Privacy, in plain language

Effective October 31, 2026. Operated by Cyrus Lee.

Your draw stays in this browser

The generator runs on your device. Names, exclusions, event details, attached questionnaire snapshots, generated result links, and manual sent status are saved in your browser’s localStorage so you can refresh and continue. Up to 12 events are stored locally. “My events” switches between or deletes individual events. Local event data is not password-encrypted; other people using the same browser profile can access it. We do not send this draw data to an application database or email service.

Use “Clear all” to remove the current saved draw from this browser. Browser settings may also clear site storage. Clearing local data does not delete files you downloaded or invalidate links you shared.

Personal result links

Each link contains one pairing, the event details, and an optional recipient questionnaire snapshot after the # character. Ordinary HTTP requests do not send this URL fragment to the hosting server. The result page opens it locally. Anyone holding the full link can read the result, including the organizer. Sharing apps, browser extensions, or other software on your device may have access to links you provide to them.

Backups

Backups contain your draw and access links, encrypted locally with a password you choose. The backup file is downloaded to your device. We do not receive its contents or password and cannot recover a forgotten password. Protect both the file and the password.

Questionnaire answers

Questionnaire answers stay in page memory by default. If you enable local saving, the questions and answers are saved in this browser’s localStorage; switching saving off removes the current saved draft, while a different saved draft is kept. Returning to the same shared link restores locally saved edits. Use “Open saved draft” to recover a draft while viewing a different snapshot. Exported files, printed pages and copied answers remain under your control. Private questionnaire links contain a snapshot of included questions and answers after #. Anyone with the complete link can read it; links cannot be revoked or updated. Opening a shared link does not automatically overwrite a locally saved draft. URL fragments are removed before analytics events are sent. Do not include sensitive information.

Hosting and technical requests

Your browser requests the site’s public HTML, scripts, and images from the hosting provider. The provider may process ordinary request information such as IP address, user agent, and time for service delivery or security. That is separate from draw data, which this application does not upload.

Traffic analytics, cookies, and advertising

We use Plausible Analytics for cookie-free, aggregate traffic statistics, such as page visits, referral sources, and browser or device categories. Your browser sends analytics requests to plausible.io, which processes request information such as IP address and user agent to produce these statistics. URL fragments (the part after #) are removed before analytics events are sent, so personal result payloads and decryption keys are excluded. We do not send participant names, questionnaire answers, or draw contents as analytics properties. We also count three actions: completing a draw, successfully copying a questionnaire link, and clicking a ready-made questionnaire PDF. These events contain only a fixed action name and the public page URL without query parameters or fragments; they contain no participant details. A PDF click does not establish a completed download. Automatic outbound-link, file-download, and form-submission tracking is disabled.

We use localStorage for draw recovery, not advertising cookies. This version does not load advertising, remote fonts, or email scripts.

Questions and deletion

See the contact and help page. We cannot recover or remotely erase copies of your draw held on other people’s devices. Do not include sensitive personal information in names or event notes.