Privacy: what is stored, where and for how long

Where it is kept

Labels, codes as hashes, rankings and placements are kept in one Cloudflare D1 database that belongs to this site, with the organisers' accounts, and the region is not pinned, so Cloudflare may keep it outside your country. Events are deleted 180 days after the last solve, or on request. The pages themselves are static files served by Cloudflare Pages.

What is stored for an owner

An owner is the organiser who signs in.

• A random account id, the account name you chose for your passkey manager, and when the account was made.
• For each passkey: its public key, its id, a signature counter, the name you gave it and when it was added and last used. Never a fingerprint, a face or any biometric data: those stay on your device.
• A scrambled form (SHA-256) of your recovery code. The code itself is shown to you once and not kept.
• For each signed in device: a scrambled form of its session id, and when it was made, last used and when it expires (90 days after the last use).
• Your email address, only if you add one, used only for the one "Choices are closed" notice per event, and a scrambled form of the confirmation link. Nothing but the confirmation is sent before you confirm it. It is the one place an email address is ever stored.
• Each event: its title, whether people are adults or children, its time zone, settings, closing time, lottery number and status; the event link as a scrambled form (SHA-256) plus a sealed copy that only this server can open with its own secret key, so you can see the link again; when the link was replaced, when choices were reopened, and how many codes that did not match were tried through it.
• Each session: title, room, capacity, round and order.
• Every saved solve: the round, the lottery number, a fingerprint of what was solved, and the counts it produced, kept with the event as its record.
• Notices for you, and a record of each email sent, kept 30 days.

What is stored for people taking part

• The label the organiser typed (or, in adult mode with self-join on, the name the person typed) and an optional group such as a class or team. For children, the server accepts one word, or a first name and one initial: it refuses two full words, names run together such as "MayaRossi", and more than 2 Chinese or Korean characters. Group names for children are refused when they hold a word for a school, surname, address, postcode or birth date, also written with spacing, invisible characters or look-alike letters. No check can catch every way of writing a name, so organisers are asked to use a first name or initials.
• The person's code, as a scrambled form (SHA-256) only. The code is shown to the organiser once (or to the person once, after self-join), and when it was last replaced.
• Their ranking for each round, their place, whether it is locked, and what they were last told.
• While they are signed in on a device: a scrambled form of their session id, ended when they press Finished, when the browser closes, or after 30 minutes without use; in adult events a person may tick Keep me signed in on this device, which keeps it 30 days after the last use.
• No email address, no account and no date of birth. People taking part are never emailed.

Limits on how fast requests come

To stop guessing and flooding, the server counts requests per person, per event and per network address in hourly buckets. The address is stored only as a keyed scramble that cannot be turned back into the address, and each bucket is deleted after 2 hours. Network addresses are never written to logs.

How long it is kept

• An event and everything in it: until 180 days after its last solve, or 180 days after it was made if never solved. It then moves to Deleted with a notice to you, and is removed 7 days later unless you restore it.
• A deleted event: 7 days, while it can be restored, then deleted for good.
• A deleted account and everything in it: 7 days, while you can sign in and cancel, then deleted for good.
• Owner sessions: until 90 days after the last visit on that device. People's sessions: 30 minutes after the last use, or 30 days with Keep me signed in.
• Passkey sign in requests: 5 minutes. Rate limit buckets: 2 hours. Email records and notices: 30 days.

What stays in your browser

On the people's page, a ranking that has not been sent yet is kept in that browser tab (session storage, key beginning with choiceplace) until the server confirms it, then dropped; it is gone when the tab closes. The organiser pages keep nothing in storage but the last tab you opened. The secret part of the event link sits after the # sign, which browsers do not send to any server in the address. Codes shown after adding people live only in that page until you leave it.

How to see and delete it

On your account page, Download everything gives one file with all of it. Delete my account removes everything after the 7 days above; you can also delete single events and withdraw single people. Requests by email go to [email protected].

Cookies

Two cookies, neither for tracking. Organisers who sign in get a session cookie that keeps them signed in. A person who enters a code gets a cookie that lasts until the browser closes (or 30 days, in adult events, if they tick Keep me signed in on this device) and is sent only to this site's people's API. Neither can be read by page scripts or is sent to another site.

Page counts

Visits may be counted by Cloudflare's own page counter, which sets no cookie and records that a page was opened, never what you typed. There is no other analytics.

Payments

No paid plan is offered at present; if one is added, this page will describe it.

Typefaces

Headings are set in Space Grotesk, and the PDFs use Noto Sans, Noto Sans Arabic and Noto Sans Hebrew, all under the SIL Open Font License 1.1 and served from this site. The licence is at /fonts/OFL.txt.

Changes and contact

If this policy changes in a way that affects what is stored, the change will appear on this page. Questions go to [email protected].