Spin and Wheel for Slack — Privacy Policy

Last updated: November 13, 2026

This policy covers the Spin and Wheel Slack app (the /spinandwheel slash command, the “App”). It explains what happens to data when you install and use the App. The website spinandwheel.com, including pages you open from a result in Slack, is covered by the website privacy policy. “We” and “us” mean Spin and Wheel, operated from Ukraine.

Summary

• The App asks Slack for one permission only: to add the /spinandwheel slash command (commands scope). It cannot read your messages, channels, files or member list.
• We do not store your entries or results. There is no database.
• The access token Slack issues on install is discarded right away.
• We keep short technical logs for 30 days. They never contain your entries.
• No ads, no tracking, no selling of data inside Slack.

1. What Slack sends us

When someone types /spinandwheel, Slack sends the App a request with the text after the command (your entries) and context about the request: workspace ID and domain, channel ID and name, user ID and username, and technical fields Slack adds to every slash command. Slack signs each request, and we reject requests whose signature does not match.

We use the text only to work out the result (a winner, an order, teams or a number) and to send it back to Slack in the same response. The App then forgets it.

2. What we keep

Our server writes one log line per request so we can fix errors, protect the service from abuse and count usage. A log line contains:

• the kind of request (command, install, wheel image) and whether it succeeded, with an error reason if it did not;
• the command mode (pick, order, teams, number, help) and the number of entries;
• the Slack workspace ID (for commands and installs);
• the time it took, plus the request ID, duration and memory use that AWS Lambda adds to every run.

Logs never contain the entries, results, channel names, user IDs, user names, message text or IP addresses. They are deleted automatically after 30 days.

We process this data on the basis of our legitimate interest in running the App, keeping it secure and fixing errors (Article 6(1)(f) GDPR).

3. Installing the App

When you click “Add to Slack”, Slack asks you to approve the App. After you approve, Slack sends the App an access token for your workspace. The App does not need it to answer slash commands, so it discards the token without storing it. We log the workspace ID of the install. A cookie with a random value protects the install against cross-site request forgery. It is only sent to our install pages, expires after 10 minutes and is deleted when the install finishes.

4. Results and the wheel image

• Results are posted to the conversation where the command was typed, together with the command you typed, so the people in that conversation see your entries and who spun the wheel. Help and error messages are shown only to you.
• Messages in Slack, including results from the App, are stored by Slack under your workspace’s settings and Slack’s privacy policy. We cannot see, edit or delete them.
• A winner result shows an animated wheel. Its image address contains the entries and the result in encoded (not encrypted) form with a signature, so that only wheels the App drew can be rendered. Anyone who has the image address can read the entries from it, just like the message itself. Slack loads the image from our server, which draws it on the fly, does not store it and does not log its address. The image is marked as cacheable, so Slack may keep a copy.
• A result can include an “Open this wheel” link to spinandwheel.com with the same entries in the address. Opening it is your choice; the website privacy policy applies there.

5. Service providers

The App runs on Amazon Web Services (AWS Lambda, API Gateway and CloudWatch Logs) in the United States (region us-east-1). AWS processes the requests and logs described above on our behalf under the AWS Data Processing Addendum, which includes the EU Standard Contractual Clauses for transfers outside the EU. Slack delivers the commands and messages. We do not share data with anyone else and do not sell it. We may disclose information only if the law requires it.

6. Uninstalling

An admin or member with permission can remove the App in Slack: Tools & settings → Manage apps → Spin and Wheel → Remove app. Nothing is left on our side apart from the logs described above, which expire within 30 days.

7. Your rights

Depending on where you live (for example under the GDPR or the CCPA), you may have the right to access, correct or delete your personal data, to object to its use and to complain to a data protection authority. Our logs hold Slack workspace IDs only, so we can find or delete data about a workspace if you tell us its ID. Email us and we will reply within 30 days.

8. Security

All traffic between Slack, our server and your browser is encrypted (HTTPS). Every request from Slack is verified with Slack’s signing secret. Our secrets are kept in the hosting configuration and are never sent to the browser.

9. Children

The App is meant for Slack workspaces and is not directed at children under 13.

10. Changes

If we change how the App handles data, we will update this page and the “Last updated” date. A change that needs more access (a new Slack permission) also requires you to approve it again in Slack.

11. Contact

Spin and Wheel, operated from Ukraine is responsible for (the “controller” of) the personal data described here. Email: spinandwheel@gmail.com. Help with the App: Spin and Wheel for Slack support. Terms: terms of service.