Privacy: What Happens to the Names You Type

Where names go

The list you type, the rules and the details are kept only in this browser, in its local storage, so the list is still there when you come back. Clearing your site data, or pressing "Start a new exchange", deletes them. In private browsing they are deleted when the private session ends, which in most browsers means when you close every private window, not just this tab.

After a draw, this browser also keeps everyone's links so you can send them later, and a note of which ones you sent with the site's buttons. Anyone who uses this browser could open the links from the draw page. Once you've sent them, press "Remove links from this device". When you copy links, the browser also keeps a yes-or-no note that links were copied, with no link or name in it, so that button knows to empty the clipboard too.

Opening a link also leaves a small record in that browser's local storage: the exchange's ID and draw number, with no names and no match, so an older link from the same exchange can show as out of date there. It stays until the browser's site data is cleared.

The link itself stays in the browser's history, like any page you open, and in the history of other devices that sync with that browser. Anyone who uses that browser could open it again from there. On a shared computer or tablet, open your link in a private window, or delete it from the history once you've seen your match.

The draw happens on your device. The page never sends names, pairs, budgets, dates or notes anywhere. Some pages on this site can fill in the draw page for you, for example with a family's households; they pass what you typed through the part of the address after the # sign, which stays in your browser, and the draw page removes it from the address bar as soon as it has read it. The questionnaire, the rules sheets and the planners on the guide pages keep what you type only in the open page and store nothing; it leaves the page only when you copy it, print it, download a calendar file, or send it to another page of this site in the way just described.

How the links work

Each person's link carries their own card inside it, after the # sign. Browsers never send that part of a link to a website's server, and previews that chat apps fetch from their own servers ask for the plain page. So the server only ever sees a request for the plain page, with no names in it. Previews made on your phone do open the whole link, which is why the page keeps the match hidden until the person presses the button.

The card inside the link is scrambled, and the key to it sits at the very end of the link, so the start of a link, as a notification preview or a screenshot might show it, gives nothing away unless almost all of it is showing. Nor does the end of a link, unless a long stretch of it shows. A cut-off link is refused rather than showing the wrong name. The card is not locked with a password: anyone who has the whole link can open it. Send each link only to the person it's for.

Links aren't signed either, so a link can be faked. See "What this page can't check" below.

The WhatsApp, Text, Email and Share buttons, and the "Copy all links" text, also put each person's name next to their link. The chat or email app you use to send a link can see it, just as it sees any message you send, and so could read the card inside. Those buttons only open your own app with the message written; nothing is sent until you send it there.

What this page can't check

This site has no server that knows about your exchange, so a few things can't be checked. It is better to say so than to pretend.

A link can be faked. How the links are built is no secret: the page's own code shows it. So anyone who understands it can make a link that opens a card with any names, budget or note on it, and with a real link from your exchange in hand they can make one that looks like it belongs to the same draw. A fake link with a higher draw number also makes the real link show as out of date on the device that opened the fake. Only a server, or a secret sent some other way, could stop this. So trust the link the organizer sent you directly. If a link shows something you didn't expect, such as a newer draw you haven't heard about or a note that doesn't sound like the organizer, ask them.

The same Chinese name in traditional and simplified characters. The list skips a name typed twice, but it can't always tell that 陳大文 and 陈大文 are the same person. When two names differ only that way, the page adds both and shows a warning, using a short built-in list of about 500 characters common in names. The same goes for a Japanese name written with an old or variant form of a kanji, such as 髙橋 and 高橋. A name with rarer characters isn't caught, and nothing is ever merged on its own, because two people can share a name. Check the list before you draw.

Dense rules on a large group. For groups of up to 16, and for larger groups whose rules keep each person from only a few others (couples, households, last year's pairs), every possible draw is exactly as likely as any other. When a group of more than 16 has rules that keep each person from about eight or more others, such as teams of ten who may not draw within their own team, or two families of 100, the page can switch to a method that is close to fair but not exact. It is furthest from fair when each person may only give to a few particular people in a ring, such as only the next one or two people on the list. Every draw it makes still follows all the rules. Making every draw exactly as likely for any set of rules is a known hard problem in mathematics, so this is a limit, not a bug waiting to be fixed.

Ads and cookies

This site shows no ads, runs no analytics and sets no cookies. No script from another company runs on any of its pages: every page loads only files from this site, and each page tells the browser to refuse anything else.

If that ever changes, this page changes first, and says what runs, on which pages, and what it can see. Cards for a group marked as including children under 13 carry that mark inside every link, and they will never show ads or shopping links.

What the server sees

The site is a set of files hosted by Cloudflare. Like every request on the web, a request for one of its pages reaches Cloudflare's servers with the page's address (never the part after the #), your IP address and your browser's name and version. The site adds nothing to that and keeps no log of its own. Cloudflare's handling of requests is covered by its own privacy policy.

Questions

Write to hello@secretsantanamegenerator.com. The about page says who runs this site.