Privacy Policy

Running a draw without an account

You can use every picker on this site without signing up. There is no profile to collect, no advertising and no tracking pixels on any page. What that free draw costs you is described below, and it is short.

One thing is written to your browser on your first visit, whether or not you ever sign up: a single localStorage entry noting which site referred you, which page you landed on, and any campaign tags in that first URL. It stays on your device and is read exactly once: if you later create an account, so that the account records where it came from. If you never create one, it is never sent anywhere at all. It is not a cookie, it is not an identifier, and clearing your site data removes it.

What happens when you run a comment draw

You paste the link to a public post or video. That link goes to our server, which asks a third-party API for the comments on it. The comments come back: display name or handle, avatar image, and the comment text, all of which are already visible to anyone without logging in. They are sent to your browser, where the winner is drawn.

Those comments are never written to our database. When you close the tab, the pool is gone.

What a draw does leave behind

The free plan is one draw per 24 hours, and a limit nobody records is not a limit. So each draw writes one row: which platform it read, which post it read, when, and the address it came from, plus the account if you were signed in. Nothing about the comments or the winner is in it.

Those rows are deleted after seven days. Two other things are held in memory only, never written down: your address for up to sixty seconds, to count draws per minute so one visitor can't exhaust the paid APIs this site runs on, and a preview of the post you pasted (author, caption, thumbnail) for up to ten minutes, so pasting the same link twice doesn't pay for the same lookup twice.

If you create an account

An account exists to carry a subscription. It holds:

• Your email address, and your password if you set one, stored only as a scrypt hash. The password itself is never written down and cannot be recovered from what is.
• Your Stripe customer id, if you subscribe, along with the status and renewal date of that subscription. Card details never reach this site at all; see below.
• How you arrived, recorded once when the account is created and never updated afterwards: the country your address resolves to, the site that referred you, the first page you landed on, any campaign tags in that first URL, your address and your browser's user-agent string. It is used to understand which sources bring people here. It is not shared, sold, or used to build a profile of you.
• When you were last seen, refreshed at most once an hour, so a dormant account can be told from a live one.

Signing in sets one cookie, gp_session, which holds a random token and nothing else: not your address, not your plan. It lasts thirty days, and only the SHA-256 of it is stored on our side, so a copy of our database would not hand anybody a live session. Signing out deletes both halves. Signing in with Google sets a second cookie for ten minutes, purely to check that the reply coming back from Google belongs to the request that left.

Paying

Payments are handled entirely by Stripe, which is the merchant of record: it takes the card details, charges you, handles tax and issues the receipt. Card numbers never touch this site. What comes back to us is a customer id, a subscription status and a renewal date. Stripe's own privacy policy governs what it holds.

The name picker and team generator

Those two tools run entirely in your browser. The list you paste is never sent to our server, and never leaves your device.

Who else is involved

Reading a comment section means asking a service that can see it, so the post link you paste is passed to a third-party API provider, which returns the public comments on that post. What reaches them is the link and nothing else about you: not your email address, and not your account.

If you choose to sign in with Google, Google tells us your account identifier and your verified email address, and nothing more. The site itself is served through a content delivery network, which also provides aggregate page-view counts: totals per page, without cookies and without following anyone from site to site.

If your comment was in someone's draw

Comments are read live from the platform each time a draw runs; nothing is copied or kept here. Deleting your comment on Instagram, Facebook, TikTok or YouTube removes it from any future draw, because there is no stored copy to remove.

Getting your account deleted

Write to [email protected] and the account and everything attached to it will be deleted. Cancel the subscription first, from your account page, or it goes on billing.

Changes

If this changes, the date at the top of this page changes with it. Questions go to [email protected], or through the contact page.