Legal
Privacy Policy
Last updated: August 5, 2026
The short version
We store nothing about you. The one thing kept on your device is the site's own code, cached so the tool keeps working offline. There are no accounts, no cookies, no analytics beacon anywhere on this domain, and nothing to sell — we couldn't; we don't collect it. Names, rules and assignments are handled by your own browser and are not sent to us.
Your names and your draw
Nothing you type is transmitted by this site. The whole draw runs with your wifi switched off: the roster, the household and blocked-pairing rules, the feasibility check, the shuffle and the sealing all happen inside your tab, because the site is static files with no backend to send anything to.
Each person's assignment then travels in the part of a URL after the #. Browsers never send that to a web server, so it is not in our logs, not in our host's logs, and not in a chat app's link-preview fetch. A request for sealeddraw.com/open/ looks identical whoever makes it and whatever it carries, which is also why every link's unfurl card is the same.
The names box carries spellcheck="false" deliberately. Some browsers offer an enhanced spell-check that sends the contents of text fields to the browser vendor for checking; that happens below the level of any website and is invisible to this site's own network meter, so the box opts out of it rather than relying on your settings.
Once you send a link, your chat app has it
This is the part most privacy pages leave out, so it is stated plainly here. The moment you paste a sealed link into Slack, Gmail, WhatsApp, iMessage or anything else, that service is carrying it and storing it under its own retention policy, on its own servers, for as long as it keeps messages. Some corporate mail systems also rewrite links they deliver, which means the rewriter sees the whole URL. None of that is something we can change, and none of it involves us — but it is real, and the honest statement is that your messages are as private as the app you sent them in.
The offline cache
A service worker stores the site's own pages, stylesheets and scripts in your browser's cache so that a draw runs with the network off — which is the strongest way to check the claims on this site, because it runs outside our code. The cache is on your device, controlled by you, and clearable through your browser settings at any time. It holds the site's code, never your draw.
The one disclosed exception: this tab's memory
The generator mirrors your own sealed links and the display names they are for into sessionStorage — the browser's per-tab scratch space — while you are distributing them. It is written for one reason: on a phone, a backgrounded tab is routinely discarded by the operating system, and without this a half-distributed draw of twenty people would be destroyed somewhere around row twelve, leaving twelve people holding live links, eight holding nothing, and no way to repair it.
What it holds is only what you already hold as the organizer. It never holds the pairings; there is no giver-to-receiver record in it, and no recipient name. It lives in that one tab and is never sent anywhere. Closing the tab drops it, but browsers that offer "reopen closed tab" can bring it back with the tab, so treat closing as housekeeping rather than erasure. A Forget this draw button clears it immediately. This is a deliberate, disclosed exception to the site's zero-storage default, and it is recorded here rather than being allowed to sit quietly under a slogan.
Nothing else is written to your device by the tool: no cookies, no localStorage, no IndexedDB.
No analytics, at all
This site runs no analytics, and neither does any other site we operate. The reason is specific rather than decorative. An analytics beacon reports the page it fires on, and it runs as JavaScript inside the page — which means that unlike a web server, it can read the part of the URL after the #. Whether a particular beacon chooses to is a promise from whoever wrote it; whether one can run here at all is a property of the header. We prefer the property. There is no configuration of such a beacon that is safe on this domain, so there is none.
That decision is enforced by the browser and not merely by intention: the site's Content-Security-Policy pins connect-src to 'self', so any request to an outside origin fails closed. If analytics ever looks broken on this site, it is broken on purpose. We accept not knowing how many people visit.
Hosting and server logs
The site is served by Cloudflare Pages. Like any web host, Cloudflare processes standard technical data — IP address, user agent, requested URL — to deliver pages and protect against abuse, subject to Cloudflare's privacy policy. Page requests are the only thing a server ever sees, and the part of a URL after the # is not in them.
Advertising
The site currently shows no advertising. If that changes, this policy will be updated first, any advertising will comply with applicable consent requirements, and a consent choice will be presented where required by law. Three pages will stay ad-free whatever happens: the generator, the reveal page at /open/ and the key maker at /code/. A third-party script on any of them could read the draw, so the advertising inventory on this site is the guides, the methodology page and the pages you are reading now.
If you email [email protected], we use your address solely to reply, and we don't add you to any list. Please don't email us sealed links or keep links: a keep link is a private key, and we would rather never hold one. See Contact for what is actually useful in a bug report.
Children
The site is a general-audience utility and does not knowingly collect personal information from anyone, including children.
Changes and contact
If this policy changes, the date at the top changes with it. Privacy questions: [email protected]. The methodology page goes further than a policy can: it sets out, actor by actor, what each party in a draw is able to learn, and where the line falls in each mode.