§1 · Data Controller & Privacy Officer Contact
The custodian responsible for personal information processed through onetimerspins.com is OneTimer Spins Archival Studio Inc. (Ontario Corp. #1008492-7), with its principal office located at 100 King Street West, Toronto, ON M5X 1A9, Canada.
Our designated Privacy Officer can be reached by electronic mail at privacy@onetimerspins.com or by telephone at +1 416 555 0101.
§2 · Categories of Information We Collect
Because our conservatory involves zero financial transactions, we never collect banking details, payment card numbers, or government identification documents. We collect only the minimum records required to operate your 19+ curator folio:
- Registration Data: Your electronic mail address, chosen Curator Screen Name, Date of Birth (solely to verify 19+ eligibility in Ontario), and a cryptographically salted `password_hash`.
- Conservatory Preferences & Ledger: Your selected lighting scene (`display_scene`), session reminder interval (`reminder_minutes`), active Account Break timestamp (`break_until`), and practice session launch history (`ledger`).
- Support Dispatches: Name, email address, topic, and inquiry text voluntarily submitted through `support.php`.
- Local Browser Tokens: Client-side hallmark arrays (`ots:claims`) and consent preferences (`ots:analytics-consent`) stored locally on your device.
§3 · Lawful Bases & PIPEDA Fair Information Principles
In accordance with Schedule 1 of the Personal Information Protection and Electronic Documents Act (PIPEDA), we process personal data strictly for the following identified purposes:
- 19+ Age Gate & Service Delivery
- Verifying that visitors meet Ontario’s 19+ age threshold and maintaining your complimentary Play Credit ledger across sessions.
- Player Care Enforcement
- Honouring self-requested Account Breaks (`break_until`) and session reminder intervals.
- Curatorial Support
- Responding to inquiries logged with a `OTS-YYYYMMDD-XXXX` Reference ID.
- Explicit Telemetry Consent
- Optional analytics storage is disabled by default under Google Consent Mode v2 and activated only if you explicitly click Allow Analytics.
§4 · Data Retention & Storage Security
Passphrases are hashed using PHP’s native `password_hash()` (`BCRYPT`/`ARGON2`) before storage, and our JSON data directory (`/data/`) is protected against direct web access via server-level access rules and exclusive file locking (`flock(LOCK_EX)`). Curator folios are retained only while your account remains active or until you request erasure via privacy@onetimerspins.com.
§5 · Your Statutory Rights under PIPEDA & Ontario Law
Under Canadian federal and Ontario provincial privacy legislation, you hold the right to:
- Request access to a complete copy of the personal data held in your curator folio.
- Request correction of inaccurate account details or immediate erasure of your profile (subject to any active self-exclusion lock).
- Withdraw optional telemetry consent at any moment through our Cookie Preferences page.
If you are unsatisfied with our response to a privacy inquiry, you have the statutory right to lodge a concern with the Information and Privacy Commissioner of Ontario (IPC) in Toronto or the Office of the Privacy Commissioner of Canada (OPC).
§6 · Third-Party Data Sharing & Practice Containers
We never sell, rent, or trade curator email lists to third parties. When a signed-in curator opens `play.php`, the embedded demonstration `