Privacy Policy
Last updated: 2026-08-10
1. Summary
SpinTheNugget is a party game operated by SOSA PROJECTS, LLC. It has accounts, optional purchases, and online play, so it does hold data about you. This page sets out exactly what, why, who touches it, and how to get rid of it.
- We do not sell your personal data.
- There is no advertising network in the app.
- We do not record audio or video. Prompts are answered out loud, offline, between you and the people in the room.
- You can delete your account from inside the app.
2. What we collect
Account
When you create an account we store your display name, email address, and a cryptographic hash of your password — never the password itself. If you sign in with Apple or another provider instead, we store the identifier that provider gives us rather than a password. We also store your time zone, so scheduling and timestamps make sense to you.
Profile photo
Setting a profile photo requires access to your camera or photo library. We request that permission only at the moment you choose a picture, and we upload only the image you select — never your wider photo library. The image is resized on your device and stored in Firebase Storage.
Purchases
Buying a pack or unlock tokens creates a transaction record: the product bought, the platform, the store's transaction identifier, and the receipt we use to verify the purchase is genuine. We also store what you own as a result — your packs, your token balance, and unlocked items. We never see or store your card details; payment is handled entirely by the app store.
Referrals
If you use a referral code, we store the code and the link between the account that shared it and the account that redeemed it, so the reward can be granted and abuse can be spotted.
Notifications
If you allow notifications, your device is issued a push token that we store so we can send game invites, new content announcements, and account notices. Turning notifications off in your system settings stops them, and you can remove the token from within the app.
Usage analytics
We record product events — games created, joined, started and ended; shop and purchase steps; referral actions; account lifecycle events — using PostHog. This is tied to a pseudonymous account identifier and is used in aggregate to see what people play and where the app frustrates them. We do not use it to build advertising profiles.
3. Playing with other people
When you host or join a lobby, your display name and profile photo are shown to the other players in that lobby, along with the in-game activity needed to run the round. Treat both as public to the people you play with, and do not use a photo or name you would not want them to see.
The game itself is played out loud, in person. We do not capture microphone or camera input during play, and there is no chat transcript.
4. Why we are allowed to hold it
Where the GDPR applies, our lawful bases are: performing our contract with you (running your account, delivering what you bought), your consent (notifications, camera and photo access — each revocable), and our legitimate interests (keeping the service working, preventing fraud and referral abuse, and improving the game). Legal obligations cover the purchase records we must keep.
5. Who processes it for us
We keep this list short deliberately. Each provider acts on our instructions and under its own security commitments:
- Google Firebase — sign-in, profile photo storage, push delivery.
- PostHog — product analytics.
- Plunk — transactional email such as verification and password resets.
- Apple — Sign in with Apple, and all payment processing.
These providers may process data outside your country, including in the United States. We rely on their standard contractual clauses and equivalent safeguards for those transfers.
6. Deleting your account
You can delete your account from inside the app. Doing so does three things immediately: your account is marked deleted and can no longer be used, every signed-in session everywhere is invalidated, and your push tokens are erased — so nothing can contact your device again.
Being straight with you about what that does not do: it is a deactivation, and some records — your email address, display name, profile image reference and purchase history — remain in our database afterwards. Purchase records in particular have to be kept for tax and accounting purposes, and retaining the account row is what stops a deleted email being silently re-registered.
If you want those remaining records erased rather than deactivated, use the deletion request in the app or email us directly. That reaches a person, and we will erase what we are not legally required to keep. Backups age out on their own cycle, so a copy may persist there briefly after erasure.
7. How long we keep things
- Account records — until you delete the account, then as described above.
- Sessions, verification codes, and password reset tokens — these expire on their own, quickly.
- Push tokens — until you disable notifications or delete your account.
- Purchase records — as long as tax and accounting rules require.
- Analytics events — retained in aggregate.
8. Security
Passwords are stored only as hashes. Traffic between the app and our servers is encrypted in transit. Sessions can be invalidated remotely, and are invalidated everywhere when you delete your account or change your password. No system is perfect, and we will not pretend otherwise — but we do not hold card details, which removes the most damaging thing we could lose.
9. Age
SpinTheNugget is rated 17+ and is intended for adults. It is not directed at children and we do not knowingly collect information from them. If you believe a child has an account, email us and we will remove it.
10. Your rights
Depending on where you live, you may have the right to access, correct, export, or delete your personal data, to object to or restrict certain processing, and to withdraw consent at any time. Email us and we will action it within the period the law requires. Exercising these rights costs nothing and will not degrade the app for you.
Because we do not sell personal data or share it for cross-context behavioural advertising, there is no opt-out for that to offer. If you are in the EU or UK and think we have got something wrong, you may also complain to your local data protection authority.
11. Changes
If the app changes in a way that affects this policy, we will update this page and the date above before that version ships. Material changes to what we collect will be disclosed here first.
12. Contact
SOSA PROJECTS, LLC
Email: [email protected]