Privacy Policy

Last updated: September 2026

This is a starting template describing what this codebase actually collects and stores today — it hasn't been reviewed by an attorney, and doesn't yet address requirements like GDPR/CCPA data-subject rights, a data retention schedule, or a designated privacy contact.

1. What we collect

Account info: name, email, and a securely hashed password (we never store your password in plain text).
Purchases: the raffles and ticket numbers you buy, and the shipping address you provide for delivering a prize if you win.
Payments: when real payments are enabled, card details are entered directly on Stripe's own page and never reach our servers — we only store a Stripe customer ID and payment method ID, not your card number.
Seller applications: name, email, phone (optional), business name (optional), and what you're applying to sell.
Photos: images you upload for a listing.
Session cookies: used to keep you signed in. They're not used for advertising or cross-site tracking.

2. How we use it

To operate raffles: creating your account, processing ticket purchases, drawing and notifying winners, shipping prizes, and reviewing seller applications and listings.

3. Who sees it

Stripe processes payment information directly, when real payments are enabled.
An email delivery provider sends purchase receipts, draw results, and password reset emails on our behalf.
We don't sell your data or share it with advertisers.

4. Data retention

We keep account and ticket records for as long as your account is active, plus a reasonable period afterward for recordkeeping (e.g. verifying past draws were fair). Password reset links expire after one hour and can't be reused.

5. Your choices

You can request a password reset at any time from the login screen. To request deletion of your account or data, contact us through the channel listed on the site — we don't currently have a self-service delete option.

6. Security

Passwords are hashed (not stored in plain text), traffic is served over HTTPS, and session cookies are marked HttpOnly and Secure. No system is perfectly secure, but we don't store raw card numbers at all, which limits what a breach could expose.

7. Changes

We may update this policy as the service changes. Continued use after an update means you accept the revised policy.

8. Contact

Questions about this policy? Reach out through the seller application or admin contact channel listed on the site.