Privacy policy

1. Who handles your information

WinSend provides tools for raffle organizers to collect and deliver winner information. We handle account, billing, security, and service-operation information to run WinSend. Organizers choose which raffle sources, winner fields, recipients, and team entries to include and are responsible for their authority to collect and share those details.

For privacy questions and data requests, contact WinSend at compactgamesnft@gmail.com.

2. Information we process

• Account information: your X account identifier, username, display name, profile image, sign-in session, and authorization credentials needed for the features you connect.
• Delivery information: delivery names, raffle URLs, selected fields, recipient handles and identifiers, message templates, team entries, delivery history, errors, and saved winner-page reviews.
• Winner information: selected wallet addresses, X handles, Discord usernames and IDs, email addresses, Telegram details, and custom raffle responses supplied by a connected provider or an organizer.
• Integration credentials: raffle-provider API keys, X authorization tokens, and the centrally connected Google account's authorization credentials.
• Billing information: subscription status, billing period, payment-provider identifiers, and checkout or subscription events. Payment details are entered in Stripe's checkout; WinSend does not store full payment-card numbers.
• Technical information: service requests, timestamps, operational logs, errors, and limited product-usage events. Hosting providers may process network information such as IP addresses to deliver and protect the service.

3. How we use information

We use information to authenticate accounts, monitor configured raffles, collect selected winners, publish results, generate exports, send requested X messages, manage subscriptions, respond to requests, prevent abuse, and diagnose service problems.

Where European data-protection law applies, our grounds depend on the activity: performing our agreement with account holders, complying with legal obligations such as accounting requirements, and legitimate interests in service security, support, and proportionate service improvement. Where consent is required, we rely on that consent. Organizers must establish an appropriate legal basis for the winner information they ask us to process.

4. Public winner pages and exports

When Google Sheets export is enabled, the exported spreadsheet also permits anyone with its link to read it. Public reader access does not permit editing. Search-engine exclusion and an unlisted sharing link do not make the information confidential.

Deleting an export or removing access cannot erase copies already downloaded or retained by recipients. Contact the organizer about incorrect winner details or a result you believe should not have been published.

5. Google account access

WinSend uses a centrally authorized Compact Games Google account to create winner spreadsheets in that account's Drive. WinSend users and recipients do not need to connect their own Google accounts. The account owner authorizes access, and WinSend retains a refresh token so exports and cleanup can run without an interactive sign-in.

We request access to files created by or explicitly opened with the app, using Google's drive.file permission. The integration creates spreadsheets, writes winner data, reads the file identifiers and metadata needed to manage its exports, grants link-based reader access, and deletes expired exports. It does not request unrestricted access to the account's Drive, Gmail, or contacts.

Google API data and authorization credentials are used to operate these features, not for advertising, sale to data brokers, credit decisions, or training general-purpose AI models. Human access is limited to what is authorized or needed for security, support with permission, or legal obligations. WinSend's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

The Google account owner can revoke WinSend's access in Google Account connections. Revocation stops further authorized access; it does not delete existing files and may prevent automatic cleanup. The account owner can delete those files directly in Google Drive.

6. Service providers and disclosures

We use Microsoft Azure for hosting and infrastructure, Stripe for checkout and subscription services, Google for spreadsheet exports, and PostHog for limited product analytics, error reporting, and session replay. Connected raffle providers and X process the requests necessary for the features you configure. These providers may also process information under their own privacy policies.

We disclose information as needed to deliver the requested service, investigate abuse, comply with applicable law, or handle a lawful business transfer with appropriate notice and protections. We do not sell personal information or use winner details for targeted advertising.

Providers may process information outside your country, including outside the European Economic Area. Where required, international transfers must use a recognized legal mechanism, such as an adequacy decision or contractual safeguards. You may contact us for information about safeguards applicable to your data.

7. Storage, retention, and security

Google Sheet exports are scheduled for permanent deletion three calendar months after their export job is created. The winner page stops displaying the sheet link at that deadline. Google outages or authorization failures may delay remote deletion; cleanup retries automatically when access is available.

The three-month schedule applies to Google Sheet exports, not to every WinSend record. Account records, winner pages, delivery history, and reviews remain as needed to provide the service, resolve requests or disputes, prevent abuse, and meet legal obligations. Archiving a delivery does not delete its published results. Billing records may need to be retained after cancellation. Minimal export-management identifiers and timestamps remain so expired files are not recreated.

We use access controls, HTTPS, and protected credential storage. Access to operational systems is restricted. No online service can guarantee absolute security; do not submit private keys, passwords, or other secrets as winner fields or custom responses.

8. Cookies and analytics

WinSend uses session cookies for sign-in and account security. Limited browser analytics record page categories, feature use, and sanitized errors. Signed-in events may use an opaque account ID. PostHog session replay records clicks, scrolling, and masked page layouts on selected website and product pages to help us understand how people use WinSend. We mask input values, page text, and element attributes and omit images and embedded media. We do not record public winner pages, sign-in callbacks, or pages with query strings or fragments. Automatic click-event capture remains off. Browser analytics does not use analytics cookies or local storage and does not intentionally send winner values or private winner-page URLs to PostHog.

Browser Do Not Track and Global Privacy Control signals disable browser analytics. Operational server logs and diagnostics needed to run and secure the service remain active. PostHog also receives high-level server warnings, errors, and critical logs; real server exceptions include their type and code stack trace. Detailed operational diagnostics remain in Application Insights. We omit log field values and exception messages from the PostHog summaries. Google, X, and Stripe may use their own cookies when you visit their services.

9. Your choices and rights

Depending on applicable law, you may request access, correction, deletion, restriction, or portability of your personal information, object to processing based on legitimate interests, or withdraw consent. These rights can have legal limits. You may also complain to your local data-protection authority.

For raffle-specific questions, contact the organizer first. For information held by WinSend, contact us with enough context to locate the account or delivery. We may ask for proportionate verification before disclosing or changing records. Removing an integration, revoking authorization, or cancelling a subscription does not automatically erase all stored information.

10. Children and policy changes

WinSend is intended for adult raffle organizers and is not directed at children. Organizers must respect age restrictions and applicable protections for participants. Contact us if you believe a child's information has been provided improperly.

We will update this page when our practices change and change the date above. Material changes will be communicated as required by law, and new consent will be requested where required before information is used for a new purpose.