Privacy Policy

This Privacy Policy explains how WinSpin collects, uses, and shares information when you visit or play the game at winspin.net, www.winspin.net, and app.winspin.net (together, the “Service”).

WinSpin is operated by Health Intellect LLC. Contact: Health Intellect LLC, Health Intellect #2118, 2309 Gilmer Rd, Ste 101, Longview, TX 75604.

What WinSpin is

WinSpin is a free social / entertainment video-slot game. You play with virtual credits that have no cash value. There is no real-money gambling, no cash-out, and no redemption of credits for money or prizes of value. The Service is for entertainment only.

You do not need an account

You can play without creating an account. We do not collect payment-card numbers or other payment details today. There is no checkout on the Service. Guest play still uses a server guest ledger (see below); it is not “device-only credits.”

Guest play (no account)

When you play as a guest, the game mints an opaque anonymous identity (guest_id + secret) and stores that pair in your browser (localStorage / device storage) so the same session can be restored. Your virtual credit balance, play state, play receipts, rewarded-ad intents, and provider transaction IDs are stored on our PocketBase server at app.tsnc.net — not only on your device. New guests receive a one-time server starter grant of virtual credits; refresh or reopen restores the same ledger and does not refill that starter. After you spend down, guest credits top up only through the optional rewarded-ad paths described under Advertising (mobile Google Ad Manager with server-side verification, or desktop H5 Games Ads with small server caps). There is no free guest top-up fallback and no invasive device fingerprinting.

Clearing site data or opening a new private window deletes the browser-held identity keys, so the next visit mints a new guest identity with its own one-time starter. That does not restore a depleted prior identity, and a normal refresh or reopen of the same browser profile keeps the same ledger (including a zero balance). This limitation is intentional and disclosed: we do not fingerprint devices, and we do not require sign-in to receive the guest starter, so we do not claim to prevent someone from obtaining another starter by clearing site data or using a new private session.

Accounts

If you choose Create account from MENU, we store your email, a hashed password (PocketBase), virtual credits, age and analytics consents, and an optional display name so they persist across devices and refreshes. This account data is stored on our PocketBase server at app.tsnc.net. You can request deletion of your account and related records via the operator (contact via winspin.net). While you are signed in, your browser's localStorage also holds your PocketBase session token (winspin-pb-auth, so you stay signed in across reloads) and a copy of your latest account balance (winspin-acct-balance, so a closed tab doesn't lose it). Both are removed or replaced when you sign out or the balance is saved; anyone with access to this browser profile could use the token until it expires. The 18+ box is a self-declaration we record with a timestamp; we cannot verify age.

Information we collect

We collect a limited set of information needed to run and improve the game:

• Google Analytics 4 (Measurement ID G-JJ2FGYSQWP). Google may receive your IP address (typically truncated by Google), device and browser type, pages viewed, approximate location, and engagement events such as visits and time on page. Google processes this as our analytics provider.
• localStorage on your device. The game stores preferences such as mute, age confirmation, analytics-notice dismissal, rewarded-ad frequency caps, guest identity keys (winspin-guest-id, winspin-guest-secret), and similar UI settings in your browser. Guest balances are not kept as the authority in localStorage — they live on the server guest ledger. Clearing site data removes these keys (see Guest play).
• Guest ledger on the server. For anonymous play we store opaque guest identity secrets, virtual credits, play state, play receipts (to prevent double-spend of the same request), rewarded-ad intents and grant counters, desktop H5 grant counters and idempotency tokens, and Google Ad Manager SSV transaction-ID tombstones on PocketBase at app.tsnc.net.
• Optional account. If you create an account, we store your email, hashed password, credits, consents, and optional display name on PocketBase at app.tsnc.net (see Accounts above).
• Optional display name and score. If you use MENU to save a score, the name you type and your current credit score are sent to a leaderboard backend (PocketBase at app.tsnc.net) so they can appear on the High Rollers list. Do not enter a name you do not want shown publicly.
• Advertising (display and rewarded). On wide desktop viewports we may show fixed 160×600 Google AdSense display banners beside the game under publisher account ca-pub-2623804956468270. Separately, a rewarded ad may play when you choose WATCH AD on the game deck, and may also be offered when your credits drop below the smallest bet. For guests on mobile / GPT-capable browsers, credits grant only after a Google Ad Manager rewarded view that Google verifies with a server-side verification (SSV) callback; a browser event such as rewardedSlotGranted is not itself credit proof. For guests on desktop / GPT-unsupported browsers, the game uses Google H5 Games Ads / AdSense (Ad Placement API, adBreak type reward); that path has no SSV and is bounded by small server caps (see Advertising below). For signed-in players, rewarded ads may also use H5 Games Ads / AdSense. Google may process device and network information to select, deliver, and measure ads. Dismissing a rewarded ad earns nothing from that view. There is no free guest top-up outside these ad paths.
• Top-up and grant records. For guests the server stores ad intents, cooldown/daily counters (including separate H5 counters), H5 idempotency tokens, and SSV transaction-ID tombstones so a replayed callback or claim cannot pay twice. For signed-in players the server keeps a rolling per-player top-up record (time, UTC-day count, retry token) plus lifetime totals and permanent retry-token storage for the same anti-replay purpose. Mobile guest GAM grants require a verified Google SSV callback. Desktop guest H5 grants and signed-in browser-reported views are bounded by server caps because those paths cannot independently prove every ad network view.

