Privacy Policy

This describes what comment-pickers.com collects and why. The short version: you can pick a winner without giving us anything, and an account costs us your email address and little else.

Using the tool without an account

Pasting a link and drawing a winner needs no account. To make the one-draw-a-day allowance hold, we record each draw with the post's shortcode, the time, and your IP address, with an IPv6 address shortened to its /64 network first. These rows are deleted after seven days.

If you create an account

• Your email address, and either a password (stored only as a scrypt hash, never in readable form) or your Google account identifier if you signed in with Google. From Google we ask for two things only: openid and email. We never see your Google password.
• How you found us, recorded once when the account is created: your country (from Cloudflare's network, derived from your IP), the IP address itself, the external site or search that referred you, the first page of the site you landed on, any campaign tags in that URL, and your browser's user-agent string. We use this to understand which countries and channels the service is worth building for.
• A session token, kept in a cookie so you stay signed in. Only the SHA-256 hash of it is stored on our side, so a copy of our database does not hand anyone a live session.

We do not use advertising or analytics cookies, and we do not track you across other sites.

If you subscribe

Payment is handled by Stripe. Your card details go to Stripe and never reach our servers. We store a Stripe customer id, your subscription's status, price, renewal date and whether it is set to cancel, which is enough to know whether Pro is on. Stripe processes your data under its own privacy policy.

Instagram data

When you draw a winner, we fetch that post's public comments through a third-party provider (ScrapeCreators) and hold them for up to two hours so a repeat draw does not refetch them, then delete them. We only ever read what is already public on the post, we never sign in as you, and we do not build profiles of the people who commented.

Who else sees anything

Nobody, beyond the processors that make the site work: Stripe for payments, ScrapeCreators for Instagram data, Cloudflare in front of the site, and our own database server. We do not sell or share your data, and we do not send marketing email.

How long we keep it

• Draw records: 7 days.
• Fetched comments: up to 2 hours.
• Sessions: 30 days, or until you sign out.
• Account and subscription records: until you ask us to delete the account.

Your choices

Email [email protected] to get a copy of what we hold about you, correct it, or have your account and its data deleted. If you are in the UK, EU or another region with equivalent rights, those rights apply to you here. Deleting your account does not automatically cancel a subscription, so cancel it first from your account page, or ask us to do both.

Children

The service is not intended for anyone under 13, and we do not knowingly create accounts for them.

Changes

Updates are posted here with a new date. Contact: [email protected]