winner-picker.online ("we", "the service") is a free tool that picks random giveaway winners. The service is operated by Hawk Minds (hawkminds.co). This page explains what personal data is processed and why. Contact: hello@winner-picker.online.
Your lists never leave your device
When you upload a CSV/TXT file or paste names, the file is read and processed inside your browser. The full list (names, emails, any other column) is not uploaded to our servers.
YouTube comments
If you paste a YouTube link, our server asks the YouTube Data API for that video's public comments (author name, profile-picture link, text and time). These comments pass through our server to your browser and are cached in our database for up to 10 minutes to protect the shared API quota; they are then deleted automatically. Comment text and profile pictures are never stored with the draw record.
This feature uses YouTube API Services. By using it you also agree to the YouTube Terms of Service, and Google's handling of data is described in the Google Privacy Policy.
What we store when you run a draw
To create the public result page and let anyone check the draw, our server stores:
- A SHA-256 fingerprint (hash) of the entry list, and the number of entries before and after clean-up.
- The clean-up settings (for example the names of the columns you chose).
- The random seed, the algorithm used, the draw title and timestamps.
- The winners and backup winners: their position in the sorted list and the text displayed for them. Email addresses are always masked (for example j*******@gmail.com) in what we store and publish. If your list contains names, the winners' names are stored and shown on the public result page.
- A salted one-way hash of your IP address, used only for rate limiting and abuse prevention.
- A hash of a secret delete token (the token itself stays in your browser).
The result page is reachable only by its link, is marked noindex, and is not listed in search engines. Whoever you share the link with can see it.
Roles under GDPR
The person running the giveaway (the host) decides which personal data of participants is used and is responsible for informing participants and for having a lawful basis, for example in the giveaway's official rules. For the data described above we act as a processor on the host's behalf; for rate-limiting and security data we act as an independent controller (legitimate interest in keeping the service available).
Retention
Result pages are deleted automatically 12 months after the draw. Hosts can delete a result page at any time from the browser where it was created, see data deletion. Draws that were started but never completed are removed within 24 hours.
Processors and hosting
- Vercel Inc. — web hosting and serverless functions.
- Railway Corp. — database hosting (EU region, Netherlands).
- Resend, Inc. — receives email sent to @winner-picker.online addresses and forwards it to our mailbox. Only used when you email us.
- Sentry (when enabled) — error monitoring. Email addresses are removed from error reports.
- Vercel Web Analytics — cookieless, aggregated page-view statistics (pages visited, referrer, country, device type). No cookies are set and visitors are not tracked across sites.
- Google Analytics 4 (Google Ireland Ltd.) — usage statistics. Analytics cookies are set only if you accept the cookie banner; until then Google receives only cookieless signals without identifiers (Consent Mode). Google Analytics 4 does not store IP addresses. Advertising features are switched off. You can withdraw consent at any time with "Cookie settings" in the footer.
Where a provider is located outside the EU/EEA, transfers rely on the provider's standard contractual clauses.
Cookies and local storage
See the cookie notice. In short: no advertising cookies are set; Google Analytics cookies are set only after you accept them. A delete token is kept in your browser's local storage so you can delete your result page later.
Your rights
You can ask for access, correction or deletion of personal data we hold, and object to processing, subject to applicable law. If you appear on a result page and want it removed, see the data deletion page. You may also complain to your local data-protection authority.
Changes
We may update this policy; the date at the top shows the latest version.