Cookies and similar technologies

We use cookies and similar technologies for Google Analytics (for example, to distinguish visits and remember a client identifier). The game also uses browser localStorage for the preferences and guest identity keys described above and your session token. Google AdSense (including the wide-desktop 160×600 display rails), Google H5 Games Ads, and Google Ad Manager (when guest rewarded ads are enabled) may set their own cookies or advertising identifiers when ads are shown. You can block or delete cookies and site data in your browser settings. Blocking analytics cookies does not stop you from playing. Blocking ad cookies may mean a display or rewarded ad cannot fill. Clearing site data ends the current guest identity on this device (see Guest play).

Third-party vendors, including Google, use cookies to serve ads based on a user’s prior visits to this website or other websites. Google’s use of advertising cookies enables it and its partners to serve ads based on visits to this site and/or other sites on the Internet. Users may opt out of personalized advertising by visiting Ads Settings and/or www.aboutads.info.

How we use information

• Operate the game, including the server guest ledger and optional accounts, and show the leaderboard when you choose to save a score.
• Understand usage (pages, devices, engagement) so we can improve the product.
• Remember your age confirmation, mute setting, and similar UI preferences.
• Deliver AdSense display banners on wide desktop layouts and rewarded ads when you choose to watch one (or when credits run low).
• Enforce ad / top-up cooldowns and daily caps; for mobile guests, credit only after a verified Google Ad Manager SSV callback; for desktop guests, apply the capped H5 grant rules described under Advertising.
• Maintain security and diagnose technical issues.

How we share information

We share information only as needed to run the Service:

• Google, as the processor for Google Analytics 4 and, when AdSense display banners, H5 Games Ads, or Google Ad Manager rewarded ads are shown, as the ad provider. For guest GAM SSV, we share an opaque guest id and a short-lived reward session token so Google’s callback can be matched to the correct ledger intent. Google may process device and IP information to select and measure those ads.
• Hosting, CDN, and infrastructure providers that deliver the website and the PocketBase backend at app.tsnc.net (guest ledger, accounts, leaderboard).
• If required by law, or to protect the Service and other players.

We do not sell personal information. Google (AdSense / H5 Games Ads / Ad Manager) may use device and advertising identifiers to select and measure ads, which some state laws treat as “sharing.” You can limit this with browser controls and Google’s ad settings.

Retention

• Analytics data is retained according to Google Analytics defaults for this property unless we change that setting later.
• Leaderboard names and scores remain until they are removed by the operator or the Service is discontinued.
• localStorage data remains on your device until you clear it or we change the keys the game uses.
• Guest ledger retention. Active guest balances and identity rows remain while the Service needs them to operate play. We apply bounded pruning that may trim oversized play-state payloads, expire abandoned ad intents, and drop old claimed intent rows after a retention window — without reopening replay grants, wiping an active balance, or silently replenishing an expired identity. Provider transaction-ID tombstones and play-receipt uniqueness keys are kept as needed to prevent double payment. Migrate-down archives redact guest secrets (they are not stored in plaintext in archive tables).

Advertising

WinSpin uses Google advertising under AdSense publisher account ca-pub-2623804956468270:

• Desktop display banners. On wide desktop viewports only, fixed 160×600 AdSense display units may appear in rails beside the game. They are not shown on narrow or mobile layouts, and they do not sit on top of game controls.
• Rewarded ads (WATCH AD). You can start a rewarded ad from the WATCH AD button on the game deck, and the game may offer one when your credits fall below the smallest bet. The credit amount shown on the button is a display hint; the server decides the grant. Credits have no cash value.

Guests — mobile / GPT-capable: Google Ad Manager serves a rewarded web ad on an operator-configured child unit. Credits grant only after Google’s verified server-side verification (SSV) callback reaches our PocketBase endpoint. A client “viewed” or rewardedSlotGranted signal alone cannot unlock that path. Default grant is +500 virtual credits, subject to the shared guest cooldown and daily cap.

Guests — desktop / GPT-unsupported: Google H5 Games Ads (Ad Placement API, adBreak type reward) may fill. That path has no signed SSV proof. Default server caps are +100 credits per completed view, a 600-second cooldown, at most 5 H5 grants per guest per UTC day, and only when the guest balance is below 15 (the smallest bet). There is no free guest top-up outside these ad paths. If ads are unavailable, fail, or are dismissed, guests do not receive credits from that attempt.

Signed-in players: Google H5 Games Ads / AdSense may fill; a low-balance free top-up path may still apply for accounts when no ad is shown, subject to cooldown and daily cap. Watching ads is always optional: you can stop playing at any time.

Children and age

The Service is 18+ only (or older where the law requires a higher age). It is not directed at children under 13, and we do not knowingly collect personal information from children under 13 (COPPA). If you believe a child has provided information, contact the operator via winspin.net and we will delete it where we can.

Your rights

Depending on where you live (including California and other U.S. states), you may have the right to request access to, correction of, or deletion of personal information we hold, and to opt out of sale or sharing (we do not sell). To make a request, contact the operator via winspin.net. We may need enough information to find the relevant records (for example, a leaderboard display name).

To limit Analytics:

• Use your browser’s cookie or tracking-protection controls, or a content blocker.
• Use Google’s opt-out tools, such as the Google Analytics Opt-out Browser Add-on, where available.

International users

The Service is hosted in the United States. If you access it from another country, your information may be processed in the U.S., which may have different data-protection rules than your home country.

Changes

We may update this policy from time to time. When we do, we will change the “Last updated” date at the top of this page. Continued use of the Service after a change means you accept the updated policy.

Contact

WinSpin, operated by Health Intellect LLC — Health Intellect #2118, 2309 Gilmer Rd, Ste 101, Longview, TX 75604.

This policy is provided for the WinSpin service. It is not personalized legal advice, and you should not treat it as advice about your own situation.