Privacy Policy

Effective Date: March 4, 2025

1. What Data We Collect

We follow a minimal-data philosophy. We collect only what is strictly necessary to operate the service:

Game Configuration Data

Game name, number of strips, draw interval, claim timeout, and prize configuration — provided by the host when creating a game.

Player Display Names

The name each player chooses when joining a game. This is a display-only identifier and does not need to be your real name.

Game State Data

Drawn numbers, ticket assignments, claim records, and game phase — generated automatically during gameplay.

Technical Metadata

IP addresses for rate limiting, timestamps for audit logs, and browser user-agent for compatibility. No tracking cookies or analytics.

2. How Data Is Stored

All game data is stored in Supabase, a PostgreSQL-based backend-as-a-service. Importantly:

  • Your data stays in your account. When you self-host or configure your own Supabase instance, all data resides in your own database under your control.
  • We do not operate a centralized database of user information.
  • Data is transmitted over HTTPS/TLS encrypted connections.
  • Row Level Security (RLS) policies in Supabase ensure players can only access data relevant to their game.

3. Data Retention

Automatic Deletion

Game data is automatically deleted when a game ends and the host confirms cleanup, or after a 30-day inactivity period. This includes all tickets, player records, claims, and audit logs for that game.

Rate limiting data is ephemeral and expires within minutes. No long-term behavioral profiles or user histories are maintained.

4. No Third-Party Sharing

We do not sell, trade, rent, or share your data with third parties. Specifically:

  • No advertising or marketing partners receive your data
  • No analytics providers track your behavior
  • No data brokers have access to your information
  • No social media platforms receive sharing data

The only exception is Supabase itself (as your infrastructure provider), which is bound by their own privacy and data processing agreements.

5. Cookie Usage

Our cookie usage is minimal:

  • Essential cookies only: Supabase auth tokens required for session management
  • No tracking cookies
  • No advertising cookies
  • No analytics cookies

No cookie consent banner is needed as we do not use non-essential cookies.

6. Your Rights

Since data is stored in your own Supabase instance, you have full control. You can view, export, modify, or delete any data at any time through the Supabase dashboard or API. If you are using a shared/hosted instance, contact the instance administrator for data access requests.

7. Security Measures

  • Cryptographically secure random number generation (crypto.randomInt)
  • HTTPS/TLS encryption for all data in transit
  • Row Level Security (RLS) for data access control
  • Rate limiting to prevent abuse
  • Atomic database operations to prevent race conditions
← Back to Home