What happens to your words

This page explains exactly what an appreciation card carries, where it goes, and how to change your mind. It applies to the card pilot, not to the public wheel, which collects nothing.

What a card holds

Two first names: yours and the receiver’s, as typed.
One quality from the wheel, and the date the card was made.
The moment you wrote: up to 140 characters.

All of it travels inside the card’s link. The moment sits after the #, which browsers never send to a server, so on its way to you it is only ever read on a device that opens the link.

If you keep a card, that changes. Keeping puts the card on your account, which means it reaches our server and stays there: the quality, the date, both first names, and the moment. The moment is encrypted before it is stored, so what sits in the database is not readable text. Until you keep a card, nothing of it has reached us.

The moment is written in a scrambled form, so it is not readable at a glance in a chat window, a browser history or over someone’s shoulder. That is not encryption, and we would rather say so: anyone who has the link can read the card.

What the pilot counts

A card hash: 16 characters derived from the card, which cannot be turned back into names or the moment.
A random device id: 16 characters made in your browser, tied to no name.
The pilot code of the round, and which event happened: a card made, opened, a keep begun, kept or reopened.

These say how many cards were sent and kept. They never say who sent what.

The counts and your account are kept apart on purpose. A count carries no name, no address and no moment, and it holds no identifier that appears on your account either, so the two cannot be put back together — by us or by anybody who obtained both. Anything we look at to understand how the wheel is used is of that kind: which qualities get named, never who named them or what was written.

Where it goes, and for how long

To whoever you send the link to, and anyone they forward it to.
Your account, for cards you kept: held until you delete the card or the account. Deleting the account deletes every card on it.
Our server logs: the link’s names and quality appear in the address; the moment does not. Vercel keeps those logs for an hour on our plan.
Slack, Teams or your email provider, if you send it there. Their copies are theirs, and we cannot delete them.
The receiver’s browser, if they press Keep this card. It stays on their device until they delete it.
A facilitator’s laptop, for cards typed up in a workshop: at most 7 days, then it clears itself.
The counts above, in our pilot store, deleted at the end of the pilot.

Signing in is how cards become yours rather than this browser's. It changes what we hold, so it is set out plainly.

Your email address, to know which cards are yours. It is kept until you ask us to delete the account.
A sign-in link, which works once and stops working after 15 minutes. We keep it only until it is used or expires.
A cookie, set when you open that link and lasting 30 days. It holds your address and a signature, nothing else, and no script on the page can read it.

We do not use any of it to track you, we run no analytics on it, and we never pass it to anyone. The address is not shared with whoever arranged your workshop.

Changing your mind

Before the round: tell the facilitator you would rather not take part. Nothing is written down.
A card you kept: delete it on the cards you’ve kept, which removes it from your device.
A card someone else holds: ask them to delete it. A link that has been sent cannot be recalled, which is why the composer says to send cards directly rather than to a channel.
The counts: ask us to remove the events for your device id and we will.
Your account: ask us to delete it and the address goes with it. Signing out on a device clears that device's cookie and leaves the account alone.

Asking us anything

For access to what we hold, a correction, or erasure, write to hello@appreciationwheel.com. We answer within 90 days, and usually far sooner. That address also reaches the person who can answer questions about this notice.

If your employer arranged the workshop, they decide the purpose of the round, and this notice covers what we do on their behalf. Ask them for their own notice.

If you are not satisfied, you can complain to the Data Protection Board of India.