Privacy Policy

Last updated: June 2026

What we collect

Spinback collects the minimum data necessary to operate the ad platform:

• GitHub identity — your GitHub username, email, and avatar, collected when you sign in via GitHub OAuth. We use this to identify your account and credit your earnings.
• Impression counts — each time an ad is displayed in your AI coding spinner, we record one impression event linked to your account. We do not record what you were doing, what prompt you sent, or any content from your session.
• Click events — if you click an ad, we record that a click occurred on that campaign. No personal information is attached to click events.
• Payout information — if you request a payout, we collect your payout preference via Stripe. Spinback does not store full payment details.

What we never collect

• Your code, prompts, or AI outputs — ever
• Keystrokes or editor content
• File paths or project names
• Browser history or browsing behavior

How ads are served

The Spinback VS Code extension runs a local loopback server on your machine (port 29847, localhost only). When your AI coding assistant's spinner appears, the extension fetches the current top ad from our API and displays it inline. The ad text is fetched from api.getspinback.com — no data about your session is sent in that request.

We also inject the current ad text into Claude Code's spinnerVerbs setting in ~/.claude/settings.json. This is a standard Claude Code configuration feature. We do not read other values from that file.

Data sharing

We do not sell, rent, or share your personal data with third parties. Advertisers only see aggregate impression and click counts — never individual user data.

Data retention

We retain impression and click event records for 12 months. Account data is retained until you delete your account. You can request deletion by emailing support@getspinback.com.

Third-party services

• GitHub — used for authentication only. Governed by GitHub's privacy policy.
• Stripe — used for advertiser payments and developer payouts. Governed by Stripe's privacy policy.
• Railway — our backend infrastructure. Data is stored in the US.

Your rights (GDPR / CCPA)

You have the right to access, correct, or delete your personal data at any time. You can:

• Access or export your data by emailing support@getspinback.com
• Delete your account and all associated data by emailing us
• Opt out of ad impressions by uninstalling the extension — this stops all data collection immediately

Spinback does not sell personal data. California residents may exercise additional rights under CCPA by contacting us. EU residents may lodge a complaint with their local data protection authority.

Contact

Questions? Email us at support@getspinback.com.