Privacy Policy

1. Introduction

SpinBox s.r.o. ("Juice Game", "we", "us", or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data when you use our platform, including the spin boxes, Banana Battle and the kink test.

This policy complies with the General Data Protection Regulation (GDPR) (EU) 2016/679 and other applicable data protection laws.

2. Data Controller

The data controller responsible for your personal data is:

All the ways to reach us about your data are listed in Section 17.

3. Data We Collect

3.1 Information You Provide

• Account Information: Email address, display name, the gender you choose during onboarding, your password (stored only in hashed form by our sign-in provider, never visible to us) and when you confirmed that you are 18 or older and accepted our Terms
• Profile Information: Display name, profile picture, bio (optional)
• Creator Applications: Profile and contact details, social media links, identity verification (see Section 7) and payout details: the IBAN and account holder name for SEPA payouts, and your VAT number if you provide one
• Kink Test (optional): Your answers and result, only if you choose to save them (see Section 6)
• Banana Battle: Photos you submit, which are shown publicly next to your username, and your battle results and rankings
• Communications: Help Desk messages, support and content removal requests, feedback

3.2 Information Collected Automatically

• Usage Data: Pages visited, features used, spin history, items won, content interactions
• Device Information: IP address, browser type, operating system, device identifiers
• Where You Came From: The invite code, campaign tags or shared link that first brought you to the platform (see Section 10)
• Cookies and Similar Technologies: See Section 10
• Log Data: Access times, error logs, referring URLs

3.3 Information from Third Parties

• Identity Verification (creators): The verification result and the data read from your identity document, from Didit (see Section 7)
• Google Sign-In: Your name, email address and profile photo, if you choose to sign in with Google
• Payment Providers: None at the moment, because no payment provider is connected yet (see Section 8)

4. Legal Basis for Processing

We process your personal data based on the following legal grounds:

• Contract Performance: To provide our services, process transactions, and manage your account
• Legal Obligation: To comply with laws (e.g., age verification, tax reporting, 2257 record-keeping)
• Legitimate Interests: To improve our services, prevent fraud, ensure security, credit referrals, and send service communications
• Consent: For analytics (see Section 10) and marketing communications. You can withdraw consent at any time
• Explicit Consent (Art. 9(2)(a) GDPR): For saving your kink test result, which concerns your sex life and sexual orientation (see Section 6)

5. How We Use Your Data

• Service Provision: Create and manage accounts, process spins and battles, deliver content
• Verification: Verify the age and identity of creators for legal compliance
• Payments and Payouts: Hand out credits, pay out creator earnings, prevent fraud
• Referral Program: Credit the creator who invited another creator
• Communication: Send service updates, respond to inquiries, provide support
• Security: Detect and prevent fraud, abuse, and unauthorized access
• Improvement: Analyze usage patterns (with your consent where required), improve features, develop new services
• Legal Compliance: Meet regulatory requirements, respond to legal requests

6. The Kink Test (Sensitive Data)

The kink test is optional. Your answers reveal information about your sex life and sexual orientation, which the GDPR treats as a special category of personal data (Art. 9). We handle it as follows:

• Before You Save: Until you save a result, your answers stay in your browser and are not sent to us. You can take the test without an account.
• Explicit Consent: We store your result only if you tick the consent box when saving it. If you tick it before signing in, your result is saved once, automatically, after you sign in or create an account (it never replaces a result your account already holds). Without that consent nothing is stored on our servers.
• What We Store: Your individual answers, the result calculated from them (a score for each role, your strongest roles, the gender you selected and your orientation as you answered it) and the date. The gender you select is also saved to your profile if it does not have one yet.
• Who Can See It: Your result is not shown to other users or creators unless you share it yourself. A share link shows your result profile, without your name or account details, to anyone who has the link and lets them compare with you; you can revoke it at any time. Creators can also switch on a badge that shows their strongest role on their public creator profile; it stays off until they switch it on. A revoked link and its preview image can stay visible for a few minutes (up to about 10) while cached copies expire.
• Staff Access: A small number of authorised Juice Game administrators can access saved results, including individual answers, when needed for support, safety or abuse handling. We never sell this data or use it for advertising.
• Analytics: If you allow analytics (see Section 10), we only record steps such as starting, finishing, saving, sharing or comparing the test, never your answers, roles or scores, and share links are removed from the page addresses we record.
• Partner Comparison: The comparison with someone else's shared profile is calculated in your browser and is not stored.
• Retaking the Test: A new saved result replaces the previous one, and an existing share link then shows the new result.
• Deletion and Withdrawal of Consent: You can delete your saved result at any time with "Delete result" in the test. This also removes your share link and badge (cached copies of the link can stay visible for a few minutes) and withdraws your consent (without affecting processing that took place before). When your account is deleted, your result, answers and share link are deleted with it at the end of the 30-day recovery period.

