Privacy Policy

The three outside tools, and your say over them

You choose whether these three run. We ask once, in a strip along the bottom of the page. Say no and we don't ask again for at least six months; say yes and we ask again after a year. Either way we ask again if what loads here changes. You can change your answer any time from the Cookies link at the bottom of the page, and changing it to no stops all of them from then on.

Until you say yes, not one of the scripts is fetched.

The counter that runs whatever you choose is our own. It's a random number in a cookie called rf_v, it lasts a year, and it's how a click counts once instead of five times and how a ticket you've already earned isn't earned again. If you're a company signed in to a dashboard, your sign-in cookie is the same sort of thing, and so is the cookie your answer to this question sits in.

We use PostHog to see how people move around the site. Say yes and its script loads on every page, and what it records is which page you opened, which giveaway you opened, and whether an entry was started or confirmed. It stores a random ID in your browser to tie those into one visit, and your IP address reaches it because your browser has to fetch the script. Its servers for this are in the EU.

No session recording, so nothing plays back what you did on a page. No automatic capture of clicks. Every input box on the site is masked, so what you type never reaches PostHog. What travels with an event is at most which giveaway it was and what category that giveaway is in. Never your email address, never the ID we count you with, and it never builds a profile of you because we never tell it who you are.

We use Datafast to count traffic. Say yes and its script loads on every page here, so it sees which page you opened and where you came from, and your IP address reaches it the way it reaches anything else your browser loads. It uses that to work out a country. It sets its own cookie with a random ID in it.

When you confirm an entry, or a company sends in an application, we tell Datafast that it happened and pass the ID from that cookie. Nothing else goes with it: not your email address, not which giveaway you entered, not the ID we use ourselves. Without that cookie there is nothing to send, so this stops as well if you said no.

We use Google Tag Manager, which is a container we can put other measuring tags in without changing the site's code. Say yes and its script loads on every page here, so it sees which page you opened and where you came from, and your IP address reaches Google the way it reaches anything else your browser loads.

Because it is a container, what runs inside it can change without this page changing. What we hold ourselves to is the list at the top: nothing that advertises to you, follows you to another site, or builds a profile. Put anything in there that does, and the question gets asked again from scratch.

How long we keep things

An entry you never confirmed is deleted 30 days after you made it. The confirmation link dies after 48 hours, so after that there's nothing an unconfirmed entry can turn into.

A confirmed entry keeps your email address until six months after the round closes. Then the address goes, along with the key we derive from it and the visitor ID it was made with. If you won, we keep the address for twelve months instead: a licence key can turn out to be a dud months later.

What's left after that is the entry itself. Its id, how many tickets it held, the country and state code it was accepted under, which version of the rules you agreed to, and whether it won. The draw is published as a list of entry ids and ticket counts so that anyone can recompute it, so those have to stay. Once the address is gone we can't turn one of them back into a person, and we keep nothing on the side that would let us.

The random ID we count you with sits in a cookie in your browser for a year. Where it's written down next to a click or a visit, we strip it 13 months after the round closes, one month past the longest that cookie can live. The count stays, the ID doesn't.

Prize keys and discount codes a company left with us and nobody ever received are deleted 90 days after the round closes. A code that did reach somebody keeps its encrypted value for twelve months, in case they lose the email, and after that we keep only the record that a code went out and when.

Your record of agreeing to the rules is kept for ten years after the round it covered. That's how long somebody can still bring a claim about an agreement here, and it's the whole reason to have the record at all.

A company's file runs on a different clock. Its contact address, what it agreed to, its invoices and its payments are kept for at least seven years from the end of the year the money moved, because the bookkeeping rules say so and we don't get to shorten that. An application we turned down is deleted twelve months after the decision.