Privacy

The pickers on this site run in your browser. The names and options you type are kept only in your browser’s storage, so they are there the next time you visit. Clear the site’s data in your browser to remove them.

The time poll keeps data on our server, because everyone in the group must see the answers: the poll’s name and details, its days and hours, its closing time and the names the organiser expects (if given), and for each person the name they typed, their times and their note. No email address and no account. The poll store does not record IP addresses (it counts requests per address for one minute, in memory, to stop floods). A poll is deleted 90 days after its last date or its last change, whichever is later; the organiser can delete it or remove an answer, and anyone can change their own answer with their own link while the poll is open, or remove it at any time.

For each person, Secret Santa keeps on our server: the wish list they write on their own link; whether that link (and its latest version) has been opened, so the organiser can see who has opened theirs; the questions their giver asks them, with their answers; and the draw’s head count. No name. It is stored under a random number, with no name and no match; only links that hold that number can read it. Only the person’s own link can change the wish and the answers; their giver’s link can add a question (10 at most). Forgetting the draw deletes all of it; otherwise it is deleted 90 days after its last change.

Secret Santa’s organiser link, only if you make one, keeps the whole draw on our server so you can open it on another device: it is locked in your browser first, with a key that stays in the link, so our server holds only text it cannot read, under a random number. Only the organiser link opens it. “Stop this link” or “Forget this draw” deletes it; otherwise it is deleted 90 days after its last change.

A live wheel, only if you make one, keeps its list on our server while the link is on, so viewers can follow: the entries, the title, the colour theme, the after-a-spin setting and the latest spin (which slice, and how it turned). No account. Its host stops it at any time, which deletes it; otherwise it is deleted 90 days after its last change. A wheel link that is not live keeps nothing on our server.

When you share a link, the list or the Secret Santa match travels inside the link, after the # sign. Browsers never send that part of an address to a server, so we never receive it. When you send a link through an app (WhatsApp, email, a chat), that app carries the whole link, # part included, as it carries any message you send.

Our server keeps the usual web-server log of page requests (the address of the page, the time, and your browser’s technical details) to keep the site running and to count visits.

We may add privacy-friendly visit counting and, later, advertising. This page will say so before either starts.

The site keeps a copy of its own pages and scripts in your browser so it works offline and can be installed as an app. “Say the winner out loud” uses your device’s own voice; the name is not sent anywhere. The giveaway picker reads one public random value from the drand beacon’s servers (api.drand.sh, drand.cloudflare.com): it asks only for a round number, never for your entries.

Last updated 3 November 2026.