7. Identity Verification (Didit)

Identity verification is currently required only from creators. It is carried out for us by Didit (didit.me), which acts as our processor.

• What Is Collected: Photos of your identity document (front and back) and the data printed on it (full name, date of birth, gender, document type and number, personal number where printed, issue and expiry dates, issuing country, nationality and address where printed), a live selfie and a short liveness video, the result of comparing your face with the document photo, your verified phone number, and technical data from the session such as your IP address and its approximate location.
• Why: To confirm that you are 18 or older and the person you say you are, to check that content features the verified creator, to prevent fraud and impersonation, to make sure payouts go to you, to determine the country used for referral rates, and to meet our legal obligations.
• Biometric Data: Comparing your selfie with your document photo involves biometric data. It is used only for this check.
• Legal Basis: Performance of the creator agreement (you cannot become a creator without verification), our legal obligations to verify age, and our legitimate interest in preventing fraud.
• Where It Is Kept: Didit returns the result to us, and we keep a copy of the data, images and video in our own secured storage on Google Cloud. Only authorised administrators who review creator applications can access it.
• Retention: For as long as your application is open or you are a creator, and afterwards for up to 7 years, to meet record-keeping obligations and to defend legal claims.

8. Payments

• Test Mode: Payments currently run in test mode. No payment provider is connected, Juice Points are handed out free of charge as test credits, and we do not collect card or bank details from fans.
• Test Earnings: Creator earnings generated with test credits are never paid out.
• Creator Payouts: We use your IBAN and account holder name only to pay out your earnings and for our accounting and tax records.
• Before Real Payments Start: Before we connect a payment provider, we will update this policy and name the provider. Card details will then be entered directly with that provider and will not be stored by us.

9. Service Providers and Data Sharing

We share personal data only with the service providers we need to run the platform, who process it on our behalf, and in the other cases listed here:

• Hosting and Infrastructure: Cloudflare (delivers and runs the website) and Google Cloud / Firebase (sign-in, our main database, located in the EU, server functions, which run mostly in the EU, and file storage, including the copies of identity verification data)
• Media Hosting: Bunny.net (private storage and delivery of creator content, and video streaming through Bunny Stream) and Cloudinary (processing of uploaded images and videos, previews and blurred versions, and Banana Battle photos)
• Identity Verification: Didit, for creators only (see Section 7)
• Analytics: PostHog, hosted in the EU, only with your consent (see Section 10)
• Email: Resend, for account and notification emails
• Sign-In: Google, if you choose to sign in with Google
• Payment Providers: None at the moment (see Section 8)
• Legal Authorities: When required by law or to protect rights and safety
• Business Transfers: In case of merger, acquisition, or sale of assets

Some things are public because you choose to publish them: your creator profile, your Banana Battle entries with your username, and a kink test share link or badge if you create one.

We do not sell your personal data to third parties.

10. Cookies and Similar Technologies

We use cookies and similar browser storage (local storage) as described below. You can change your analytics choice at any time with "Cookie settings" in the site footer.

