Privacy Policy

Who is responsible

Wheel Cue (wheelcue.com) is run by Massimiliano Governi, a private individual based in Italy, who is the data controller for the processing described on this page under the EU General Data Protection Regulation (GDPR).

• Contact, including privacy requests: hello@wheelcue.com

No data protection officer has been appointed, because the law does not require one for a site like this.

The short version

• What you type into a wheel stays in your browser, unless you send it as a link. We do not store or read it.
• No accounts, and no cookies of ours. The site asks nobody for a name, an email address or a password.
• Cloudflare delivers and protects every page. Like any web host, it processes the technical data of each request, such as your IP address. We keep no logs of our own.
• Visits are counted without cookies, with Cloudflare Web Analytics. We see totals only, and it does not run inside embedded wheels.
• There is no advertising yet. When it starts, it will follow the rules described below, and it will not run on the four pages made for students, on shared wheels or in embedded wheels.

What stays in your browser

Wheel contents. Names, entries, options and results are held in the open page while you use it. They are not uploaded, and we never see them.

Saved wheels. Pressing Save writes the wheel into your browser's local storage, on that browser, on that device. We cannot read it. Deleting it from the Saved wheels panel, or clearing this site's data in your browser, removes it.

Accounts: there are none. No sign-up, no email address, no password.

Share links

Send this wheel builds a link that carries the entries and, if you type one, the question. They sit after a "#" in the link (for example /tools/decision-wheel/#w=…), a part of the address that browsers keep to themselves: when someone opens the link, the request sent to the server does not include the list, so it does not reach Cloudflare or us.

Older links carry the list after "?w=" instead. They still work. When one is opened, that first request, and the requests for the page's own files made while it loads, reach Cloudflare with the list in the address, like any page address, and can appear in its request logs; the page then moves the list after the "#" in the address bar. We do not read, keep or use these addresses.

The services you send a link through receive the whole link, list included. If you send it through an app, such as WhatsApp, Google Classroom or Microsoft Teams, that service receives the link, and the message text, as soon as its share window opens, even if you then cancel, and handles them under its own privacy policy. Some services also fetch the page to show a preview; that request does not include the part after the "#", but the service already holds the link itself.

This matters if the entries are student names or entrant handles: treat the link like the list it contains, and only send it to people who should have it. If a wheel contains other people's names or details, you are responsible for having their permission to share them.

Embedded wheels

The embed code also puts the list after a "#", so it is not sent to a server either. Anyone who views the code of a page with an embedded wheel can still read the list, so on a public page use first names or numbers.

Cloudflare delivers the embedded wheel, so it receives the IP address and browser data of each visitor of a page that shows one, and uses them to deliver the wheel and protect it from abuse, as described under Hosting, delivery and security. No analytics and no advertising run inside an embedded wheel, and the wheel itself stores nothing on the visitor's device. If Cloudflare's automated security check runs there, it keeps a temporary identifier in session storage, as described under Hosting, delivery and security.

Hosting, delivery and security

Every page is delivered by Cloudflare, Inc. (Cloudflare Pages and the Cloudflare network). To deliver pages, keep the site secure and stop automated abuse, Cloudflare processes the technical data of each request: IP address, date and time, the address requested, the referring page, and browser and device type.

On some pages Cloudflare also runs a short automated security check in your browser to tell people from bots. It keeps a temporary identifier in your browser's session storage, which is deleted when you close the tab. If Cloudflare ever needs to show you a security challenge, it may also set a strictly necessary security cookie to remember that you passed it. Browsers may also send Cloudflare a report when a page fails to load.

Cloudflare acts as our processor under its Data Processing Addendum. We do not keep or export request logs. Cloudflare's dashboard shows us traffic totals and can show individual security events, such as a blocked request and the address it came from; we use them only to keep the site working and secure. Cloudflare keeps its own logs for a limited period under its own policies.

Legal basis: our legitimate interest in running a website that works and is secure (GDPR Art. 6(1)(f)).

