Sister Spins

Privacy Policy

Last updated: October 14, 2026.

1. What we collect

We ask for your email address and nothing more when you sign up with email. If you sign up with Facebook or Google, we receive your email address and the basic profile information those services share by default. When you play, we also collect gameplay data (which games you open, bets placed, session length) and technical data (IP address, browser type, general location derived from IP). If you buy Coins, Stripe collects your payment details directly — we never see or store your full card number. We also use cookies; see §4.

What other players can see. Your nickname and avatar (never your email address) are shown to the members of your circle: in the members list, on your posts, and when you send a card. If a friend joined through your invite link, you see her nickname and level, and she sees yours. If you choose to share your album, anyone with that link sees your nickname and your cards, until you stop sharing it.

Community posts. If you post on your circle's wall, we store your posts, replies, reactions and reports, along with the time and your account. Posts are visible to members of your circle only. We check posts automatically for links, contact details and payment information, and we keep a short excerpt of any blocked post so we can handle appeals. Deleted posts are hidden from everyone and kept only as long as needed for safety and legal purposes. Post content is never shared with advertising or analytics partners.

Gifted cards. When you give or receive an album card, we record who gave which card to whom and when. The player who receives it sees your nickname and avatar. If you send a gift link, anyone who opens it sees the card, your nickname and your avatar — never your email address or anything else about you. When you gift to someone in your circle, you'll see which members don't have that card yet.

Spending limits. If you set a spending limit, we keep each limit you set and when, so we can apply it and its 24-hour waiting period, and we compare it with your purchases before you buy Coins. The playtime reminder's clock is kept only in your own browser; we record only that a reminder was shown, and after how many hours.

Feedback you send us. If you use "Tell us what you think", we store your message and the face you picked, together with your account, the page you were on, and your browser and screen size. Our team receives it by email (sent through Brevo) along with your nickname, email address, level and coin balance, so we can understand it and reply to you. Your message is never shared with advertising or analytics partners — they only learn that feedback was sent, never what it said.

2. Why we collect it

We collect account and gameplay data because we need it to run the service you've signed up for — you can't have a Coins balance without an account, or see your play history without logging it. We use technical and analytics data on the basis of our legitimate interest in keeping the site secure, working properly, and improving it, balanced against your right to privacy. Where we use cookies or trackers that aren't strictly necessary, we ask for your consent first — see §4. We may also email you about Sister Spins — a daily gift waiting, a new album — and every such email has an unsubscribe link you can use at any time. Pausing your account stops these emails automatically.

3. Who we share it with

We never sell your details. We share data with the following processors, each under a data processing agreement, and only for the purpose stated:

  • Stripe (payments) — receives your payment details when you buy Coins.
  • Amazon Web Services and Aiven (hosting) — run our servers and our database, in the United States.
  • Cloudflare (network and security) — sits in front of our site to keep it fast and protect it from attacks; it handles your IP address and browser details as part of that.
  • Brevo (email) — holds your email address to send account email, such as receipts, and our occasional emails about Sister Spins. If you've chosen a nickname, Brevo holds that too, so our emails can greet you by it. Feedback you send us is delivered to our team through Brevo too.
  • Resend (email) — sends the one-time sign-in link when you sign in with your email address.
  • Facebook and Google (sign-in) — only if you choose to sign in with one of them.
  • Game studios (Mancala Gaming, Endorphina) — the games you play are run by the studios that make them. They receive a random account number (never your name or email address), your bets and wins in Coins, and, because the game loads from their servers, your IP address and browser details.
  • PostHog, Google Analytics (GA4), and Meta (analytics and advertising) — receive gameplay and account events. Identifiers like your email are hashed before we send them, and we don't share your raw IP address with these three. PostHog also receives a technical report when a page breaks (what went wrong, the page and your browser type), so we can fix it.

We may also share information where the law requires it, or to protect the rights, safety, or property of Sister Spins, our players, or others.

4. Cookies and tracking

We use three kinds of cookies:

  • Strictly necessary — keeping you signed in and the site working. The site can't work without them.
  • Analytics — Google Analytics (GA4), to understand how people find and use the site. (Our other analytics, PostHog, runs on our servers and sets no cookies in your browser.)
  • Advertising — the Meta pixel, to measure whether our ads on Facebook work.

You can block or delete cookies in your browser's settings; the site keeps working without the analytics and advertising ones. You can also install Google's opt-out add-on and manage how Meta uses your activity in your Facebook ad settings.

5. How long we keep it

We keep account and gameplay data for as long as your account is active, and for a period afterward where we're required to for tax, accounting, or fraud-prevention purposes. Payment records are kept by Stripe under their own retention schedule. If you delete your account, we delete or anonymise data that isn't subject to a legal retention requirement — see §6.

6. Deleting your account

You can ask us to delete your account and your personal data at any time, however you signed up — with email, Facebook or Google. Email [email protected] from the address your account uses and say you'd like it deleted. We'll confirm the request with you and complete it within 30 days.

When we delete your account, we remove your email address, nickname and avatar, your posts, and your sign-in links to Facebook or Google, and we ask Brevo and our analytics partners to delete what they hold about you. Your Coins, cards and level are gone for good and can't be restored. We keep only what the law requires — records of any purchases, for tax and accounting — and we keep them without your name or email address attached wherever we can.

If you'd like a break rather than leaving for good, you can pause your account instead — see Responsible Play.

7. Your rights

You have the right to ask us what personal data we hold about you (access), correct it (rectification), ask us to delete it (erasure, §6), receive a copy in a portable format (portability), and object to certain processing. These rights come from the GDPR, which applies to us as a company based in the Netherlands, and they're open to every player, wherever you live. We never sell your personal information. To use any of these rights, email [email protected] — we'll respond within 30 days. If you're not satisfied with our response, you can also complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens.

8. Children's privacy

Sister Spins is for players 18 and over. We do not knowingly collect information from anyone under 18. If we learn that we've collected personal data from someone under 18, we'll delete it and close the associated account as soon as we become aware.

9. Changes to this policy

We may update this policy as the service changes. If a change is material, we'll post a notice on the site and update the "last updated" date above at least 14 days before it takes effect.

10. Contact

Questions about your data? Email [email protected], or write to us at our registered address: Sannis, Foeliestraat 10, 1011TM Amsterdam, Netherlands. KvK 78627656.