Privacy Policy
Last updated September 1, 2026
Who is responsible
STELVY LLC operates randomgiveawaypicker.com and is the controller of the personal data described here.
What we collect
- Account data. Your email address and, if you set one, a cryptographic hash of your password. We never store your password itself. If you sign in with Google we also store the account identifier Google gives us for you; we ask Google only for your email address, and we never receive your Google password.
- Billing data. If you subscribe, Stripe processes your payment and we store your Stripe customer and subscription identifiers plus your subscription status and renewal date. Card numbers never reach our servers.
- Session data. A random session token, stored in your browser as an httpOnly cookie and in our database only as a hash. This cookie is strictly necessary to keep you signed in; we set no advertising or analytics cookies.
- Giveaway data. The public Instagram post you submit, and the public comments read for that draw (username, comment text, public avatar URL, verified flag).
Comments and the people who wrote them
Comment data is fetched from publicly visible posts, used to run your draw, and deleted automatically within two hours. We do not build profiles of commenters, do not sell this data, and do not use it to contact anyone.
Why we may process this data
To provide the Service and perform our contract with you (accounts, draws, subscriptions), to comply with tax and accounting duties, and, for basic abuse prevention such as rate limiting, on the basis of our legitimate interest in keeping the Service available.
How long we keep it
- Comment data from a draw: deleted within two hours.
- Sessions: expire after 30 days, or immediately when you sign out.
- Account and subscription records: kept while your account exists, then deleted, save for transaction records we must retain for tax purposes.
Who we share it with
Stripe (payments), Google (only if you choose to sign in with Google), our hosting provider, and the third-party Instagram data provider used to read public post and comment data. We do not sell personal data.
Your rights
Depending on where you live, you may have the right to access, correct, export or delete your personal data, and to object to certain processing. To exercise any of these, or to have your account deleted, contact [email protected].