Analytics

We count visits with Cloudflare Web Analytics. It sets no cookies, stores nothing on your device and does not follow you across sites. Before anything is recorded, it removes everything after "?" and "#" from the page address and from the referring address, so the contents of a wheel are never included, even from a shared link. It records the page visited, the referring site, the country, the browser, the device type and how fast the page loaded, and Cloudflare sees your IP address as it does for any request. We see only totals.

It does not run inside embedded wheels.

Legal basis: our legitimate interest in knowing which pages are useful (GDPR Art. 6(1)(f)).

Email

If you write to us, we use your address and your message only to reply and to deal with what you asked: our legitimate interest in answering (GDPR Art. 6(1)(f)), or, for a privacy request, our legal obligation to handle it (Art. 6(1)(c)).

Email is stored by the email services that carry it. Messages to hello@wheelcue.com are forwarded by Cloudflare Email Routing to a mailbox provided by Google. We delete correspondence periodically, within 12 months of the last message, unless we need it longer to deal with a dispute or a legal claim.

Storage on your device

Wheel Cue sets no cookies of its own. Your browser's storage is used only for these:

• cue.theme (local storage): your light or dark choice, saved when you press the theme button and kept until you clear this site's data.
• cue.saved.v1 (local storage): the wheels you save, up to 60, kept until you delete them or clear this site's data.
• A temporary security identifier (session storage), set by Cloudflare's security check and deleted when you close the tab.
• A security cookie, set by Cloudflare only if it has to show you a security challenge, to remember that you passed it.

These are strictly necessary for features you use or for the site's security, so they need no consent (Art. 122 of the Italian Privacy Code; Art. 5(3) of the ePrivacy Directive). Advertising cookies, once advertising starts, are described under Advertising.

Who receives data

• Cloudflare, Inc., for hosting, delivery, security, Web Analytics and Email Routing, as our processor.
• Google, which provides the mailbox where email sent to hello@wheelcue.com arrives.
• Google AdSense, once advertising starts, as described under Advertising.
• The services you choose to send a link through, such as WhatsApp, Google Classroom or Microsoft Teams, which receive it from you directly, under their own terms.

We do not sell personal data, and we share it with no one else unless the law requires it.

International transfers

Cloudflare, Inc. and Google LLC are based in the United States, and data may be processed there and in other countries where they operate. Transfers to the United States rely on the EU-US Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795), under which Cloudflare, Inc. and Google LLC are certified, and, for Cloudflare, also on the EU Standard Contractual Clauses included in its Data Processing Addendum.

How long data is kept

• Wheel contents: not kept by us at all.
• Storage on your device: until you delete it or clear this site's data, or until you close the tab for session storage.
• Request data: we keep no logs ourselves. Cloudflare keeps its logs for a limited period under its own policies.
• Analytics: totals only, kept in Cloudflare's dashboard for as long as Cloudflare offers them.
• Email: deleted within 12 months of the last message, unless needed longer for a dispute or a legal claim.

Advertising

Wheel Cue is free and will be supported by advertising from Google AdSense. Advertising is not switched on yet: no ad code loads and no ad space appears on any page today.

Once it is on, ads will appear only in the written part of a page: between its sections, and under the heading of the guides. They will stay well away from the wheel and its buttons, with none in the result window, in a sidebar or in a bar fixed to the screen. There will be no ads on the classroom page, the student picker, the team generator, the classroom jobs wheel or the embed builder, on any wheel opened from a shared link, or in embedded wheels.

Google (Google Ireland Limited, and Google LLC in the United States) will act as an independent controller for the ads it serves, under its own policies (how Google uses information from sites that use its services). It may set cookies or similar identifiers in your browser and use them, together with your IP address, to show and measure ads, to limit how often you see the same ad and to prevent fraud. Where the law requires consent for this, consent will be asked for before advertising cookies are used, as described below (GDPR Art. 6(1)(a)).

We will not pass anything you type into a wheel to an advertising provider. We do not receive wheel contents, and ads will not load on a wheel opened from a shared link, so a list in a link cannot end up in an ad request.

The ads.txt file at the root of this site lists which sellers are authorized to sell our ad space.

