Privacy

Short version: Quick Draw stays on your device. Event Draw stores only what an organizer’s event needs, and removes it after a retention period.

Quick Draw

Names you type or import never leave your browser. We keep your list, options and history in your browser’s local storage so it is there next time. Clear all local data on the home page removes it. We do not use analytics or advertising trackers.

Quick Draw QR rooms

If you choose Start QR room, the names (and, if you ask for them, the IDs) that people type on their phones are stored on our server so they can appear in your list, and are deleted when you end the room or after 6 hours at the latest. Nothing else from your list is uploaded, and the draw still happens in your browser.

Event Draw (organizers)

To create events you sign in with an e-mail address and a one-time code. We store that address, the events you create, their prizes, participants and draw records, and an audit log of important actions (state changes, locking, draws, redraws).

Event participants

By default a participant is asked for a name only. An organizer may also ask for a participant ID, e-mail address or organization; that is the organizer’s choice and responsibility. Fields used only to prevent duplicates are stored as a keyed hash, not as readable text.

Retention

Participant personal data is deleted automatically 30 days after an event completes or expires, or earlier if the organizer deletes it. Draw results stay available for verification, with winner names reduced to the form the organizer chose for the public page (full name, partly masked, or a reference number). Organizers can export their own data at any time.

Cookies and security data

• A session cookie keeps organizers signed in (HttpOnly, Secure, expires when idle).
• On QR join pages, a small random device cookie helps limit abuse. It is not used for tracking.
• To protect sign-in, event creation and busy join pages from bots we may use Cloudflare Turnstile, which loads a script from Cloudflare only on those pages.
• Rate-limit counters use keyed hashes, not raw IP addresses or e-mail addresses.

Questions or deletion requests: see Support.