What happens to your words

This page explains exactly what an appreciation card carries, where it goes, and how to change your mind. It applies to the card pilot (the cards being tried out in workshops now). The public wheel collects nothing, with one exception: opening it from the code on a printed card counts that open, as set out below.

What a card holds

Two first names: yours and the receiver’s, as typed.
One quality from the wheel, and the date the card was made.
The moment you wrote: up to 140 characters.

All of it travels inside the card’s link. The moment sits after the #, which browsers never send to a server, so between sender and receiver it is only ever read on a device that opens the link.

Inside the link, the moment is written in a scrambled form, so it is not readable at a glance in a chat window, a browser history or over someone’s shoulder. That is not encryption, and we would rather say so: anyone who has the link can read the card.

If you keep a card, that changes. Keeping puts the card on your account, which means it reaches our server and stays there: the quality, the date, both first names, and the moment. The moment is encrypted before it is stored, so what sits in the database is not readable text. Until you keep a card, nothing of it has reached us.

What the pilot counts

A card hash: 16 characters derived from the card, which cannot be turned back into names or the moment.
A random device id: 16 characters made in your browser, tied to no name.
The code of the workshop the card came from, and what happened: a card made, opened, a keep started, kept or reopened.

These say how many cards were sent and kept. They never say who sent what.

In Microsoft Teams, our server counts three things itself: each card put into a message box, each card kept from Teams, and how many different people open the page where you keep your cards each day. Each count holds a code made from the card or the person, the day, your organisation’s workshop code and the kind of conversation, never a name or a moment. The codes can’t be turned back into a card or a person, and the count of people can say how many, never who.

In Slack, it counts the same three things the same way: each card posted, each card kept from Slack, and how many different people open the app’s Home tab each day, under your workspace’s code.

The counts and your account are kept apart on purpose. A count carries no name, no address and no moment, and it holds no identifier that appears on your account either, so the two cannot be put back together, by us or by anybody who obtained both. Anything we look at to understand how the wheel is used is of that kind: which qualities get named, never who named them or what was written.

What a printed card counts

Each card in the printed kit, and the board, carries a code that opens the wheel at its quality. Opening one counts:

Which quality the card names, or that it was the board.
Which print run the card came from.
A random device id, only if your browser keeps one, so the same phone counts once.

This says how often the printed cards are used and which qualities people look up. It never says who.

Where it goes, and for how long

To whoever you send the link to, and anyone they forward it to.
Your account, for cards you kept: held until you delete the card or the account. Deleting the account deletes every card on it.
Our server logs: the link’s names and quality appear in the address; the moment does not. Vercel keeps those logs for an hour on our plan.
Slack, Teams or your email provider, if you send it there. Their copies are theirs, and we cannot delete them.
The receiver’s browser, briefly, if they sign in to keep a card: it waits there until sign-in finishes, then moves to their account.
A facilitator’s laptop, for cards typed up in a workshop: at most 7 days, then it clears itself.
The counts above, in our pilot store, deleted at the end of the pilot.
The printed-card counts, in the same store, each deleted automatically 13 months after the day it was made.

Signing in is how cards become yours rather than this browser's. It changes what we hold, so it is set out plainly.

Your email address, to know which cards are yours. It is kept until you ask us to delete the account.
A sign-in link, which works once and stops working after 15 minutes. We keep it only until it is used or expires.
A cookie, set when you open that link and lasting 30 days. It holds your address and a signature, nothing else, and no script on the page can read it.

We do not use any of it to track you, we run no analytics on it, and we never pass it to anyone. The address is not shared with whoever arranged your workshop.

If you use it in Microsoft Teams

Your organisation can add Appreciation Wheel to Microsoft Teams. A card is then written in Teams and posted into a conversation, rather than sent as a link. Some of what is set out above works differently there.

Who reads the card: everyone in the conversation you post it in. In a channel or a group chat, that is everyone who can see it. In a meeting chat, it includes any guests from outside your organisation. The card says who will read it before you add it.
What it holds: the name on the card, the quality, the date, the moment, and your name as Teams shows it. If you tagged someone, it also holds what Teams needs to tag them. It also carries our signature and two codes made from your and the tagged person’s Teams ids. The codes can’t be turned back into the ids. They are how we check, later, who sent the card and who may keep it.
Where it lives: in your organisation’s Teams, like any message, kept for as long as your organisation keeps messages. The card passes through our server on its way there, and we store none of it. Our logs record which kind of conversation it was, never a name or a moment.
While you write it: an unsent or recently added card’s words stay on this device for up to 7 days, unless you clear them, so you can pick up where you left off. They are kept apart for each person and each conversation, and never leave the device.
If you keep a card: it goes on your account, as above, with the moment encrypted. Here, your account is your Teams sign-in, not an email address. We store it under a code made from your organisation’s Microsoft id and your own, not under your name. We also list that code with your organisation, so your organisation’s records can be found and erased when it leaves. A card that tags someone can be kept only by that person.
Your wheel in the Home tab: the app’s Home tab shows your wheel, lit by the cards you kept. Slack fetches that picture from us and keeps a copy, as it does with any picture. Its address says which qualities you were named for and how often, and nothing else: no name, no Slack id, no moment.
Taking your cards with you: Download my cards, on the page where you keep them, opens all of them in your browser, ready to save as a PDF that is yours to keep. The link that opens them works once, within 10 minutes, and shows only your own cards. Nothing about the download is kept.

Who is responsible for what. Your organisation decides what happens to what lives in its Teams, including the cards posted there. We are responsible for your own record: the cards you kept. It belongs to you, and your organisation never sees it, nor how many cards you kept.

If your organisation stops using it, you are told the date access ends at least 30 days before, and the page where you keep your cards shows it. From that date, Teams can no longer reach your cards. We keep them for 30 days more, in case you write to us for them, and then erase every card kept through that organisation. Cards already posted stay in its Teams.

If you search for a colleague in Teams

In Microsoft Teams, the name field on a card can look up the people in your organisation, so the card can tag the person it is for. It does this only if your organisation’s Microsoft administrator has approved it.

What we ask Microsoft: once you have typed two letters, for up to eight people in your organisation whose name begins with what you typed. We ask with your own Teams sign-in, so we see no one you could not already find in Teams.
What comes back: each person’s name, first name and job title, and the id Microsoft gives them. It goes to your screen and is not stored.
If you pick someone, their name and that id go on the card, which is how Teams tags them. The card then lives in your organisation’s Teams, like any message.
What we keep: nothing of the search. The pass Microsoft gives us to ask is held in our server’s memory until it expires, about an hour later, and is never written down. Our logs record how many people were found, never what was typed or who.

Your administrator can withdraw the approval at any time. The name field then takes a typed name, as it does everywhere else, and nothing is tagged.

If you use it in Slack

Anyone can add Appreciation Wheel to a Slack workspace. A card is then written in Slack and posted into a conversation. Some of what is set out above works differently there.

When it is added: we store your workspace’s Slack id and name, when it was added, and the key Slack gives the app to post cards, encrypted. Nothing about the people in it is stored then.
Who reads the card: everyone in the conversation it is posted in. In a channel shared with another company, that includes their people.
What it holds: the quality, the date, the moment, and your and the other person’s names as Slack shows them, which we ask Slack for as the card is made. It also carries our signature and two codes made from your and the other person’s Slack ids. The codes can’t be turned back into the ids. They are how we check, later, who may keep the card.
Where it lives: in your workspace’s Slack, like any message, kept for as long as your workspace keeps messages. The card passes through our server on its way there, and we store none of it. Our logs record which kind of conversation it was, never a name or a moment.
If you keep a card: only the person a card is for can keep it, and only if they are in the workspace that added the app. It goes on your account, as above, with the moment encrypted. Here, your account is your Slack account, not an email address. We store it under a code made from your workspace’s Slack id and your own, and list that code with your workspace, so its records can be found and erased when it leaves.
On the website: Sign in with Slack asks Slack who you are. Slack also sends your name and picture; we use only your workspace and your Slack id, and keep neither the name nor the picture. We ask for no email. It signs you in on that device as above.
Taking your cards with you: Download my cards, in the app’s Home tab, works as it does in Teams: a link that works once, within 10 minutes, and shows only your own cards.

Who is responsible for what. Your workspace decides what happens to what lives in its Slack, including the cards posted there. We are responsible for your own record: the cards you kept. It belongs to you, and your workspace never sees it, nor how many cards you kept.

If your workspace removes the app, the key it gave us is deleted at once, and nothing new can be posted or kept. For 30 days you can still sign in with Slack on this website and download your cards. Then every card kept through that workspace, and our record of the workspace, are erased automatically. Cards already posted stay in its Slack. If it adds the app again within the 30 days, nothing is erased.

If you ask for a workshop

The workshop form sends us what you type into it: your name, your email address, and, if you add them, your organisation, how many people, when, and a note.

We email it to ourselves, so we can reply to you. That copy stays in our inbox for as long as we are talking about a workshop.
We keep a copy in our store in case that email goes astray, and it deletes itself after six months.
To stop the form being misused, we count requests per address and per connection for one day. Each is kept as a fingerprint that cannot be turned back into the address, and is gone the next day.

We use it only to answer you about a workshop. It is never added to a mailing list, never joined to an account or a card, and never passed to anyone.

If you order the poster or the kit

The store’s order form sends us what you type into it: how many posters and kits, your name, your email address, the country it’s going to, and, if you add them, your organisation, your city and a note.

We email it to ourselves, so we can reply with the price and the delivery. That copy stays in our inbox for as long as we are dealing with your order, and the invoice is kept for as long as the law asks.
We keep a copy in our store in case that email goes astray, and it deletes itself after six months.
To stop the form being misused, we count orders per address and per connection for one day, the same way as workshop requests.

We ask for your full address only in our reply, once there is something to send. We use these details only for your order. They are never added to a mailing list, never joined to an account or a card, and passed on only to whoever delivers it.

Changing your mind

Before the round: tell the facilitator you would rather not take part. Nothing is written down.
A card you kept: delete it from your qualities, which removes it from your account.
A card posted in Teams: delete the message there, as you would any other. If the person it is for has already kept it, ask them to delete it from their qualities.
A card posted in Slack: the same. All the cards you kept from Slack can also be deleted at once, with Delete all my cards in the app’s Home tab.
A card someone else holds: ask them to delete it. A link that has been sent cannot be recalled, which is why the composer says to send cards directly rather than to a channel.
The counts: ask us to remove the events for your device id and we will.
A workshop request: ask us to delete it and we will, from the store and our inbox.
Your account: ask us to delete it and the address goes with it. Signing out on a device clears that device's cookie and leaves the account alone.

Asking us anything

For access to what we hold, a correction, or erasure, write to hello@appreciationwheel.com. We answer within 90 days, and usually far sooner. That address also reaches the person who can answer questions about this notice.

If your employer arranged the workshop, they decide the purpose of the round, and this notice covers what we do on their behalf. Ask them for their own notice.

If you are not satisfied, you can complain to the Data Protection Board of India.

Last updated 7 November 2026. The Digital Personal Data Protection Rules 2025 take full effect on 13 May 2027; this notice is written to them now.