Your advertising choices

Advertising is not switched on yet, so today there is no consent message and no opt-out link, and nothing is shared with an advertising provider. Once it is on, Wheel Cue will pass the choices the law gives you through to its advertising provider rather than deciding on your behalf.

In the EU, the UK and Switzerland, a consent message from Google will appear on your first visit. Google's advertising code loads in order to show that message, but advertising cookies will be used only if you accept. If you refuse, Google may still show ads that are not personalized, under its own rules for limited ads. A Privacy settings link at the bottom of every page will let you change your choice at any time.

In US states with applicable privacy laws — California, Colorado, Connecticut, Virginia and a growing list of others — you have the right to opt out of the "sale" or "sharing" of your personal information.

To be precise about what that means here: nobody pays us for a list of visitors, and we do not sell personal information in the everyday sense of the phrase. But personalized advertising involves sharing identifiers such as cookie IDs and your IP address with advertising partners, and several of those state laws define exactly that as a sale or a sharing. So once advertising is on, we will either honor that right, with a Do Not Sell or Share My Personal Information link on every page and by respecting the Global Privacy Control signal your browser can send, or show only non-personalized ads in those states, so that there is nothing to opt out of. This page will say which before advertising starts.

Either way, the wheels themselves are unaffected. Names, entries and results are not sent to us or to an advertising provider, with or without advertising, so there is nothing there to sell or share.

Children and classrooms

Wheel Cue is used in schools, so this is worth being explicit about.

Wheel Cue is a general-audience site written for adults: teachers, parents and organizers. It has no accounts and never asks anyone, of any age, for a name, an email address or other details. Like every website, it receives the technical data described under Hosting, delivery and security, including an IP address, from every visitor, and that data is used only to deliver and protect the site and to count visits. Class rosters typed into the student picker are never uploaded or stored by us.

The things to be careful about are share links and embed code. A link or an embedded wheel made from a wheel of student names carries those names inside it. Do not post such a link publicly, and on a public page use first names or numbers. Posting a link through Google Classroom or Microsoft Teams puts it, names included, in that service, under your school's own agreement with Google or Microsoft.

When advertising starts, there will be none on the pages made for classroom use (the classroom hub, the random student picker, the random team generator and the classroom jobs wheel), on any wheel opened from a shared link, or in embedded wheels.

If your school or district requires a vendor assessment: we hold no student records, no accounts and no copies of wheels. What reaches our web host is the standard request data any web page generates, described above, which for an older "?w=" link includes the list in its address.

If you are a parent or teacher and believe a child's personal information has reached us, for example in an email, write to hello@wheelcue.com and we will delete it.

Your rights

Under the GDPR you can ask for access to your personal data, for its correction or erasure, for its use to be restricted and for a copy in a portable format, and you can object at any time to processing based on our legitimate interests (Arts. 15 to 21). Where processing is based on your consent, you can withdraw it at any time, without affecting what was done before.

To use these rights, write to hello@wheelcue.com. We reply within one month. Because we do not receive the contents of your wheels and cannot link request data to a name, we may need more details from you, such as when you visited, to find data about you, and we may be unable to find any (GDPR Art. 11).

You can also complain to the Italian supervisory authority, the Garante per la protezione dei dati personali (garanteprivacy.it), or to the supervisory authority of the EU country where you live or work.

You do not have to give us any personal data. The request data described above is needed for your browser to receive pages at all, and writing to us is optional. No decision with legal or similarly significant effects is made about you by automated means.

Outside the EU

If you are in Canada (including Quebec), the United States or Australia, the person responsible for privacy at Wheel Cue, and for questions under your local privacy laws, is Massimiliano Governi, at hello@wheelcue.com.

Your choices

• Delete saved wheels by removing them from the Saved wheels panel, or by clearing your browser's site data for this domain.
• Avoid share links if the entries are sensitive.
• Use the site without saving anything — every tool works without pressing Save.
• Make your advertising choices, once advertising is on, as described under Your advertising choices.
• Ask a question or use your rights at hello@wheelcue.com.

If this policy changes materially, the date at the top of this page will change with it.