Privacy

What we store

• Your email address, used to identify your account and sign you in. Nothing is sent to it unless you ask for something that requires it.
• A password hash, produced with bcrypt. Your actual password is never stored and cannot be recovered from what we hold — not by us, and not by anyone who obtained the database.
• An optional display name, if you enter one.
• The numbers you save, along with the game and the strategy that produced them.
• Session records, holding a hash of your session token, the expiry, and the browser user-agent string. Deleted when you sign out or when they expire.

What we do not do

• No advertising, and no advertising identifiers.
• No analytics platform, no tracking pixels, no third-party scripts.
• No selling, renting or sharing of personal information with anyone.
• No profiling, and no attempt to work out who you are beyond your account.
• No emails you did not ask for.

Cookies

One cookie, sagedraws_session, set only when you sign in. It holds a random session token, is marked HttpOnly and SameSite=Lax, and is served as Secure over HTTPS. It exists solely to keep you signed in. There are no cookies for anything else, which is why there is no cookie banner.

Server logs

The web server keeps ordinary short-lived request logs, which may include IP addresses, for security and debugging. IP addresses are also held briefly in memory to rate-limit sign-in attempts. Neither is used to build a profile or linked to your saved numbers.

Your choices

You can delete any saved line at any time from your dashboard. You can ask for your account and everything attached to it to be deleted, and deleting an account removes its saved numbers and sessions along with it. Depending on where you live you may have additional rights — including under the California Consumer Privacy Act — to know what is held, to have it deleted, and not to be discriminated against for asking. We do not sell personal information, so there is nothing to opt out of.

Children

This site is not intended for anyone under 18, and accounts should not be created by under-18s. If you believe a child has registered, contact us and the account will be removed.

Where data lives

Sage Draws runs on a private server with a PostgreSQL database. Draw results are fetched from public lottery sources; those requests come from the server, not from your browser, so visiting this site does not expose you to them.

Changes

If this notice changes in a way that matters, the date at the top will change with it.