Giveaway Rules

1. Free to enter

No purchase is necessary to enter or win, and buying something does not improve your chances. You enter with an email address and nothing else.

2. You must confirm your address

After entering you get one email with a confirmation link. Your entry only counts once you click it, and the link expires 48 hours after it is sent. An entry that is never confirmed is not in the draw and is not counted anywhere on this site.

3. One entry per person per giveaway

One inbox may enter a giveaway once. Addresses that differ only by dots or a plus-tag are treated as the same inbox, and disposable email services are refused. Entering the same giveaway again simply tells you that you are already in.

4. Tickets improve your odds, they do not reserve a place

Entering gives you one ticket. Some actions — opening the product, coming back on a later day, bringing somebody who enters, and the social actions listed on the giveaway — earn extra tickets, up to the limits shown there. You compete with the best of the tickets you hold, so more tickets means better odds and never a guaranteed win. An entry with ten tickets can lose to an entry with one.

Once your address is confirmed you get your own link to that giveaway. If somebody opens it and then enters and confirms their own address, you get one more ticket. That happens once per entry however many people you send, and a link you open yourself from the same browser does not count. How many people came in that way is published on the giveaway, as a count.

Nothing you pay affects your odds, and nothing a company pays affects them either.

5. There is a maximum, and companies at it pay to be ordered

There is a limit on how much any one company may give away in a round. It is the same limit for everyone, it is shown on the board, and it goes up as the number of people who visit the board goes up, measured after a round has closed. A company that had already promised more than the limit before it existed keeps all of it; the limit stops a pot going higher, it never takes anything back.

Several companies can reach that maximum in the same round. When they do, they are all giving away exactly the same amount. Those companies — and only those companies — can pay us to be placed ahead of each other. What each one paid is shown on the board next to its listing.

This changes nobody's chance of winning anything. It also never moves a company past one that is giving away more. The money is paid to Riffleboard, it is never added to any prize pot, and no figure on this site adds the two together. It lasts one round and then it is gone.

6. How winners are drawn, and how to check it

Before entries close we publish a SHA-256 hash of a random seed. When entries close we publish the seed itself. Anyone can check that the hash of the published seed matches what was published beforehand, which is what makes it impossible for us to change the seed afterwards.

Winners are then selected by computing HMAC-SHA256 of the seed against each entry id — one value per ticket held — and taking the entries with the lowest values. The entry ids and ticket counts are published with the result, so anyone can repeat the calculation and arrive at exactly the same winners.

import { createHash, createHmac } from "node:crypto";

const r = await (await fetch("https://riffleboard.com/api/rounds/1")).json();

for (const g of r.giveaways) {
  const sha = createHash("sha256").update(g.seed).digest("hex");
  const best = (e) => {
    let low = null;
    for (let n = 1; n <= e.tickets; n++) {
      const t = createHmac("sha256", g.seed).update(e.id + "#" + n).digest("hex");
      if (low === null || t < low) low = t;
    }
    return low;
  };
  const order = g.field
    .map((e) => ({ id: e.id, key: best(e) }))
    .sort((a, b) => (a.key < b.key ? -1 : a.key > b.key ? 1 : 0))
    .slice(0, g.count)
    .map((e) => e.id);

  console.log(g.companySlug, sha === g.seedCommitment, order.join() === g.winners.map((w) => w.entryId).join());
}

7. Prizes come from the company, not from Riffleboard

Every prize is software supplied by the company running that giveaway: licences or subscriptions, at the public price shown. Riffleboard passes the prize on to the winner and is not the seller — the company's own licence terms apply to what you win.

Prizes cannot be exchanged for money, and are not transferable.

8. We can't test what we're given

A giveaway only goes live once the company has deposited enough keys for every prize, and we refuse what obviously isn't a key at all. What we can't check is whether a real-looking key is genuine and actually works; we don't have the company's product to test it against and we never redeem one. We store what we're given and hand it out exactly as received.

If your prize key doesn't work, the email it came in has a link for saying so. We write down what you tell us and when, and put it to the company — they can look up whether that licence exists and we can't. They either send a replacement, which we pass on, or tell you what their records show, which we also pass on. We don't decide between the two versions and we never take a key off anybody to settle one.

The same page is where you say a key worked. Once you have, that prize is settled and nobody will ask you about it again. There is a limit on the other half: one report per prize, within 30 days of the key going out. After a month a company can't tell a key that never worked from one that was used.

How often a company's prizes were reported and how often it replaced one are published on its listing, for every round it has run here. They are counts, not a rate.

A discount code works the same way in principle and not in practice: most of them are one shared code, so there is nothing to swap it for. If yours is refused, that is between you and the company, and the company's own terms apply to what you bought.

9. If you do not win

Most giveaways here carry a discount code for people who entered and did not win. It is sent when the draw closes and is valid for 72 hours from that moment. The giveaway page says whether there is one before you enter, and what the company says it is worth.

The code is the company's and not ours. When a company gives us a fixed number of one-time codes instead of one shared code, they can run out, so a code is not promised to every person who does not win. The giveaway page says which of the two arrangements it is.

If you buy during a giveaway and then win it, the company refunds what you paid.

10. Who may enter

You must be 18 or older. If the law where you live sets a higher age for entering a prize draw, that age applies to you instead. We ask because what you can win is a software licence with the company's own terms attached, and because a draw open to children needs a parent's permission that we have no way to ask for or check. Employees of Riffleboard and of the company running a giveaway may not enter it. Void where prohibited by law.

Riffleboard does not run in:

New York (US) — Prizes over $5,000 need state registration and a bond, filed 30 days before entries open. Our pots start above that.

Florida (US) — Same rule, less notice — registration and a bond are due 7 days before entries open for prizes over $5,000.

Italy — A random prize draw needs a notary in the room and a legal representative based in Italy. We have neither.

North Korea — EU sanctions block us from delivering anything there, prize or not.

We check this when you enter. Our host works out the country from your connection, and the state too if you're in the US, and an entry from one of the places above is refused. If we can't work out the country at all, we can't take the entry.

We don't store your IP address. What we keep alongside your entry is the country code, plus the state code where a state rule applies, so we can show afterwards that this rule was applied to it.

A location read off a connection gets it wrong sometimes. A VPN or a company proxy puts you where its exit point is rather than where you are, so it can turn away somebody who was entitled to enter. Switching a VPN off before you enter is the fix, and it is the only one we have: we can't verify a claim about where you live, so we don't ask for one.

11. Your email address

We store your address to confirm your entry, to run the draw, and to send you your prize or discount code. We never pass it to the company running the giveaway. There is a box asking whether you're okay hearing from them, and we record the tick, but nothing is sent anywhere. That box is optional and never pre-ticked, and your entry counts either way.

Once we assign you a prize key or discount code, that code and your entry together count as personal data too, for as long as they stay linked. If you ask us to delete your data after a code has already been sent to you, we remove your entry — but we may keep a minimal record of which code was given out and when, in case you or the company need it later to sort out a problem with that prize.

What we do with your data, and for how long, is in the privacy policy.

12. Disqualification

We may remove an entry that breaks these rules — for example one person entering a single giveaway through several addresses. We may also cancel or reschedule a giveaway if the company cannot supply the prize, in which case everyone who entered is told what happened.