Privacy policy

Your account

You sign in with Google, Facebook, Instagram, TikTok, a link we email you, or your email address and a password. For your account we keep:

• an account ID, your name and, if a sign-in method shares one, your email address;
• each way you sign in: the provider, the ID it gives you and a label such as your username or email address. You can add or remove ways to sign in in Settings;
• if you set a password: the email address it signs in with and a salted scrypt hash of it, never the password itself. You can change or remove it in Settings;
• your choice of light or dark mode;
• your sessions: a random code stored only as a fingerprint, and when it expires. A session lasts 30 days, or until you sign out.

We never merge two accounts because they share an email address.

What each sign-in method shares

Every provider shares who you are. Some can also give Sealdraw access to your posts, but only if you allow it on the provider's own consent screen.

Google

Your Google account ID, name and email address. If you also allow read-only access to YouTube, the same sign-in connects your YouTube channel so Sealdraw can read your videos and their comments.

Facebook

The ID Facebook gives you for Sealdraw, your name and your email address. If you also allow access to your Pages, the same sign-in connects them, and the Instagram professional accounts linked to them, so their posts and comments can be read.

Instagram

Your Instagram professional account's ID and username (Instagram shares no email address). Signing in also connects that account, so Sealdraw can read its posts and their comments.

TikTok

Your TikTok ID for Sealdraw and your display name. Signing in with TikTok connects nothing: reading your videos' comments is a separate connection you can add in Settings.

Email link

Your email address. We send the sign-in link through Resend, the email delivery service that processes the address and the message for us. A link works once and expires after 15 minutes.

Connected accounts

When you connect an account, by signing in with it or from Settings, we store the account's ID and name and the access tokens the platform issues, so we can read that account's posts and their comments. Tokens are stored encrypted and are never shown in the browser. Sealdraw only reads: it never posts, comments or sends messages for you.

Comments on giveaway posts

For each comment on a post you add to a giveaway we store its ID and text, the commenter's platform user ID, username and display name, when it was posted and its like count. Comments come from the platform's API, from a file or text you import, or from the Sealdraw browser extension on your own TikTok, Instagram or Facebook post (see Browser extension).

When you seal a draw, the comments that qualify are frozen with it: each one's platform, comment ID, author ID and username for the certificate, and its text and the commenter's display name for your own view of the winners.

We don't collect passwords, private messages, contact lists or payment details.

Browser extension

The Sealdraw capture extension for Chrome is optional. It reads the comments of a TikTok, Instagram or Facebook post in your browser, for posts no connection can read.

• What it reads. Only the post you choose to capture, and only once you start a capture (Capture comments in Sealdraw, or Add this post in the extension's popup): the post's comments, each with the commenter's platform user ID, username and display name, when it was posted and its like count, and the number of comments the post shows. It never reads your cookies, your password or session on the platform, private messages, avatars or profiles.
• Before a capture. The extension runs on TikTok, Instagram and Facebook pages so that a capture includes the comments a post had already loaded. Those stay in that tab's memory, and are dropped when the tab closes or moves on, unless you capture that post. When you open the extension's popup, it reads the address of the tab in front, to tell whether it is a post.
• Where it sends data. Only to your own Sealdraw account, over HTTPS, at the Sealdraw address you approved in the extension's own window: the comments it captured, the post's link and, when you connect it, a device label such as "Chrome on Windows". It sends nothing to anyone else, and has no analytics or ads.
• What it stores on your computer. In the extension's storage in Chrome: the connection token for your account (we keep only its fingerprint), your account name, the Sealdraw address it is connected to and a few settings, such as Include replies and the giveaway you picked last. While a capture runs, its progress (the post's link and counts, no comments) is kept until Chrome closes.
• Diagnostic report. Copy diagnostic report in the popup copies a technical summary of the last capture to your clipboard, only when you click it. It holds no comment text, usernames, account names or tokens, and you decide whether to send it to anyone.
• No tracking. The extension doesn't record your browsing, runs on no other websites than TikTok, Instagram, Facebook and Sealdraw's own pages, and what it reads isn't sold, used for advertising or used to decide creditworthiness.
• Disconnecting. Disconnect in Settings → Browser extension, or in the extension's popup, revokes the token at once; removing the extension from Chrome deletes what it stored. Comments it captured stay in your giveaways until you delete them, like any others.

How we use it

• To sign you in and keep you signed in.
• To build a giveaway's entry list, apply its rules and draw winners.
• To send the sign-in links you ask for. We send no other email.
• To publish a draw certificate. It lists each entry's platform, comment ID, author ID and username so anyone can check the draw. It never shows comment text or display names.

We don't sell data, show ads or share it with anyone except the services below, or as required by law.

Services that process data for us

• Resend delivers sign-in emails: it receives the email address and the message.
• Google, Meta (Facebook and Instagram) and TikTok handle your sign-in and the connections you make, under their own privacy policies.
• Paddle processes payments as our merchant of record: when you buy a plan it receives your email address, payment details and billing address under its own privacy policy. We receive only what you bought, Paddle's customer and subscription IDs and the renewal date, never card details.
• The company that hosts this Sealdraw site stores the database.

Cookies

We only use cookies the site needs to work: one keeps you signed in, one remembers light or dark mode, and one lasts 10 minutes while you sign in or connect an account with a provider. There are no advertising or tracking cookies.

How long we keep it

• Comments are kept while their giveaway exists, and are refreshed or deleted as the platforms' developer policies require.
• Deleting a giveaway deletes its sources and comments at once, and the comment text and display names frozen with its draws.
• Deleting your account deletes your giveaways with their sources and comments, your connections, your sessions, your ways to sign in and your billing records at once (a running Pro subscription is cancelled first), and the comment text and display names frozen with your draws. Paddle keeps its own records of payments, as the law requires of a seller.
• Published draw certificates stay online either way, so a draw can still be checked. They keep the giveaway's title, the posts the entries came from, the draw's result and the frozen entry list: each entry's platform, comment ID, author ID and username, never comment text or display names.
• Removing a connection deletes its tokens at once. Unused sign-in links expire after 15 minutes.

Your choices

Delete a giveaway, a connection or your whole account in Sealdraw at any time, and revoke its access in your Google, Facebook, Instagram or TikTok settings. Commenters can ask for their comments to be deleted or to be removed from a certificate: see data deletion.

Contact

Questions about your data: hello@sealdraw.com.