Privacy
Written from the actual database schema, not from a template. If something here does not match what the service does, the service is wrong and we will fix it.
Last updated 2 November 2026.
Two different roles
If you run a giveaway, we hold your account data and decide how it is handled.
If you enter a giveaway, the organiser decided to collect your details and what to do with them. We store and process that data on their behalf. For anything about how a specific giveaway uses your data, the organiser is the right place to ask — but you can always contact us too, and we will act on erasure requests directly.
If you enter a giveaway
What we store
| Data | Why |
|---|---|
| Your email address, as you typed it | To send the confirmation link and to give the organiser a way to reach a winner. |
| A normalised form of that address | To stop the same inbox entering twice. Dots and +tags are collapsed for known providers. |
| Your TikTok username | Shown in the public result if you win, so the giveaway can be announced. |
| Your entry code | So you can find yourself in the published list. |
| Whether and when you confirmed | Only confirmed entries go into the draw. |
| A hash of your confirmation token | The token itself is never stored, so a leaked database cannot be used to confirm entries. |
| Whether you ticked marketing consent | A separate, optional box. Leaving it unticked does not affect your entry. |
| A hash of your IP address | To rate-limit bulk entry attempts. The address itself is never written down — only an irreversible fingerprint of it. |
What becomes public when the draw happens
To make the draw checkable, the entry list is published. For each entry it shows:
- the entry code,
- the TikTok username given,
- a masked email address: the first two characters and the domain, for example
bu***@gmail.com.
The full address is never published. The number of asterisks is fixed, so the length of your address is not revealed either. If you would rather not appear in a public list at all, do not enter — the list is the thing that makes the result checkable, and it cannot be switched off for one person without breaking it for everyone.
If you run giveaways
We store your email address (both as you typed it and in normalised form), your chosen time zone, when the account was created and when you last signed in.
There is no password, so there is none to leak. Sign-in codes and session tokens are stored only as hashes.
For each giveaway we store its title, prize, rules, your TikTok username, the random seed and its fingerprint, the fingerprint of the entry list, and the result.
What we never collect
- Passwords — the service does not use any.
- Payment details — none are taken.
- Raw IP addresses.
- Anything from your TikTok account. We have no access to TikTok and read nothing from it; the username is simply text you typed.
- Analytics, advertising or tracking of any kind. The public pages load no external file and set no cookie.
Cookies
One cookie, and only if you sign in to run giveaways: a session token, valid for 30 days. Entry pages set no cookies at all.
Who else sees the data
| Who | What for | Where |
|---|---|---|
| Hetzner | Servers and storage | Finland (EU) |
| Resend | Delivering confirmation and sign-in emails | United States |
| Cloudflare | DNS only — traffic is not routed through it | Global |
Email delivery means your address is transferred to a provider in the United States. That transfer is necessary to send you the confirmation link; without it you cannot enter. We sell data to nobody and share it with no one else.
How long it is kept
Entries stay for as long as the giveaway record exists, so that a published result remains checkable. Sign-in codes expire after 10 minutes and sessions after 30 days.
We do not yet delete old giveaways automatically. Until we do, removal happens on request — see below. We would rather say this plainly than publish a retention period we are not enforcing.
Your rights
You can ask for a copy of your data, ask for it to be corrected, ask for it to be deleted, and withdraw marketing consent at any time. Withdrawing marketing consent does not remove you from a draw.
Erasure has one limit worth knowing: if the draw has already happened, removing your row would change the published list and break the proof for everyone else. In that case we remove your email address and replace your row with its entry code alone, so the result still verifies but you are no longer identifiable.
Write to support@drawnfair.com. If you are in the EU or UK and are not satisfied with how we handled it, you can complain to your local data protection authority.