Privacy Policy
Effective October 24, 2026
The Giveaway Picker (thegiveawaypicker.com) is a free tool for picking random giveaway winners. This policy explains what information the site handles, why, and the choices you have. In this policy, “we” and “us” mean the operator of The Giveaway Picker. “Host” means the person running a giveaway, and “entrant” means someone whose name or username is in a draw.
The short version
- No accounts, no ads, no analytics or tracking scripts, and no selling or sharing of personal information.
- We use only what's needed to run a draw and publish its public record.
- Imported comments are deleted automatically after 24 hours.
- Email hello@thegiveawaypicker.com to remove a draw record or ask about your data.
Information we collect
Entries you provide
When you paste a list or upload a CSV, we receive the names, usernames and any comment text in it. We use it only to run the draw you request.
Instagram (only if you connect it)
If you log in with Instagram, Instagram shares your account's ID, username, account type and profile picture, your recent posts, and the comments and replies on posts you choose to import. We request read-only permissions (instagram_business_basic and instagram_business_manage_comments). We never post, comment, message, like or follow on your behalf.
YouTube (only if this feature is enabled)
If you paste a YouTube link, we retrieve the video's public title, channel and comments through the YouTube API Services. This feature is subject to the YouTube Terms of Service and the Google Privacy Policy.
Technical information
To prevent abuse, we count requests per visitor using a one-way, salted hash of your IP address. The raw IP is not stored and the counter expires within about 10 minutes. Our hosting provider keeps standard server logs (such as IP address, browser type and the page requested) for security and reliability.
How we use information
- To import entries, apply your rules and pick winners at random.
- To publish the draw record so the host and entrants can verify the result.
- To keep the site secure, prevent abuse and fix problems.
- To respond when you contact us.
We do not use your information for advertising, profiling or automated decisions about you.
Public draw records
Each completed draw creates a record at a public, unlisted link. It shows the giveaway name, the source post or video, the rules, the winners and alternates, the random seed, and the list of entrant names or usernames. It does not include comment text. Anyone with the link can view it, and the host chooses whether to share it. We ask search engines not to index draw records. Hosts and entrants can ask us to remove a record or a name at any time.
Cookies and similar technology
We use one essential cookie, and only if you connect Instagram: an encrypted session cookie that keeps you logged in for up to 30 days. It holds your Instagram access token, which is never saved in our database. We don't use advertising, analytics or third-party tracking cookies.
Do Not Track and Global Privacy Control. Because we don't track visitors across sites or sell or share personal information, there is nothing for these signals to switch off. We honor them by default.
Who we share information with
We don't sell or share personal information, as those terms are defined by California law. We rely on these service providers to run the site:
- Vercel — website hosting and server logs.
- Upstash — database that stores draw records and temporary imports.
- Meta (Instagram) — when you connect Instagram.
- Google (YouTube API Services) — when you import from YouTube.
We may also disclose information if the law requires it, or to protect the safety and rights of users or the public.
How long we keep information
- Imported comments: deleted automatically after 24 hours.
- Instagram session cookie: up to 30 days, or until you disconnect.
- Abuse-prevention counters: about 10 minutes.
- Draw records: until the host or an entrant asks us to remove them.
Your rights and choices
Depending on where you live (for example California under the CCPA, or the EU and UK under the GDPR), you may have the right to know what personal information we hold about you, to get a copy, to correct it, and to have it deleted. To make a request, email hello@thegiveawaypicker.com with the draw link or the username involved. We'll respond within 30 days and won't treat you differently for asking. If you're in the EU or UK, we rely on our legitimate interest in providing a working, verifiable draw service (and on your request, when you import entries), and you can complain to your local data protection authority.
Deleting Instagram data
You can disconnect Instagram on the draw page at any time, which clears the session cookie. You can also remove The Giveaway Picker from your Instagram account under Settings → Apps and websites. Imported comments are already deleted after 24 hours. To remove a draw record or anything else, email hello@thegiveawaypicker.com and we'll confirm when it's done.
Children
The Giveaway Picker is meant for giveaway hosts who are 18 or older and is not directed to children under 13. We don't knowingly collect personal information from children. If you believe a child's information is in a draw record, email us and we'll remove it.
Security
The site is served only over HTTPS, the session cookie is encrypted and HTTP-only, and access to our database is restricted. No method of storage or transmission is perfectly secure, but we work to protect the information we hold.
Changes to this policy
If we change this policy, we'll update the effective date above. Significant changes will be noted on this page.
Contact
Questions or requests: hello@thegiveawaypicker.com. See also our Terms of Use and Accessibility Statement.