Privacy

What we store

• Your email address, used to identify your account, to confirm that the address is yours, to send a password reset when you ask for one, and to send the mailing-list email described below. Unsubscribing stops the mailing-list email and leaves confirmation and reset messages working as normal, since those are about your account rather than marketing.
• Your password, stored only as a salted one-way hash produced with scrypt. We cannot read it, we cannot recover it for you, and a copy of our database would not reveal it. Nobody here will ever ask you for it.
• Confirmation and reset links, stored only as a one-way hash, with an expiry, and usable once. Spent and expired links are deleted automatically.
• An optional display name, if you enter one.
• The numbers you save, along with the game and the strategy that produced them.
• Session records, holding a hash of your session token, the expiry, and the browser user-agent string. Deleted when you sign out or when they expire.
• A count of generator use, so we can see which games and strategies people actually use. Each time numbers are generated we record the game, the strategy, how many lines, the time, and whether the visitor was signed in. We do not record who it was, your IP address, your browser, or the numbers themselves, so these counts cannot be traced back to you or to your account.

What we do not do

• No advertising on the site itself, and no advertising identifiers.
• No analytics platform, no tracking pixels and no third-party scripts on this site. Your mail provider may record whether a message was opened.
• No selling or renting of personal information. Your address is shared only with the services that deliver our email, so that it can be delivered: our mail provider for account messages, and systeme.io, which hosts our mailing list, once you have confirmed your address.
• No profiling, and no attempt to work out who you are beyond your account.
• No email you cannot stop. Every promotional message carries a working unsubscribe link.

Mailing list

Creating an account adds your address to our mailing list once you have confirmed it by opening the link we send. An address nobody has confirmed is never added, because it may belong to somebody else. The list is hosted by systeme.io, which sends those messages and handles unsubscribing. We use it to send news about Sage Draws and, from time to time, products or services we think are worth your attention. Every one of those messages carries an unsubscribe link. Unsubscribing applies to all promotional email and takes effect straight away; confirmation and password-reset messages are not promotional and keep working, because without them you could not recover your account. Your address is never sold or rented.

Cookies

One cookie, sagedraws_session, set only when you sign in. It holds a random session token, is marked HttpOnly and SameSite=Lax, and is served as Secure over HTTPS. It exists solely to keep you signed in. There are no cookies for anything else, which is why there is no cookie banner.

Server logs

The web server keeps ordinary short-lived request logs, which may include IP addresses, for security and debugging. IP addresses are also held briefly in memory to rate-limit sign-in attempts. Neither is used to build a profile or linked to your saved numbers.

Your choices

You can delete any saved line at any time from your dashboard. You can also delete your whole account yourself, from the bottom of your dashboard, which removes it along with its saved numbers, sessions and any pending emailed links; or email info@sagedraws.com and we will do it for you. Depending on where you live you may have additional rights, including under the California Consumer Privacy Act, to know what is held, to have it deleted, and not to be discriminated against for asking. We do not sell personal information, so there is nothing to opt out of on that front. Promotional email is separate and always optional: unsubscribe from the link in any such message, or email info@sagedraws.com and we will take you off the list. Deleting your account does not remove your address from the mailing list by itself, so do one of those as well if you want both.

Children

This site is not intended for anyone under 18, and accounts should not be created by under-18s. If you believe a child has registered, email info@sagedraws.com and the account will be removed.

Where data lives

Sage Draws runs on a private server with a PostgreSQL database. Draw results are fetched from public lottery sources; those requests come from the server, not from your browser, so visiting this site does not expose you to them.

Contact

Questions about this notice, or any request about your data, go to info@sagedraws.com.

Changes

If this notice changes in a way that matters, the date at the top will change with it.