Privacy: What Happens to the Names You Type

Where names go

Gift wishes entered on the draw page are kept with each person in this organizer's browser. They are included in that person's gift buyer's private link. Anyone holding the whole link can read those wishes, including the organizer. Leave out home addresses and private contact details. Clearing site data or starting a new exchange removes the stored wishes; it does not remove links already sent or browser history.

The list you type, the rules and the details are kept only in this browser, in its local storage, so the list is still there when you come back. Clearing your site data, or pressing "Start a new exchange", deletes them. In private browsing they are deleted when the private session ends, which in most browsers means when you close every private window, not just this tab.

After a draw, this browser also keeps everyone's links so you can send them later, and a note of which ones you sent with the site's buttons. Anyone who uses this browser could open the links from the draw page. Once you've sent them, press "Remove links from this device". When you copy links, the browser also keeps a yes-or-no note that links were copied, with no link or name in it, so that button knows to empty the clipboard too.

Opening a link also leaves a small record in that browser's local storage: the exchange's ID and draw number, with no names and no match, so an older link from the same exchange can show as out of date there. It stays until the browser's site data is cleared.

The link itself stays in the browser's history, like any page you open, and in the history of other devices that sync with that browser. Anyone who uses that browser could open it again from there. On a shared computer or tablet, open your link in a private window, or delete it from the history once you've seen your match.

The draw happens on your device. The page never sends names, pairs, budgets, dates or notes anywhere. Some pages on this site can fill in the draw page for you, for example with a family's households; they pass what you typed through the part of the address after the # sign, which stays in your browser, and the draw page removes it from the address bar as soon as it has read it. The questionnaire, the rules sheets and the planners on the guide pages keep what you type only in the open page and store nothing; it leaves the page only when you copy it, print it, download a calendar file, or send it to another page of this site in the way just described.

How the links work

Each person's link carries their own card inside it, after the # sign. Browsers never send that part of a link to a website's server, and previews that chat apps fetch from their own servers ask for the plain page. So the server only ever sees a request for the plain page, with no names in it. Previews made on your phone do open the whole link, which is why the page keeps the match hidden until the person presses the button.

The card inside the link is scrambled, and the key to it sits at the very end of the link, so the start of a link, as a notification preview or a screenshot might show it, gives nothing away unless almost all of it is showing. Nor does the end of a link, unless a long stretch of it shows. A cut-off link is refused rather than showing the wrong name. The card is not locked with a password: anyone who has the whole link can open it. Send each link only to the person it's for.

Links aren't signed either, so a link can be faked. See "What this page can't check" below.

The WhatsApp, Text, Email and Share buttons, and the "Copy all links" text, also put each person's name next to their link. The chat or email app you use to send a link can see it, just as it sees any message you send, and so could read the card inside. Those buttons only open your own app with the message written; nothing is sent until you send it there.

What this page can't check

This site has no server that knows about your exchange, so a few things can't be checked. It is better to say so than to pretend.

A link can be faked. How the links are built is no secret: the page's own code shows it. So anyone who understands it can make a link that opens a card with any names, budget or note on it, and with a real link from your exchange in hand they can make one that looks like it belongs to the same draw. A fake link with a higher draw number also makes the real link show as out of date on the device that opened the fake. Only a server, or a secret sent some other way, could stop this. So trust the link the organizer sent you directly. If a link shows something you didn't expect, such as a newer draw you haven't heard about or a note that doesn't sound like the organizer, ask them.

The same Chinese name in traditional and simplified characters. The list skips a name typed twice, but it can't always tell that 陳大文 and 陈大文 are the same person. When two names differ only that way, the page adds both and shows a warning, using a short built-in list of about 500 characters common in names. The same goes for a Japanese name written with an old or variant form of a kanji, such as 髙橋 and 高橋. A name with rarer characters isn't caught, and nothing is ever merged on its own, because two people can share a name. Check the list before you draw.

Dense rules on a large group. For groups of up to 16, and for larger groups whose rules keep each person from only a few others (couples, households, last year's pairs), every possible draw is exactly as likely as any other. When a group of more than 16 has rules that keep each person from about eight or more others, such as teams of ten who may not draw within their own team, or two families of 100, the page can switch to a method that is close to fair but not exact. It is furthest from fair when each person may only give to a few particular people in a ring, such as only the next one or two people on the list. Every draw it makes still follows all the rules. Making every draw exactly as likely for any set of rules is a known hard problem in mathematics, so this is a limit, not a bug waiting to be fixed.

Google Analytics

To see which pages people find useful, this site uses Google Analytics 4, a Google service. It runs on every page except two: the page that opens a person's link, and the "page not found" page. It counts page views, how long a page stays open, and whether people scroll most of the way down it. It records no clicks, no searches, nothing typed into a form and no events of the site's own.

For each page view, Google receives the page's address without the part after the # sign, and without anything after the ? sign except campaign tags (the utm_ parameters some links carry); the page's title; the previous page, if it was on this site, or else only the name of the site you came from; and what Google's tag collects by itself, such as your browser, screen size and language. Google works out a rough location from your IP address and says it doesn't store the address in Analytics.

Google never receives names, pairs, links, budgets, dates, notes or anything else you type. Because Google Analytics never runs on the page that opens a person's link, nothing on a card reaches Google. Drawing names, or pressing the WhatsApp, Text, Email or Share buttons, sends Google nothing about the draw or the button. If a button takes you to another app, Google's tag may send how long the page was open, as it does whenever you leave a page.

Visitors in the European Economic Area, the United Kingdom or Switzerland, or in the territories and small states tied to them, get no Google Analytics at all, and neither does anyone whose country can't be told. For them the site leaves it out of every page. The country comes from Cloudflare, the site's host, which reads it from your IP address; the site uses it for this choice only and keeps no record of it. Google Analytics also stays off if your browser sends a Global Privacy Control signal.

Where it runs, Google Analytics sets two cookies for this site, _ga and _ga_ECMDKMN696. They hold a random ID, so that a second visit counts as the same visitor, and last 13 months from your last visit. Google signals and all advertising features are switched off, so the visits aren't linked to a Google account or used for ads. Google deletes the detailed visit data after two months, and what it holds about a random ID two months after that ID's last visit; the page-view totals are kept.

To opt out, install Google's opt-out add-on, or block cookies for this site, which stops a later visit counting as the same visitor. A content blocker, or blocking www.googletagmanager.com, stops Google Analytics altogether. The site works the same either way. How Google uses the data is set out in how Google uses information from sites that use its services and in Google's privacy policy.

Ads and other scripts

This site shows no ads, and no script from any company other than Google runs on its pages. A page with Google Analytics loads only this site's files and Google's tag, and tells the browser to refuse anything else. Every other page, including the page that opens a person's link, loads only this site's files.

If that ever changes, this page changes first, and says what runs, on which pages, and what it can see. Cards for a group marked as including children under 13 carry that mark inside every link, and they will never show ads or shopping links.

What the server sees

The site is a set of files hosted by Cloudflare. Like every request on the web, a request for one of its pages reaches Cloudflare's servers with the page's address (never the part after the #), your IP address and your browser's name and version. The site adds nothing to that and keeps no log of its own. It uses the country Cloudflare gives for your IP address only to decide whether a page includes Google Analytics. Where Google Analytics has set its two cookies, your browser sends them along with each request too; the site doesn't read them. Cloudflare's handling of requests is covered by its own privacy policy.

Questions

Write to hello@secretsantanamegenerator.com. The about page says who runs this site.