authentication and database hosting. It processes account credentials, identifiers, profile, team and game records, stored communications, sessions, IP addresses, user-agents and authentication audit events.
- Vercel hosts the website and API. It processes requests and operational logs, which may include IP address, user-agent, path, query parameters, request identifiers, status, timing and hosting region.
- Cloudflare Turnstile protects sign-in, sign-up and public security-report forms from automated abuse. It receives the client IP address, user-agent, sitekey and origin, and browser or TLS signals used to distinguish people from bots. Cloudflare acts on our behalf to provide the check and may act as a separate controller for limited processing used to improve its threat-detection service.
- Resend sends and receives service and game email. It processes email addresses, message content and metadata, verification and unsubscribe requests, delivery events, bounces and complaints. Messages sent to support or reporting addresses may also be delivered to an authorised operator mailbox.
- Google Fonts supplies typefaces to the public website. When a page loads a font, the browser connects to Google and sends ordinary request information such as IP address, user-agent and the requested font resource. Google is not used by us for advertising.
- Finnhub, Yahoo and Nasdaq supply stock-market reference data. Our server sends a stock ticker or market-data request; we do not intentionally send the requesting player’s identity to these providers.
International transfers
Some providers and their subprocessors operate in the United States and other countries outside the United Kingdom. Where UK personal data is transferred to a country without UK adequacy regulations, the transfer must be covered by an approved safeguard, such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with the provider’s data-processing terms. Contact us if you would like more information about the safeguard relevant to your data.
How long we keep it
We keep personal data only for as long as it is needed for the purpose described above, taking account of the shared nature of a team game, security, dispute resolution and legal requirements. In particular:
- account, profile, membership and game records are normally kept while the account or relevant team exists and while needed to preserve the shared game record;
- pending spin records are designed to expire after about 10 minutes and are removed when the spin completes or during later cleanup;
- standard hosting request logs are normally available for a short period; Vercel’s standard runtime-log period is currently up to three days, unless a record is retained separately to investigate a fault, abuse or security incident;
- rate-limit counters last for their active security window, but the database key containing an account identifier or, for some unauthenticated actions, an IP address can remain until it is overwritten or deleted;
- email verification and invitation records are kept while needed to complete or administer the request, and delivery or support messages are kept while needed to resolve the communication;
- email suppression records are kept for as long as reasonably necessary to honour an unsubscribe, complaint or permanent-delivery failure and prevent further messages.
You can ask us to delete your account or particular information by contacting us. We will delete or anonymise information where required, but may need to retain limited records to comply with law, honour an email objection, protect the service, establish or defend legal claims, or avoid corrupting another player’s shared game record. Provider backups and logs may persist for their limited rotation periods before being overwritten.
Your rights
Under UK data protection law you may have the right to ask us to: access a copy of your personal data; correct inaccurate data; delete it; restrict its use; object to processing based on legitimate interests; or provide data you supplied in a portable form. Where we rely on consent, you may withdraw it without affecting earlier lawful processing. These rights can depend on the circumstances and are not absolute.
Some profile details and preferences can be changed in Account settings. For any other request, email us using the address below. We may need to confirm your identity and clarify the scope of the request. You also have the right to complain to the Information Commissioner’s Office (ICO).
Automated game features
The service uses random game outcomes, automatic stock-price lookups and rules-based competition rankings. These affect only the entertainment game and its virtual results. We do not use automated processing to make decisions that produce legal or similarly significant real-world effects about you.
Security
We use measures intended to protect personal data, including encrypted connections, managed authentication, access controls, rate limiting, anti-bot checks, restricted database access and security monitoring. No online service can guarantee absolute security. Please use a unique password and contact us promptly if you believe your account or personal data has been compromised.
Children
Wheel of Misfortune is intended for adults (18+) and is not directed at children. We do not knowingly collect data from anyone under 18.
Storage on your device
For details of what we store in your browser (such as your login session and storage-notice acknowledgement), see our Cookie & storage policy.
Changes
We may update this policy from time to time. When we do, we’ll change the “last updated” date above and, for significant changes, let you know in the app.
Contact
For any privacy question or to exercise your rights, email privacy@wheelofmisfortune.co.uk.