10.1 Strictly Necessary

These keep the platform working and do not need your consent:

• Sign-in session: Kept in your browser storage by Firebase Authentication until you sign out
• sb_dest (180 days): Remembers that you are signed in, so you go straight to your start page instead of the landing page
• NEXT_LOCALE: Your language
• sb_country (1 hour): The country detected from your connection, used for country-specific features such as creators' country restrictions
• sb_admin (1 hour): Administrator sessions only
• Your choices: Your confirmation that you are 18 or older and your analytics choice (sb_analytics_consent) are remembered in your browser storage

10.2 Functional: Where Your Visit Came From

• sb_attr (60 days): Set on your first visit. It records where that visit came from: a creator invite code (ref), campaign tags (src, utm_*), a shared clip or kink test comparison link, the first page you opened and the time of that visit. Later links do not overwrite it while it exists.
• We use it to credit the right creator for an invitation and to understand which links bring new members. When you sign up, its content is copied once to your account, without any kink test share code: the account only records that you arrived through a comparison link. It is not used for advertising and is not shared with anyone.
• A creator invite code from a link is also kept in your browser storage for up to 60 days, so it is not lost while you sign up and apply.

10.3 Analytics (Only With Your Consent)

• We use PostHog, hosted in the EU. Until you click "Allow analytics" in the cookie banner, PostHog is not loaded at all: no cookie, no browser storage and no request to PostHog.
• After you allow it, PostHog stores an identifier in a cookie and in your browser storage (names starting with ph_) and records the pages you view and named steps such as signing up, opening a creator's page, spinning (including which creator's box), topping up or starting and finishing the kink test. You are identified by your account ID only, never by your email or name. Session recording, heatmaps and automatic click tracking are switched off.
• You can withdraw your consent at any time with "Cookie settings" in the site footer, as easily as you gave it.

11. International Data Transfers

Some of our service providers are based outside the European Economic Area (EEA) or have group companies there, for example in the United States, so your data may be transferred to and processed in such countries. When this occurs, we ensure appropriate safeguards are in place, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Adequacy decisions for countries with equivalent data protection, including the EU-US Data Privacy Framework for certified providers
• Binding Corporate Rules where applicable

12. Data Retention

We retain your data for the following periods:

• Account Data: Duration of account plus 3 years after deletion
• Kink Test Result and Answers: Until you delete them, or until your account is deleted at the end of the 30-day recovery period
• Identity Verification (creators): While your application is open or you are a creator, then up to 7 years (see Section 7)
• Transaction and Payout Records: 7 years (tax and legal requirements)
• Support Communications: 3 years after resolution
• Usage Logs: 12 months
• Analytics Data (only with your consent): 12 months
• First-Touch Attribution: The sb_attr cookie expires after 60 days; the copy saved to your account is kept while the account exists
• Marketing Consent Records: Duration of consent plus 3 years

13. Your Rights (GDPR)

Under GDPR, you have the following rights:

• Right of Access: Request a copy of your personal data
• Right to Rectification: Correct inaccurate or incomplete data
• Right to Erasure: Request deletion of your data ("right to be forgotten")
• Right to Restriction: Limit how we process your data
• Right to Data Portability: Receive your data in a structured, machine-readable format
• Right to Object: Object to processing based on legitimate interests or for marketing
• Right to Withdraw Consent: Withdraw consent at any time (without affecting prior processing)
• Right to Lodge a Complaint: File a complaint with a supervisory authority

To exercise your rights, use one of the contact options in Section 17. We will respond within one month.

Supervisory Authority: Office for Personal Data Protection (ÚOOÚ), Pplk. Sochora 27, 170 00 Praha 7, Czech Republic

14. Data Security

We implement appropriate technical and organizational measures to protect your data:

• Encryption of data in transit (TLS/SSL) and at rest
• Access controls and authentication requirements
• Regular security assessments and monitoring
• Employee training on data protection
• Incident response procedures

15. Children's Privacy

Juice Game is strictly for users aged 18 and over. We do not knowingly collect personal data from anyone under 18. If we discover that we have collected data from a minor, we will delete it immediately. If you believe a minor has provided us with personal data, please contact us (see Section 17).

16. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by email or through a notice on our platform. The "Last Updated" date at the top indicates when the policy was last revised. Where a change needs your consent, for example a new use of your kink test data, we will ask for it again rather than rely on your continued use of the platform.

17. Contact Us

For privacy-related inquiries or to exercise your rights:

• Support Chat: When signed in, send us a message through Support in your account settings
• Email: compliance@spinbox.app
• Address: SpinBox s.r.o., Dandova 2619/13, Horní Počernice, 193 00 Praha, Czech Republic

To have content that shows you removed, use the content removal request form. For everything else, see our Contact page.