Privacy
Almost nothing about you reaches a server. This page says what does, how long it stays there, and how to get rid of it.
Your names stay in your browser
Every tool on this site runs on your own device. The names you type, the weights you set, the colours you pick and the record of what came up are held in your browser's own storage and are sent nowhere. Nothing here builds a profile of you, and there is no advertising on any page of this site.
The seven things that do reach us
Sharing a wheel, opening a join list, publishing a draw record, running a Secret Santa, signing in, reporting a shared page and offering one to the gallery are the only actions that send anything to a server, and each one asks you first. What follows is everything that is stored when you do one of them — and nothing at all is stored when you do not.
| What | How long | Counted from |
|---|---|---|
| A wheel, list or team sheet you shared with a link | 365 days | the last time somebody opened it |
| A wheel saved to your account | No fixed limit | it stays while the account does — deleting the account puts it back on the rule above |
| A join list, and the names people typed into it | 24 hours | the moment it was opened |
| A published draw record: the entries, the seed and the result | 365 days | the moment it was made |
| A Secret Santa: names, hints, sealed links and any addresses you entered | 60 days | the exchange date, or the day it was made if you gave no date |
| A sign-in link or code | 15 minutes | the moment it was sent |
| Your sign-in on this device | 90 days | signing in, unless you sign out first |
Every number in that table is read from the code that enforces it, so the page and the site cannot drift apart.
A row is unreachable the second it expires, and a nightly job then deletes it for good. Anything you delete yourself is deleted at once, not overnight.
Reporting a page, and offering one to the gallery
A report stores three things: the reason you picked from the list, whatever you wrote in the box, and the address of the page you reported. It has no expiry, because it is the evidence one person reads when deciding what to take down, and it outlives the page it is about; nobody else is ever shown it. Offering a wheel to the gallery stores the name you typed for it, on the shared wheel itself, and that name stays there whether the answer is yes or no. Neither asks for your name or your address, and neither publishes anything on its own.
Cookies, and what else sits on your device
A few small cookies exist and not one of them tracks anything: the language you chose, your sign-in if you have one, a short-lived one while a sign-in is in flight, one that lets you open your own Secret Santa card a second time, and — if you host a join list — one per list, which is how that list knows this browser is its key. Everything else — rosters, theme, saved wheels — is in your browser's own storage. The storage notice names every item. Cloudflare's network may add one short-lived cookie of its own while it decides whether a request is automated; it is not ours, it names nobody, and nothing on this site reads it.
How visits are counted
Cloudflare Web Analytics counts page views. It sets no cookie, takes no fingerprint and builds no profile — it records that a page was opened and roughly where from, and nothing that leads back to you. That is why this site has no cookie banner: there is nothing here to ask permission for. The counter runs on every page of this site.
Email addresses
There are two reasons an address is ever held here. An organiser can ask us to email the sealed links for a Secret Santa instead of handing them out, and those addresses live with the event and go when it goes. And an account is an address and nothing else — no password, no name, no profile. We send the sign-in link and the messages you asked for, and nothing else, ever.
Classrooms and children
This site is not made for children to use alone: the teacher or the host is the user. Classroom registers never leave the device they were typed on, the page asks for first names only, and a register that has not been used for ninety days deletes itself. Classroom pages carry no advertising and never will, and nobody on a register is ever emailed.
Who else is involved
Cloudflare runs the servers, the database and the network this site stands on, counts the visits, and delivers the few emails it sends. Resend is the standby that takes a message when Cloudflare's own post cannot. Nobody else — no analytics vendor and no advertising network. Two scripts here are not ours and both are Cloudflare's: the visit counter, on every page, and the robot check, on the few pages that have to ask whether you are one.
Getting rid of it
Everything you make has its own delete button — a shared wheel from the page that made it, a Secret Santa from the organiser's page, a draw record from its own address. An account can export everything it holds and then delete itself on the spot. If you would rather ask than click, write to us.