Privacy Policy

We collect information you provide directly and information generated automatically through your use of our platform.

Account information (shop owners):

• Email address used to create and manage your account
• Shop name, URL slug, and logo you configure
• Prize wheel content you create (prize names, weights, colours)
• Billing information (processed by our payment provider — we do not store card numbers)

Customer data (end-users spinning your wheel):

• Optional first name entered before spinning
• Prize outcome and timestamp of the spin
• Access code used to enter the wheel (single-use tokens generated by the shop owner)

Usage data collected automatically:

• Browser type and device information
• Pages visited, time spent, and actions taken within the platform
• IP address (used for security and abuse prevention)

We use cookies and similar technologies to operate and improve our services.

• Essential cookies: Required for authentication sessions and secure access to your account. Cannot be disabled without breaking core functionality.
• Functional cookies: Remember your preferences such as reduced-motion settings and PWA install state.
• Analytics cookies: Help us understand how the platform is used in aggregate so we can improve it. No personal profiles are built from this data.

You can control cookies through your browser settings. Disabling essential cookies will prevent you from logging in.

• To create and maintain your account and provide the Mystery Unlock service
• To process subscription payments and send billing-related communications
• To display your shop's prize wheel to your customers
• To detect, investigate, and prevent fraudulent or unauthorised use
• To send service-related communications (e.g. account approval, password resets)
• To improve and develop our platform based on aggregate usage patterns

We do not sell your personal information to third parties.

We share your information only in the following circumstances:

• Service providers: Infrastructure partners (hosting, database, authentication) who process data on our behalf under strict data processing agreements.
• Payment processors: Your billing details are handled by PCI-compliant third-party processors. We receive only a tokenised reference.
• Legal requirements: We may disclose information if required by law, court order, or to protect the rights and safety of Mystery Unlock and its users.

• All data is transmitted over TLS (HTTPS) — never plain HTTP
• Row-level security is enforced on all user data tables in our database
• Access codes and spin results are not accessible via public APIs
• Administrative privileges (super-admin roles) can only be granted server-side
• Passwords are never stored in plain text — authentication is managed by our auth provider

No method of transmission or storage is 100% secure. We encourage you to use a strong, unique password for your account.

We retain your account data for as long as your account is active or as needed to provide our services.

• Spin records and access codes can be deleted by the shop owner at any time from the dashboard
• Upon account closure, we delete or anonymise your personal data within 30 days
• Billing records may be retained for up to 7 years to comply with financial regulations

Depending on your location, you may have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your account and associated personal data
• Object to or restrict certain processing of your data
• Receive a copy of your data in a portable format

To exercise these rights, email us at support@mysteryunlock.com. We will respond within 30 days.

Mystery Unlock is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us and we will delete it promptly.

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy on this page with an updated "Last updated" date. Continued use of the platform after changes take effect constitutes your acceptance of the revised policy.

If you have questions about this Privacy Policy or our data practices, please contact us: