Privacy policy for spiroshader.com

Last updated: 2026-11-05.

This policy covers the website spiroshader.com (the “Site”) and the email you send WiderUp, including support requests about the application. It also explains how WiderUp handles personal data on its YouTube channel and on Spiroshader’s Steam pages; see YouTube channel and Steam community. What the Spiroshader™ application processes on your device is described in the application’s own privacy policy. The short version is that the application has no WiderUp account, advertising, analytics or crash reporting and does not contact a WiderUp server.

Who is responsible

WiderUp LLC
2909 S Wayzata Boulevard #1019
Minneapolis, MN 55405
United States

Privacy questions: privacy@widerup.com.

WiderUp has appointed DataRep as its data protection representative in the EU/EEA, the United Kingdom and Switzerland. The representative’s contact details appear under Your rights below.

What we process

Website access logs. The Site is hosted on Amazon Web Services (AWS) and delivered through Amazon CloudFront. When your browser requests a page or file, CloudFront records technical request information for WiderUp. This can include your IP address, date and time, requested host, URL or resource, response status, browser/user-agent information, and referrer information when your browser sends it. Your browser has to send this information for the Site to be delivered; without it the Site cannot be shown.

We use this information only to deliver and secure the Site, diagnose technical problems, investigate abuse, and understand operational errors. We do not use access logs to build advertising profiles or to track your activity across other sites. Where the GDPR or UK GDPR applies, the legal basis is WiderUp’s legitimate interest in operating and securing the Site (Art. 6(1)(f)).

Access logs are deleted automatically after 30 days. If specific log entries are needed to investigate or document a security incident, abuse or fraud, or to establish, exercise or defend a legal claim, WiderUp keeps a copy of those entries for as long as that purpose requires. WiderUp does not create a separate behavioral-analytics database from them.

Cookies, browser storage and analytics. The Site does not set cookies, does not store anything in your browser, and uses no analytics, advertising networks or social-media tracking.

No embedded third-party content. Every page, image and file of the Site is delivered from the Site itself. The Site currently embeds no videos and loads nothing from YouTube or any other third party. An earlier version offered embedded YouTube videos and remembered your choice about them in your browser’s local storage as spiroshader-consent. The Site no longer reads that item, and you can remove it by clearing the Site’s data in your browser.

Email and support. If you email WiderUp, for support, privacy, business, press or any other inquiry, we process your email address, your name if you give it, the content of your message, and anything you choose to attach (for example log files or screenshots). We use it to answer you, troubleshoot an issue, keep appropriate business and compliance records, and where needed establish, exercise or defend legal claims. WiderUp uses Google Workspace to provide business email. Please do not send passwords, keys or unrelated personal data in a support request.

WiderUp is the controller of the correspondence it receives. Where the GDPR or UK GDPR applies, we process support requests as necessary to perform our contract with you or to take steps at your request before a contract (Art. 6(1)(b)). Business-contact and general correspondence is processed for our legitimate interests in answering inquiries and managing our business (Art. 6(1)(f)). Information needed to comply with a legal duty, such as accounting records or a privacy request, is processed on that basis (Art. 6(1)(c)), and information needed for a legal claim is kept for our legitimate interest in establishing, exercising or defending it (Art. 6(1)(f)). Writing to us is voluntary, but without enough information we may be unable to answer your request.

Security reports. If you report a potential vulnerability to security@widerup.com, or if we investigate a security incident, we process the report and correspondence, your name or pseudonym and contact details, and the logs, IP addresses, timestamps, evidence files and other technical information relevant to the investigation. We use it to investigate and fix the issue and to document the incident. Where the GDPR or UK GDPR applies, the legal basis is our legitimate interest in keeping the Site, the application and our systems secure (Art. 6(1)(f)), and, where the law requires us to notify an authority or affected people, that legal duty (Art. 6(1)(c)).

Data-protection requests. If you contact WiderUp or DataRep to exercise a privacy right, the information needed to receive, verify and answer the request is processed to comply with applicable data-protection law (Art. 6(1)(c)). DataRep processes information it receives under its own privacy notice and forwards relevant requests to WiderUp.

Third-party links. Links to Steam, YouTube, DataRep and other external sites take you to services operated by other organizations. Their privacy practices apply once you leave this Site.

YouTube channel and Steam community

WiderUp publishes product and demo videos on its YouTube channel, and Spiroshader has a store page and community hub on Steam. These pages are operated by Google (YouTube) and Valve (Steam), and their privacy policies apply to everything you do there. This section explains what WiderUp itself does with personal data on those pages.

Comments, reviews and discussions. If you comment on a WiderUp video or post a review or discussion on Spiroshader’s Steam pages, WiderUp can see your public username or display name, your profile image and what you wrote. WiderUp may read and reply to these posts and may hide or remove comments and discussion posts on its own channel or community hub that break the platform’s rules or WiderUp’s community standards. Reviews on Steam are moderated by Valve. Your post and WiderUp’s reply are public on the platform. WiderUp does not copy posts into its own systems, except where a specific post has to be kept as evidence of abuse or for a legal claim.

Channel statistics. YouTube provides WiderUp with statistics about its channel (YouTube Analytics), such as views, watch time, approximate geography, age range and device type. WiderUp receives these statistics in aggregated form and does not use them to identify individual viewers. Google collects the underlying data under its own privacy policy, and WiderUp may be jointly responsible with Google for compiling these statistics. WiderUp uses them only to understand the reach of its videos and improve its content.

Steam reports. As publisher, WiderUp receives from Valve the sales and aggregate reports Valve provides to publishers, such as sales, wishlist and store-traffic figures. These reports contain aggregated figures only and no information about individual players: WiderUp does not learn from Valve who bought, wishlisted or played Spiroshader, and does not receive your payment details. We use the reports for accounting and to understand sales and product performance.

Where the GDPR or UK GDPR applies, the legal basis is WiderUp’s legitimate interest in presenting its product, communicating with users, moderating its own pages and understanding the reach of its content (Art. 6(1)(f)).

For data that Google or Valve collect, such as your viewing history or account data, you can exercise your rights most effectively with them directly. You can still contact WiderUp about any of this processing, and WiderUp will answer for its own part and forward relevant requests to Google or Valve where needed.

Who receives personal data

Personal data is accessible to authorized WiderUp personnel and, only as far as each needs it, to:

• Amazon Web Services, which hosts and delivers the Site and stores its access logs as WiderUp’s processor;
• Google (Google Workspace), which provides WiderUp’s business email as WiderUp’s processor;
• DataRep, WiderUp’s data protection representative, for requests and correspondence sent to or through it;
• professional advisers, such as legal counsel and accountants, and insurers and incident-response providers, where needed for advice, a security incident or a legal claim;
• public authorities, courts and supervisory authorities, where the law requires a disclosure or notification, or where needed to establish, exercise or defend a legal claim;
• Valve, for Steam partner matters, for example when you ask for a review key as a member of the press or a content creator; and
• a successor, if the Spiroshader business is sold, merged or otherwise transferred, under the protections of this policy or with notice where the law requires it.

The processors act on WiderUp’s instructions under their data-processing terms. WiderUp does not sell or rent personal data.

What we do not do

WiderUp does not use this Site to:

• create user accounts or advertising profiles;
• run behavioral analytics;
• serve targeted advertising;
• sell personal data;
• use personal data for cross-context behavioral advertising; or
• make decisions about you using automated profiling.

WiderUp does not sell personal information or share it for cross-context behavioral advertising, as those terms are used in U.S. state privacy laws. The Site does not track visitors over time or across other websites, and no third party collects such information through the Site. The Site therefore works the same way whether or not your browser sends a Do Not Track or Global Privacy Control signal; there is no tracking for the signal to turn off.

International processing and transfers

WiderUp is based in the United States, so information you send to the Site or to WiderUp directly, such as a page request or an email, is received there.

• Website hosting and access logs: AWS, in its US East (N. Virginia) region, United States. CloudFront locations in other countries handle requests close to you before the logs are delivered there. Safeguard: the European Commission’s Standard Contractual Clauses under the AWS Data Processing Addendum, with the AWS UK GDPR Addendum and the AWS Swiss Addendum.
• Email: Google Workspace, United States; Google’s subprocessors may process data in other countries. Safeguard: the Standard Contractual Clauses under Google’s Cloud Data Processing Addendum, which covers transfers under the EU GDPR, the UK GDPR and the Swiss FADP.
• Data-protection requests: requests received by DataRep in Ireland, the United Kingdom or Switzerland are forwarded to WiderUp in the United States, and may be exchanged with the relevant supervisory authority as necessary to handle the request.

You may contact privacy@widerup.com for the relevant safeguard information and a copy, subject to necessary redactions.

Security

The Site is served only over encrypted connections (HTTPS). Access to WiderUp’s hosting, email and business accounts is restricted to authorized personnel and protected with multi-factor authentication where the service supports it, and WiderUp follows a documented procedure for security incidents. No website, device or network can be guaranteed completely secure. We use technical and organizational measures proportionate to the information and the risks.

Retention

Retention depends on the type of data:

• Website access logs: deleted automatically after 30 days, except for specific entries kept as evidence as described above.
• Comments, reviews and posts on YouTube and Steam: remain on the platform until you or the platform delete them, or, for comments and discussion posts, until WiderUp removes them from its own pages. WiderUp keeps no separate copy unless a specific post is needed as evidence.
• Email and support correspondence: normally no longer than three years after the matter closes; unnecessary attachments are deleted sooner.
• Privacy requests: normally no longer than three years after the request closes, to document compliance and handle follow-up requests.
• Security reports and incident records: as long as they are relevant to the incident or vulnerability, its remediation, and related legal obligations or claims.
• Business, platform and press contacts: for the business relationship and up to three years after the last contact.

A particular record may be kept longer where a documented legal duty, such as accounting or tax law, or a legal claim requires it, and is deleted when that need ends. You may request deletion at privacy@widerup.com, subject to these retention grounds.

Your rights

Where the GDPR, UK GDPR, Swiss FADP or another applicable privacy law gives you rights, those rights may include access, correction, deletion, restriction, objection, data portability, withdrawal of consent, and the right to complain to a data-protection authority. Which rights apply depends on the law and the processing involved.

Your right to object. Where we process your data on the basis of our legitimate interests (Art. 6(1)(f)), such as access logs, correspondence and our YouTube and Steam pages, you may object at any time on grounds relating to your particular situation. We will then stop that processing unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is needed to establish, exercise or defend legal claims.

Where processing is based on consent, you may withdraw your consent at any time without affecting the lawfulness of earlier processing.

You may contact WiderUp directly at privacy@widerup.com. We may ask for information reasonably necessary to verify your identity, but will not ask you to create an account or send unrelated sensitive documents merely to make a request. For requests governed by the GDPR or UK GDPR, we normally respond within one month, and explain any permitted extension within that month.

If you are in the EU/EEA, the United Kingdom or Switzerland, you may also contact WiderUp through its data protection representative, DataRep:

• email datarequest@datarep.com and put WiderUp LLC in the subject line;
• use www.datarep.com/data-request; or
• write to the applicable representative address below.

Primary representative/contact addresses:

• EU/EEA: Data Protection Representative Limited (trading as DataRep), 77 Camden Street Lower, Dublin, D02 XE80, Ireland.
• United Kingdom: DataRep, 107-111 Fleet Street, London, EC4A 2AB, United Kingdom.
• Switzerland: DataRep, Leutschenbachstrasse 95, Zurich 8050, Switzerland.

If you write to DataRep, address the correspondence to DataRep, not WiderUp LLC, and identify WiderUp LLC clearly.

You may also lodge a complaint with the data-protection authority where you habitually reside, work, or where you believe an infringement occurred, including an EU/EEA supervisory authority, the UK Information Commissioner’s Office, or the Swiss Federal Data Protection and Information Commissioner, as applicable.

Children

The Site is not directed at children, and WiderUp does not knowingly collect personal data from children through the Site. If you believe a child has sent us personal data, contact privacy@widerup.com so we can assess and address it, including deletion where required.

Changes

We will update this policy when the Site’s data handling changes. The date at the top identifies the current version. We will post a prominent notice on the Site before a material change takes effect. New purposes for information we already hold will be described here before that further processing begins and will use an appropriate lawful basis; a policy update alone does not authorize incompatible reuse or supply consent. Earlier versions of this policy are available on request at privacy@widerup.com.