Privacy, in plain words
Spinlings runs inside Claude Code, which is where your work happens. So privacy outranks every other rule in the game. This page says what the mod reads, what it sends, what this server keeps and who can see what.
The short version
- The game does not know who you are. You are a random token and a random handle like soft-otter-42. Nothing about your Claude account, email, organization or machine is ever sent.
- Nothing about your work leaves your machine. The mod never reads your prompts, Claude's answers, tool calls, files, paths, repository names or cost.
- Nothing about your usage is shown to anyone. The only usage-related value the server receives is a model family (haiku, sonnet, opus or fable), when you join, a pack charges or a battle starts. Nobody else sees it, and it is deleted with that pack or battle.
- No IP addresses, no request logs, no analytics, and no third-party requests, in the mod or on this server.
- You can delete everything from
/spin privacyinside Claude Code.
What the mod reads
Only the shape of your session: which model, whether Claude is working, how a turn ended, how many helpers are running, context fill and rate limits, and how long Claude Code has been open. It never hooks tool calls, prompt submissions or permission requests, and it never uses files, programs, models, prompts, tools, agents, MCP servers or environment variables.
What the mod sends
Requests go only to the one server in the mod's settings, over https. Each body holds game choices and nothing else: the proof-of-work answer and a model family when you join, a model family for a pack charge or a battle, the round numbers on which you pressed 1, and the ids of the cards, packs, offers or codes you act on. /spin privacy shows the last 20 requests the mod sent, with your token hidden.
What this server keeps
| What | For how long |
|---|---|
| A player id, your handle, and SHA-256 hashes of your session tokens (never a token) | Until you delete your account |
| Your game: cards, team, packs, sparks, rating, league, streak, wishlist and album | Until you delete your account |
| Your stats: counts of duel wins and losses, players beaten, wild wins, catches, species, first finds, Mythics found and market sales, all time and this season | Until you delete your account, as counts with no dates or times |
| The day you joined and the day you were last seen, never a time | Until you delete your account |
| A saved passkey's public key, if you save one | Until you delete your account |
| The model family of a pack charge or a battle | Only as long as that pack or battle |
| Battles | 7 days after they settle |
| Notices, and finished offers and gifts | 30 days |
| A keyed, daily-changing hash of your network address, for join limits | 24 hours |
Never kept: your IP address, user agent, timezone, email, Claude account, organization, or anything about your work.
What other players can see
- Your profile: your handle, team, cards marked for trade, album count and league, your market listings, and your stats unless you hide from the leaderboards. Nothing else.
- The leaderboards: every player is on them unless they hide with
/spin leaderboard off: your handle, league, rank and the board's number. Numbers show as they stood at the last midnight, so nobody can watch them move while you play. - Duels: the other player gets a notice with your handle and the result, dated "today" or "yesterday".
- Mythics: if you catch one, its card and the public list show your handle and its name. Change your handle or delete your account and they say it was found by a trainer, so your old handle never shows beside a new one.
- First discoveries: a card that was the first of its species in the world says so, and that it was first found by a trainer. It never says which one.
Never visible to anyone else: your battle count, when you joined or were last seen, your activity, the arena or model you used, and any timestamps. Duel wins and losses show only as counts in your stats, and you can hide those.
The pages of this site set no cookies and load nothing from other sites. Their scripts come from this site alone, draw the creatures in your browser and send nothing anywhere; /odds and this page run none at all. The two passkey pages run one small script of their own, to talk to your passkey.
The website remembers the creature you met in your browser's own storage so it can greet you next time. It never leaves your browser.
Deleting your account
/spin privacy has a delete button behind a 2-second hold. It removes your player record and all of your cards, packs, battles, offers, gifts, market listings, notices, wishlist, stats, board places and first-discovery credit. Cards you already traded, sold or gave away stay with their new owners. Your handle stays reserved for 30 days, then anyone can get it.
The full policy, including what someone could still guess and how this is checked, is in PRIVACY.md.