Legal

Privacy Policy

Last updated: September 23, 2026

The short version

We store nothing about you. The one thing kept on your device is the site's own code, cached so the tool keeps working offline. There are no accounts, no cookies and no analytics beacon anywhere on this domain. We don't collect your data, so there is nothing to sell. Names, rules and assignments are handled by your own browser and are not sent to us.

Your names and your draw

Nothing you type is transmitted by this site. The whole draw runs with your wifi switched off: the roster, the household and blocked-pairing rules, the feasibility check, the shuffle and the sealing all happen inside your tab, because the site is static files with no backend to send anything to.

Each person's assignment then travels in the part of a URL after the #. Browsers never send that part to a web server, so it is not in our logs, our host's logs or a chat app's link-preview fetch. A request for sealeddraw.com/open/ looks identical whoever makes it and whatever it carries, which is also why every link's unfurl card is the same.

The names box carries spellcheck="false". Some browsers offer an enhanced spell-check that sends the contents of text fields to the browser vendor for checking. That happens below the level of any website, so this site's own network meter cannot see it. The attribute opts the names box out of it, whatever your browser settings are.

Once you send a link, your chat app has it

When you paste a sealed link into Slack, Gmail, WhatsApp, iMessage or anything else, that service carries it and stores it on its own servers, under its own retention policy, for as long as it keeps messages. Some corporate mail systems also rewrite the links they deliver, so the rewriter sees the whole URL. We cannot change any of that, and none of it involves us. Your messages are as private as the app you sent them in.

The offline cache

A service worker stores the site's own pages, stylesheets and scripts in your browser's cache so that a draw runs with the network off. Running a draw offline is the strongest way to check the claims on this site, because that check runs outside our code. The cache is on your device, under your control, and you can clear it through your browser settings at any time. It holds the site's code and nothing from your draw.

The one disclosed exception: this tab's memory

While you are sending links, the generator mirrors your own sealed links, the display names they are for and any manual sent checkmarks into sessionStorage, the browser's per-tab scratch space. A copy or share action never marks delivery automatically. The mirror exists for one reason: on a phone, the operating system routinely discards a backgrounded tab, and without the mirror a half-distributed draw of twenty people would be destroyed somewhere around row twelve, leaving twelve people holding live links, eight holding nothing, and no way to repair it.

It holds only what you already hold as the organizer. It never holds the pairings: there is no giver-to-receiver record in it, and no recipient name. It lives in that one tab and is never sent anywhere. Closing the tab drops it, but browsers that offer "reopen closed tab" can bring it back with the tab. To erase it, press Forget this draw, which clears it immediately. This is the one exception to the site's zero-storage default.

The tool writes nothing else to your device: no cookies, no localStorage and no IndexedDB.

No analytics, at all

This site runs no analytics, and neither does any other site we operate. An analytics beacon reports the page it fires on, and because it runs as JavaScript inside the page, it can read the part of the URL after the #, which a web server never receives. Whether a beacon reads it is up to whoever wrote the beacon, so no configuration of one is safe on this domain, and the site has none.

The browser enforces this. The site's Content-Security-Policy pins connect-src to 'self', so any request to an outside origin is blocked. We accept not knowing how many people visit.

Hosting and server logs

The site is served by Cloudflare Pages. Like any web host, Cloudflare processes standard technical data (IP address, user agent, requested URL) to deliver pages and protect against abuse, subject to Cloudflare's privacy policy. Page requests are the only thing a server ever sees, and the part of a URL after the # is not in them.

Advertising

The site shows no advertising. Ad space is set aside on the guides, the methodology page and pages like this one. Three pages have none: the generator, the reveal page at /open/ and the key maker at /code/. A third-party script on any of them could read the draw.

Email

If you email hello@sealeddraw.com, we use your address only to reply, and we don't add you to any list. Please don't email us sealed links or keep links: a keep link is a private key, and we would rather never hold one. Contact lists what to include in a bug report.

Children

The site is a general-audience utility and does not knowingly collect personal information from anyone, including children.

Changes and contact

The date at the top shows when this policy last changed. Privacy questions: hello@sealeddraw.com. The methodology page sets out, actor by actor, what each party in a draw is able to learn, and where the line falls in each mode.