Privacy Policy

It covers two groups of people:

• Organisers — people who create a DrawPilot account to run giveaways.
• Participants — people whose names an organiser adds to a giveaway, by uploading a list or by importing comments from the organiser’s own Facebook Page.

For participant information, the organiser decides what to add and why. DrawPilot processes it on the organiser’s behalf to run the draw. Organisers are responsible for having the right to use their participants’ information and for following the rules of their giveaway and of any platform they use.

From organisers:

• Account details: email address, password (stored only as a secure hash by our authentication provider), and optionally first name, last name and profile picture.
• Content you create: campaigns, settings, campaign images, participant lists, draw sessions and winner records.
• If you connect Facebook: your Facebook user ID, the names and IDs of the Pages you choose to connect, and Page access tokens.
• Basic technical data needed to keep you signed in and protect the service, such as session tokens and server logs (IP address, browser type, time of request).

About participants (added by an organiser):

• Name, and optionally email address, phone number, photo, ticket or entry number, and notes.
• For Facebook imports: the commenter’s public name and Facebook-scoped user ID, profile picture link (when Facebook provides it), the comment ID and time. If the organiser uses a keyword rule, the comment text is read to check the rule but is not stored.

• To provide the service: store your campaigns, run draws, save winners and show your history.
• To import participants from a Facebook Page post you manage, when you ask us to.
• To send account emails, such as sign-up confirmation, password reset and email change messages.
• To keep the service secure, prevent abuse and fix problems.

We do not sell personal information, do not use it for advertising, and do not use Facebook data for any purpose other than importing participants into the organiser’s own campaign.

The Facebook importer uses only Meta’s official Graph API, with the Page owner’s permission given through Facebook Login. We request these permissions: pages_show_list (to list Pages you manage), pages_read_engagement and pages_read_user_content (to read posts and comments on those Pages). We never post, comment, message or change anything on Facebook.

• Page access tokens are encrypted (AES-256-GCM) and stored on our server. They are never sent to your browser.
• Imported commenters become participants in your campaign. You can edit or delete them at any time.
• You can disconnect a Page in DrawPilot at any time, and you can remove DrawPilot from Facebook in your Facebook settings (Settings & privacy → Settings → Apps and websites).

Our use of information received from Meta follows the Meta Platform Terms and Developer Policies.

Emails and phone numbers are never shown on the live draw screen. They are hidden on the winner reveal unless the organiser chooses to show them, and are left out of exports unless the organiser includes them.

We use a small number of service providers to run DrawPilot:

• Supabase — database, file storage, authentication and server functions. Data is hosted in Supabase’s Asia-Pacific (Seoul, South Korea) region.
• Netlify — hosting of the website itself.
• Google Fonts — web fonts, which your browser loads from Google.
• Meta — only if you use the Facebook importer.

This means your information may be processed outside the country where you live. Each record is protected so that only the account that created it can access it, and photos are delivered through short-lived private links.

• Your account and campaigns are kept until you delete them or delete your account.
• Deleting a participant removes them from the campaign. Winner records keep a snapshot of the winner’s details so the draw history stays accurate; deleting the campaign removes these too.
• Deleting your account (Account settings → Delete account) permanently removes your profile, campaigns, participants, winners, uploaded files and Facebook connections.
• Facebook Page tokens are deleted when you disconnect the Page or delete your account.
• Server logs are kept for a limited period by our providers for security purposes.

Organisers can view, edit, export and delete their data directly in the app at any time. Participants who want their information removed should contact the organiser who ran the giveaway; you can also email us at hello@drawpilot.app and we will help or forward your request. You may also ask us for a copy of your information or to correct it.

To delete data DrawPilot received from Facebook, see our Data Deletion instructions.

We use browser storage only to keep you signed in and remember settings such as sound. We do not use advertising or tracking cookies.

We use encrypted connections (HTTPS), per-account access controls on every database record, encrypted storage of Facebook tokens, and private file storage. No system is perfectly secure, so please use a strong, unique password.

DrawPilot is not intended for anyone under 18, and organisers must be at least 18. We do not knowingly collect information from children as account holders.

We may update this policy. We will change the “Last updated” date above and, for significant changes, notify account holders by email or in the app.

Lokman Hossain, operator of DrawPilot, Bangladesh. Email: hello@drawpilot.app